>> This is Module 1,
Lesson 5, Mapping to a Narrative Report.
Our objectives for this lesson
are to give you some practice
identifying tactics, techniques,
and sub-techniques in a narrative report
if you're working with somebody else to
be able to compare your results to
another analyst's outcomes and
review the exercise results.
This is Exercise 1.
We're going to have you actually take
a narrative report and map
to attack tactics and techniques.
I'm going to have you analyze a portion of
a threat report going through
the process that we've been
covering the rest of this module.
We've highlighted 21 techniques and sub-techniques
in a threat report called Cobalt Kitty by Cybereason.
You're going to review the report.
It should be under the Resources tab in the system.
There will be two versions of the report,
one called Cobalt Kitty Highlights
Only and one called Cobalt Kitty Tactic Hints.
You can use either.
The tactic hints tell you
what we would suggest the tactic is,
whereas the highlights only is
the harder version where you're going to
have to come up with both.
It's a PDF.
If you're using the right reader,
you should be able to actually fill in
the fields in the PDF
itself or use a separate piece
of paper to keep track of your results.
Write down the attack tactic and technique or
sub-technique you think applies
to each highlighted behavior.
Remember, use the tricks and tips
that we've given you throughout the rest of this module.
Do search bar in keyword searches, the ATT&CK website.
You don't have to be perfect
and there isn't necessarily a right answer.
You may actually come up
with different things than we do.
You may feel that some of the behaviors we've
highlighted aren't really covered in any techniques.
This also can be an opportunity to dive into
ATT&CK and take a look at
some of the actual content in there.
Please pause the video now.
We recommend giving yourself up to
30 minutes to do this exercise.
Done with that part of the exercise?
We've got one more step for you
if you're doing this training working with others.
We said it was going to
be something that went up to step 5.
The step we didn't cover yet in
the training is to
compare your results with other analysts.
Collaboration helps hedge against analysts' biases.
Everyone has different types of biases.
We'll cover some of those in the next lesson.
But comparing with others can help
us come up with better answers.
If you do have somebody to work with,
compare what you had for each technique answer.
Discuss if there are differences, why?
How did you each arrive at your conclusions?
It is okay if you walk away disagreeing.
This is analysis at the end of the day.
If you do have somebody to work with, please pause.
I suggest giving yourself
10 minutes for this part of the exercise.
If you don't have any other analysts
to discuss your answers with,
you can go on to the next portion.
As we start to get
into what you came up with for answers on the exercise,
some things to think through.
What were the easiest and hardest techniques
or sub-techniques to identify?
Why were those easier or harder for you?
Which tricks did you use to
identify each technique or sub-technique?
What challenges did you have?
Was there anything you couldn't find?
How did you address them?
Which steps did you go
through in trying to figure it out?
I'm going to go through what our answers
were for the highlighted portions of the threat report.
Two types of payloads were found
in the spear-phishing email.
It said it was a link and it says to be
initial access spearphishing link.
Right next to that we also had
spearphishing emails, Word documents.
Let this be initial access-phishing,
spearphishing attachment.
Both of those are pretty straightforward.
Two types of payloads are found
in the spearphishing emails,
Word documents with malicious macros.
Let's take a little bit more understanding
of macros and languages behind them.
But if you dig into the details,
you'll probably find defense evasion/execution,
command scripting interpreter, Visual Basic,
which is language behind Word macros.
Finally, maybe a little bit less obvious,
two types of payloads were
found in the spearphishing emails.
Report goes on to describe these as successful attacks,
implying that the user clicked on the email.
Something that might attack as we do
our own report mappings is that we would add
a user execution malicious link.
We highlighted the command.exe
being the parent process here,
which is the Windows command shell.
This is execution commanding
scripting interpreter Windows command shell.
This talks about scheduled tasks being created on
Windows and execution and
persistence scheduled tasks/job,
scheduled task, which is
the Windows specific version of scheduled task.
Right in this command here we
actually have mshta directory.
We've got execution/defense evasion-signed
binary proxy execution, mshta.
Write in the name of the technique.
Downloads and executes an additional payload
from the same server.
Downloads tools come straight into Ingress Tool Transfer.
Very similar to the command.exe,
we had a parent process of PowerShell.
This is Command and Scripting Interpreter-PowerShell.
Obfuscated and XOR'ed PowerShell.
The words line up right with the technique name,
obfuscated files or information,
write in defense evasion.
Registry autoruns.
This is an example gave actually in the introduction
even to register running keys/startup folder,
which is a sub-technique of boot or login
autostart execution in the persistence tactic.
NTFS Alternate Data Stream is directly in
the NTFS File Attributes
technique which comes under defensive evasion.
Attackers created and/or modified Windows services.
Created and modified are both in there,
so create or modify system processes Windows service.
Also had actually running the service itself,
so system service execution, both under persistence.
Used a malicious Outlook backdoor macro,
edited a specific registry value.
That's a pretty specific technique that's under
Office application startup within persistence.
Then the registry modification
we have under defense evasion.
Communicated with command and control servers,
so strong hint here that were in command and
control from command and control servers.
Then we have that it's HTTP,
so web protocols, application layer protocol.
The attacker is downloaded COM scriptlets using regsvr32.
We have again Ingress tool transfer
for the downloading of the tools.
Then with the regsvr32,
that's signed binary proxy execution regsvr32.
Masquerading is a specific technique.
The technique is masquerading.
If you look more carefully at what they're doing,
they're making it look like a legitimate Windows update.
It match legitimate name or location.
Network scanning, looking for open ports,
that's network service scanning under discovery.
How did you do? If you feel like you would
like some more practice or even
if you just have a little bit of extra time,
we've actually provided a second report
that we've highlighted in a very similar fashion.
We don't give tactic hints in this version.
We do have our answers
in there as well in a separate PDF.
So this will show up in
the resources section as the FireEye APT 39 report.
I'm not going to go over
the answers to that in this lesson.
Hopefully in this lesson you've gotten
some practice identifying tactics,
techniques, and sub-techniques in a narrative report,
talked a little bit about the importance
of comparing your results to
another analyst's outcomes and gone
through and evaluated the exercise results.