>> Welcome to lesson 2.3,
Translate Behaviors to
Tactics Techniques and Sub-techniques.
In this lesson, our objectives
are developing the ability to take
the behaviors we identify in
raw data and map them to the relevant tactics,
techniques, and subs.
Then we'll be reviewing concurrent techniques and
reinforcing the importance of
peer review for attack mappings.
In this step, we're going to be going through and
translating the behaviors and the tactics.
With ipconfig/all, this was
a relatively specific procedure that we previously
found under System Network Configuration Discovery
and that falls under the discovery tactic.
Although we've identified the tactic, we're not done.
As we noted while reviewing the data,
it was seen being run via Sysmon,
and so this also falls under the execution tactic.
For the next behavior, the recycler.exe,
that's being run via the command line
and we see via Sysmon,
and we align the pieces of our research analysis
together to identify what we think is the tactic.
We ascertained that it's trying to pretend that it's
a Visio diagram and we have
moderate confidence that this is exfiltration.
If we were able to leverage
some more information and other
data sources and run this,
it might enrich our analysis
and add some additional details.
But based on what we've found,
it also maps to execution as well.
Step 4, figuring out what
technique or sub-technique applies.
Similar to what was covered in
Module 1 about working with narrative reporting,
you might have enough information
occasionally to map directly to
a certain technique or sub-technique
instead of going through a tactic.
But we need to try and work through
that structure process and avoid skipping steps.
If you do map directly to a technique or sub,
make sure you go through and
confirm that it aligns with a tactic that
best represents your understanding
of the adversary goals.
For ipconfig/all, we found that
this maps to system network configuration discovery,
and as I mentioned, adding an execution,
we have that it's command and scripting interpreter.
Then for the recycler binary,
we've identified a couple of different elements.
We figured out these command line flags
mean it's compressing and encrypting data,
so we mapped it to archive collected data.
But as discussed, it's
also command and scripting interpreter.
What's going on with these concurrent techniques?
There are certain tactics that
commonly have concurrent techniques.
These are tactics like execution,
defense evasion, initial access, collection,
where a lot of the techniques are
describing how things are
happening and other techniques
are describing what's happening.
A combination and we often see
is phishing: spear phishing,
attachment, and user execution.
The spear phishing is often coming with
attachment and a user clicks,
this is user execution.
This is initial access and execution happening together.
Data from local system and Ebell collection
can be leveraged in concert, so for example,
an adversary is identifying a hosting a PST file,
so two types of collection are occurring simultaneously.
Finally, as we've seen,
many of those discovery techniques
can be command in scripting interpreter,
with Windows built-in commands
being run one after another.
In our final step will want to compare
our analysis to the results for other analysts.
We discussed collaboration end up in
the last module to help hedge against biases.
This is particularly important with raw data,
given the fact that raw data requires a broader set
of skills to work with the different types of data.
You might have one analyst who has
experience working with things like malware packets,
reverse engineering,
and Windows command line and
understanding what barriers commands do.
We might have another analysts needed
for the same incident who's
very familiar with other platforms
such as MacOS or Linux,
or whose skill sets includes looking at
this forensics and Windows event logs.
Based on the additional caveats with raw data,
it's really critical to
recognize the diverse set of skill sets,
you'll likely need to be able to leverage them
and ensure that the analysis is as accurate as possible.
In Lesson 2.3, we walked through the process for
translating behaviors from raw data
into tactics, techniques and subs.
We talked about concurrent techniques
and the importance of recognizing
what's happening as well as how
it's happening and finally,
we highlighted how important it is to
maintain ongoing collaboration with
analysts that have a diverse skill sets
and experience working with different types of data.
In Lesson 2.4,
we'll take what we've learned so far and
apply it to a mapping exercise.