>> Welcome to Module 3,
Lesson 2, Detection and Analytics.
In this lesson, we will explore how ATT&CK and
cyber threat intelligence can help us
prioritize techniques
and build better detection analytics.
Building from our last lesson,
we can use cyber threat intelligence to prioritize
which tactics and techniques
are most critical for us to defend.
In this example, we'll focus on credential access,
Specifically that LSASS memory sub-technique
of OS credential dumping.
We can use the data within
attack to begin to identify the trends,
and in this case, how often
this sub-technique is executed with the Mimikatz tool.
Before we begin our detection engineering process,
let's look back at David Bianco's pyramid
of pain for wisdom and advice.
While we could target hash values,
Mimikatz, as we recall,
these values could change very often and
won't inflict much pain back to the adversary.
We can continue to work our way up the pyramid of
pain until eventually we reach the top,
we ask the tough question,
what does Mimikatz actually do?
ATT&CK can help answer that question.
The description of this sub-technique will
explain how adversaries can
dump credentials from LSASS memory.
But in this case, we can also use the detection section,
which highlights the potential for detecting
this behavior by capturing
processes interacting with LSASS.
Highlighting example of writing
a behavior-based analytic,
it's to use the cyber analytic repository
or car project from MITRE.
Its analytics is available online
and the URL is at the bottom.
But as you can see, the description of this analytic is
focusing on the behavior
specifically captured within that sub-technique.
As we identified from
the detection section of the sub-technique,
we're going to want to focus on
processes that access LSASS.
In this case, you can see
this analytic does exactly that.
With that, we've reached the end
of this lesson and the knowledge check.
When building detection analytics,
the knowledge in ATT&CK can?
Please, pause the video and think of
the correct response before proceeding.
In this case, the correct answer was
d. When building detection analytics,
the knowledge in ATT&CK can
help provide defensive suggestions,
highlight variances and procedures,
and explain technical details of the target behavior.
With that, we've reached the end of Lesson 2.
In summary, cyber threat intelligence can
help us prioritize how we build detection analytics,
by pointing out which techniques or
sub-techniques are most important to us,
as well as how adversaries
actually perform in this behaviors.
Finally, knowledge from
ATT&CK can augment this process,
and improve output by helping
us focus on adversary behaviors.