>> This is Module 1, Lesson 4,
ATT&CK mapping process:
identifying techniques or sub-techniques.
In this lesson, we have three objectives.
The first is to learn key strategies for
identifying techniques and sub-techniques.
We're going to go over some examples of
working with these strategies
with texture and actual report,
as well as some of the external resources that you
might use as you take a look at this.
Our overall hope is that you get out of this,
the ability to identify techniques and
sub-techniques in narrative reporting,
so step 4 of the process we gave in Lesson 1.
On to step 4. This is often
the hardest step in
the mapping process that we gave in the first lesson.
Techniques and sub-techniques are
not always easy to identify.
There are a lot of them in ATT&CK.
The process we've gone through so far in
the first few steps
is in order to try to make this better.
Also, some techniques may
appear in ATT&CK multiple times.
This is reflected throughout ATT&CK,
where an adversary may be trying to do one of
a couple of different things with a particular behavior.
For example, hijack execution flow and all of
its sub-techniques fall under persistence,
privilege, escalation, and defense evasion.
Because there are a couple of different reasons why
an adversary may actually use these behaviors.
Not every behavior that you're going to find in
every report is necessarily
a technique or sub-technique in ATT&CK.
It may be not a match with the tech scope.
It could be something outside
of the technical space that ATT&CK lives in,
it could be something more like just
providing indicators compromise to an analyst,
and not every behavior that could be mapped is
actually malicious activity by an adversary.
Contexts can be key for determining this and
taking a look at what it is
the adversary is trying to accomplish.
You can take a look at
tools that the adversary is using,
and isn't actually a hostile adversary usage.
Are they trying to meet one of those tactics in ATT&CK?
It's also true that not
every possible technique is documented.
One of the goals of ATT&CK is to describe seen
in the wild adversary behaviors, and so for that reason,
if it hasn't been given to us before from
threat intelligence reporting or contributed to ATT&CK,
it might not be an ATT&CK.
Now that said, if you are finding behaviors and reporting
that are coming from actual adversaries
and you're not finding them in ATT&CK,
might be a great opportunity to
contribute those to us
so they will be an ATT&CK in the future.
I'm going to get into three key strategies
that you can use in order to try to
find this specific technique and
sub-technique to map to an ATT&CK.
The first is to take what you've already been doing in
the previous steps and looking at
the list of techniques and
sub-techniques for the tactic or tactics you
previously identified because that'll
get you down to a much smaller portion of ATT&CK.
Get into a little bit of just searching
the attack.mitre.org website directly.
We have a lot of text in there,
and it may help you key in on
the specific technique or
sub-technique that you're looking for.
Finally, if that's not working,
taking a look at how ATT&CK actually is doing mappings.
We have thousands of examples in this point
of adversary behavior from reports map to ATT&CK.
Just taking a look at how
we're actually doing that ourselves.
Strategy 1, taking a look at the list of
techniques and sub-techniques in
the tactic that you previously identified.
As you take a look,
you're going to find that ATT&CK these days actually has
two levels of technique; techniques and sub-techniques.
Now, sub-techniques are just more specific techniques.
They have all the same fields,
the same properties as techniques.
But we recommend that as you're mapping to ATT&CK,
that you get down to the lowest level
of detail that you're able to.
That is, if there is
both a technique and a sub-technique that applies,
we recommend going down to the sub-technique.
Take a look at the behaviors in the given tactic.
It's going to give you a much smaller list of
techniques and sub-techniques then
you have looking at of all ATT&CK.
Now, this is even more true in something like
initial access or impact
where there's only a few techniques there,
but there's still quite a few there,
if you're looking at something like defense evasion.
As you go through, you can take a look at details
that are in the first paragraph of each of the reports.
Sometimes it may not make sense to go
all the way down to the sub-technique at first,
sometimes it may be that
it's fairly obvious what technique applies,
then you need to open it up, take a look,
and see if there are sub-techniques that actually match.
Other times, if something really
specifically maps to a given sub-technique,
you may be able to go directly to that level.
It may be that you're actually
working your way back up where you were
first able to identify a sub-technique directly,
and then work back up to the technique.
If that fails, if you're not finding what you're looking
for in the tactic that you
believe that the adversary was doing,
it might be worth looking
across the entire ATT&CK website.
We have a lot of text in ATT&CK that
is both describing the adversary behavior itself,
as well as a number of examples where we've mapped
adversary behavior already to specific techniques.
This can be things like just
using your favorite search engine
to search the attack.mitre.org website
using Control F keyword searches across
different lists of techniques looking for
text and the technique name itself.
You can also take a look at procedure level details.
In a lot of cases,
we may have mapped something that came from
very similar texts to
what you're looking for from the report you have,
and it can be worth trying specific command strings.
We have a lot of
example commands in ATT&CK at this point,
they may match up exactly
with what you're seeing and adversary do.
If that fails,
it may be worth backing up a step and taking
a look at how
we're actually mapping techniques to ATT&CK.
If you get into some of the groups and software pages
on ATT&CK or techniques
and looking at procedure examples,
you can actually see some of how
the ATT&CK team is
taking details from reporting and mapping them to ATT&CK.
It may be helpful to just take
a look at how we're doing it,
and it may be useful as a hint
to take another direction forward.
Let's get into some examples of
actually using some of these strategies.
In that report that we've looked
at in the previous lessons,
we had a couple of these phrases
in there that we've already highlighted.
Used email attachments,
created scheduled task, installed tools.
These are terms that you can search in
ATT&CK and you'll find directly
appearing in different techniques.
For example, used email attachments.
You'll find that directly in
phishing, spearphishing attachment,
which is sub-technique 1566.001.
If you'll look for create scheduled task,
you'll find scheduled task/job, T1053.
Now, if you then go in and look at
the sub-techniques of that technique,
look at the details around create scheduled task,
you'll find that you can probably get all the
way down to T1053.005.
Another level down. Installed tools.
Again, you'll find directly in
ingress tool transfer, T1105.
If I search for SOCKS5 in ATT&CK,
I may or may not find an appropriate matching technique.
But so if, for example,
I look for just SOCKS,
I come up right in non-application layer protocol,
where we describe SOCKS
as a non-application layer protocol.
It is directly in the technique description itself.
You also would have found it from
the specific tactics that you've gotten down into.
Again, it's a fairly direct finding.
Maybe you're just looking at cross technique lists.
One of the things we highlighted earlier was,
establishes a SOCKS5 connection using TCP port 1913.
Well, I want to see what using
port might actually be in ATT&CK.
We've already figured out that
that's command and control.
Let's take a look at our technique list.
If I look for port,
I come up with nonstandard port and port knocking.
If I get into the descriptions,
this is not port knocking.
Port knocking is when an adversary connects to
a series of specific numbered ports,
which opens a connection on the given system.
Now, nonstandard port on the other hand,
we had already taken a look at 1913.
We'd done some research.
We recognized that it was not a normal port to be using,
and this maps down to nonstandard port.
From this one little phrase,
we've actually been able to come up with two techniques;
non-application layer protocol, and nonstandard port.
Backing all the way back to
that piece of report that we started with here.
We've got this, establishes
a SOCKS5 connection using TCP port,
where we've come up with
tactics and techniques for that one little portion.
Now, for now, let's check.
Take a look through the rest of this,
and see what techniques you're able to identify.
Please pause the video, take a look,
see what you're able to find,
and in a minute, I'll give you what my answers would be.
Going back to the behaviors that
we highlighted earlier in the module,
we have a successful exploitation.
We've given a user system access on the machine.
This is privilege escalation,
exploitation for privilege escalation.
We had that the malware is using
command.exe in running a specific command.
Well, the command.exe part,
you'll find directly in command and
scripting interpreter Windows command shell,
and the command that's being run
is system owner/user discovery.
Again, we can find scheduled task jobs, scheduled task.
If we get into first the technique from
the specific phrase and then get into
the sub-technique that is Windows specific.
How did you do? Hopefully,
you've gotten some strategies out of this
for identifying techniques and sub-techniques.
We've taken a look at how we can actually apply those,
dig some of the information out of the ATT&CK website,
and some of the resources you might be able
to use for doing this.
We're giving you a little bit of practice,
identifying techniques and
sub-techniques in narrative reporting.
We'll get into some more practice
on doing that in a moment.