Finding Cyber Threats with Attack-Based Analytics

All too often, security teams within organisations fail to test their controls using the same real-world techniques that would be used by potential adversaries.

Only by emulating offensive techniques can defences be tested, measured and improved, thereby augmenting intrusion detection and prevention mechanisms.

An effective security team should not only aim to test technical controls, but also their outcomes.

These should answer basic questions such as

• What can our controls and programme currently detect?

• What do they fail to detect?

• How quickly do they detect the attack methods?

• What would be the likely outcome in the event of a detection failure?

• How long does it take for us to contain the attack, remediate and recover?

• Are our intrusion detection tools and systems working as they should?

• What is the signal-to-noise ratio for the detection criteria?

Such tests would demonstrate where different threat actors would be successful or would be caught in the environment and would allow the business to know exactly what is detected or mitigated and what is not.

The ATT&CK Framework

One of the most valuable frameworks for building adversary attack emulation scenarios is ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge).

As described by MITRE:

ATT&CK is a knowledge base of cyber adversary behaviour and taxonomy for adversarial actions across their lifecycle. ATT&CK has several parts: PRE-ATT&CK, which focuses left of delivery and exploit, ATT&CK for Enterprise, which covers initial access/exploit and beyond, and ATT&CK for Mobile, which focuses on mobile devices.

The ATT&CK model applies to enterprise IT systems covering Windows, macOS, and Linux, and mobile devices using Android or iOS. It places the tactical goals of an adversary within ten categories:

Each of the tactical categories within the matrix includes common attack techniques, such as ‘Supply Chain Compromise’ or ‘Spearphishing Link’ for Initial Access. Privilege Escalation includes ‘Sudo’ and ‘Launch Daemon’, while Credential Access contains ‘Bash History’ and ‘Two-Factor Authentication Interception’. Of course, some of the techniques, such as Network Sniffing, can span multiple categories (Credential Access and Discovery).

It’s important to stress that ATT&CK doesn’t claim to cover all possible techniques in a given tactical category (it would be dangerous to make this assumption), but is based on a community of knowledge about actions that adversaries have used for a particular purpose. Using the framework, a Red Team posing as the adversary can test each of the methods while the Blue Team acting as network defenders can see whether the actions are detected or not. In this way the security team can benefit from exposing themselves to a wide variety of adversary types and techniques.