For less than three point two, we'll
be learning how to express insta
attack that intel.
Our objectives for less than three
point two are to review methods for
expressing and storing mapped Intel
and to identify the most effective
approach for your environment and
requirements.
Here we have an example of a threat
intelligence report from the company
Anomaly.
This report discusses new malware in
the different types of systems that
it targets and what kind of behavior
is exhibited by it.
The important point to notice here
is that the report not only
describes the new threat
intelligence information in full
text for human consumption,
but they also provide links to the
attack site, to their techniques for
more of a machine and automated
consumption path.
Placing the techniques at the end of
the report is helpful for analysts
not only consume this data, but
to be able to take it and make it
more actionable.
It also helps us standardize how we
talk about specific malware
behaviors so that we can help keep
the community better equipped to
understand different malware
techniques.
One caveat to point out is that this
page has been updated to reflect
some.
So please confirm the actual
technique I.D. with our official
website.
This is an example of a threat
intelligence report from McAfee, but
they look at the operation go secret
campaign for the support.
They list all the procedure examples
from attack at the bottom of the
report, just like we saw in the
previous slide.
But what we see here is that they
also have an extra layer of detail
where they explain how the adversary
used these techniques within their
campaign.
So this is very useful for our
analysis beyond just listing the
techniques.
This is an example of a threat
report from Crown Strike.
The main difference here is that
they list the techniques at the
beginning without the procedure
examples.
So it might be better for someone
looking specifically for technique,
but not necessarily any more of a
procedure level detail.
So they're just looking for the high
level. What are the techniques
observed here?
We don't know how they were used,
but we just want to know which ones
are here so we can determine what's
important for our analysis needs.
The next report we're going to look
at is a report from another
way that threat intelligence reports
will relate back to attack is that
they'll highlight the techniques
within the report as they're
identified.
This is the most useful as it easily
helps the analysts understand which
attack techniques are being shown
and leaves less way for confusion or
misidentification of the techniques
as you read and consume different
threat intelligence reports.
And this is an example of expressing
strong attack map data from a
Digital Shadows Threat intelligence
report here.
They not only had the attack
technique and tactic, but they also
include advice for mitigating the
behavior once it's been detected.
This is just an additional layer of
information to help your analysis
as you read through these reports.
For this example of attack metadata
being expressed and stored, we see
recorded future's way of visualizing
the workflow, well, being able to
apply the attack framework to it,
they show the visualization of the
execution of Meitner tips for
financial threat groups.
They represent these attack
techniques and software over linear
time. So the timestamps are included
as well at the bottom, giving it
lots of detail for analysts to
consume, but in a more manageable
way.
Another great resource for
expressing story in tech that Intel
is Unit 40 two's playbook viewer,
what they do here is they showcase
their threat intelligence reporting
in an interactive Web page that
links the attack techniques to
indicators of compromise that sort
of brings everything together full
circle from human readable text to
machine readable content, all in one
platform.
Another example we have for
expressing storying attack map data
is from the NCC Group Under Threat
Report for about 15
here. We've highlighted the text,
much like you saw in your previous
exercises where the attack
techniques exist.
They didn't do this on their own,
though, which would make it a lot
harder to identify and correlate
these techniques to the attack site.
So this is a report we'd have to do
a little bit more work beyond just
reading the threat intelligence
report from the website.
To summarize what we learned in less
than three point two, let's review
our main highlights, we learned to
consider how attack that intel will
be consumed, linked, contextualized
and imported and exported.
The second is that we reviewed the
internal and external storage
platforms based on the environment
and requirements we're working with.