This is module for lesson to
research how techniques and sub
techniques are being used
and defensive operations for dealing
with them.
So if two objectives for this
lesson, hopefully, that you
learn the approach for identifying
how techniques and sub techniques
are being used in relevant
situations and
understanding of how to research the
associated defensive options for
those techniques and sub techniques.
So research how techniques and some
techniques are used.
So this is important in
creating our defensive
recommendations.
If we're taking a cyber threat
intelligence approach, we want
to make sure that the defensive
recommendations we eventually come
up with line up with
what the adversaries are actually
doing.
So this is getting down to the
procedure level of
how a technique is being used by an
adversary.
So it's really important that as we
create our defensive
recommendations, if they actually
overlap with what an adversary is
doing, because it's entirely
possible that there are
ways of doing a technique
that have no relevance to how our
adversaries are actually doing them.
So let's start with taking a look at
the reporting that we pulled these
techniques from the first place.
So this is the Apte thirty nine
report where
thirty nine leverages spearfishing
emails with malicious attachments
and or hyperlinks.
This is leading up to user
execution, both of malicious
link and malicious attachment.
OK, so spearfishing,
going back to Cobalt kidI
spearfishing emails, links to
malicious sites or weaponized word
documents.
OK, again, our user
execution is coming from
spearfishing, so that's
at least in the examples that we're
looking at. It looks like spear
fishing is going to be pretty
important.
Well, let's take a look at some
broader examples.
So this is the user execution
technique page on attack
Apte 30 to
spearfishing emails
if thirty three spearfishing emails,
spear fishing emails.
Links to Israel hosting malicious
content, emails,
emails, spearfishing,
and if you go through the rest of
the procedure, examples in
use or execution, there's a theme
here over and over and over again.
The way that adversaries are getting
people to click on stuff is
spearfishing.
So whatever we do, it looks
like it's going to be really
important that it is
able to deal with spearfishing.
So we know that we need
to be able to deal with spearfishing,
how do we pull together some
of our options for dealing with
user execution?
There are a lot of different sources
out there that provide defensive
information, its index to
attack its part of the value of
putting your intelligence into
attack in the first place.
I'll go through a few examples of
where you can get data from attack
itself.
So things like our data
sources, detections,
we list mitigations
on each technique.
And then there are a lot of
references on each technique
and sub technique, which may have
their own recommendations for how to
deal with something.
We have our own analytic repository
called the Car or Cyber Analytics
Repository, where we have
specific analytics that are linked
to a number of attack techniques
for how to detect them in something
like a SIM.
There are a number of other free
resources out there, though, that we
have no role with that have taken
attack, have map to it, have
given a bunch of defensive
recommendations, just as
a couple of examples of ones you can
leverage for free.
Roberto Rodriguez's threat playbook,
atomic threat coverage.
But there are a number of other
resources out there that
are linked to attack these days.
And this is just the starting list.
Absolutely supplement with your own
research.
Take a look at how a
technique looks in your own
environment, the footprint it
leaves, and how it is
that you'd actually see it in your
sensing.
So getting into some specific
examples from attack,
so this is the high level technique,
user execution,
the first thing we told you to look
at was data sources.
And so this has all the data
sources that are in the sub
techniques, as well as the
technique itself suggests you
might be able to look at in a virus
process, command line parameters,
process monitoring
as ways of seeing this activity.
You can also get into
some of the specific data sources
that might be useful to a sub
technique, so taking
a look at things like a Web
proxy or some
of the same tech data
sources that are going to be
relevant to the parent.
Another section we suggested looking
at his mitigations, and
these are different ways of
potentially stopping the activity
from happening in the first place,
not just being able to detect
it, but prevent it.
So things like application control,
you may be able to
only allow specific executables that
you're aware of to run in your
environment. So things coming in
from the outside via spearfishing
wouldn't run.
It ranges from different
technical sources, both
network and host, based
to things like user training,
teaching your users to identify
spearfishing emails.
It may be a way to keep them from
clicking on them, since that's the
most common way they're coming in
the door.
We also have given some ways to
detect this activity,
so to be able to tell that it's
happening at some different level
so that things like looking at the
command line arguments, looking
at how files are executed on a given
system, seeing things
like compression applications,
being used to unpack, unwrap various
pieces of malware coming in
using things like antivirus,
detect malware in the first place,
as well as other types of endpoint
network sensing.
Mention the references on
each of these pages to
and so the different user execution
pages have a ton of different
references coming both from
procedure examples as
well as from the description
of the technique itself.
And each of these may have its
own recommendations for how to
actually detect the activity going
on.
So taking these together and looking
at some of the other resources that
we mentioned, we're starting to
build up a list of defensive
options, different things that we
can do to have an impact
on this adversary.
So pulling from these sources, we've
gathered user training,
got application control, stopping
the executable of running block
unknown files and transit's to stop
it at the email, their network
intrusion protection systems.
File detonations of putting it in a
sandbox, executing and seeing how it
runs,
if you dig into some of the external
resources, you'll find that
there are a couple different ways
you can monitor command line
arguments so you can enable
and watch windows vent log
forty six, eighty eight.
You can install assessment on
systems.
You can put antivirus on the
various systems as well as more
advanced endpoint sensing.
So in summary, we've reviewed
approach for identifying how
techniques and some techniques
are being used in relevant use
cases so that we can later make sure
that our defensive recommendations
match up with our adversaries.
You've taken a look at some of the
different places where
you can pull in associated
defensive options using
attack techniques and some
techniques as a data, as a starting
point.
These are everything from attack
data sources, detection mitigations,
references to a
number of external websites that
are reference to attack.