SlideShare uma empresa Scribd logo

MITRE ATT&CKcon Power Hour - November

‱
‱
MITRE - ATT&CKcon
MITRE - ATT&CKcon

Presentation slides from the MITRE ATT&CKcon Power Hour held on November 12, 2020.

Governo e ONGs
1 de 65
Baixar para ler offline
Welcome Follow the conversation on Slack @MITREattack attack.mitre.org
Allie Mellen Security Strategist, Office of the CSO Cybereason
Confidential Mapping the EventBot Mobile Banking Trojan with MITRE ATT&CK for Mobile Allie Mellen, Security Strategist, Office of the CSO
WHO AM I? ALLIE MELLEN Security Strategist Office of the CSO, Cybereason
● Why MITRE ATT&CK? ● Cybereason Nocturnus Mobile Malware Research ● Aligning to MITRE ATT&CK For Mobile ● How This Drives Future Alignment AGENDA
● Classification ● Purple Teaming ● Knowledge Sharing ○ Community ○ Internally ○ Partners ○ Customers ○ Business WHY MAP TO MITRE ATT&CK?
● Innovative Approach ● Important Target ● Clarity ● Communicate Value WHY MAP TO MITRE ATT&CK FOR MOBILE?
THREAT TYPE Banking Trojan NOCTURNUS RESEARCH: EVENTBOT TARGET INDUSTRY Financial ATTACK GOAL User Data IMPACTED GEO USA & Europe
EVENTBOT TARGETS: RECOGNIZE ANY OF THESE?
INITIAL ACCESS PERSISTENCE DEFENSE EVASION CREDENTIAL ACCESS DISCOVERY COLLECTION EXFILTRATION C2 T1476: Deliver Malicious App via Other Means T1402: App Auto- Start at Device Boot T1444: Masquerade as Legitimate Application T1412: Capture SMS Messages T1418: Application Discovery T1056: Input Capture T1532: Data Encrypted T1521: Standard Cryptographic Protocol T1461: Lockscreen Bypass T1508: Suppress Application Icon T1417: Input Capture T1426: System Information Discovery T1413: Access Sensitive Data in Device Logs T1437: Standard Application Layer Protocol T1407: Download New Code at Runtime T1409: Access Stored Application Data T1516: Input Injection MITRE ATT&CK FOR MOBILE TECHNIQUES
NOCTURNUS RESEARCH: EVENTBOT Unsuspecting User Downloads Application Masquerading as Legitimate INITIAL ACCESS CONTROL Gets Control of Accessibility Features, Begins to Run in the Background Collects Reconnaissance Information Like Device Info and the Names of Android Packages DISCOVERY COLLECTION Tracks the Device PIN and Collects Financial Information, Personal Data, Keystrokes, and Passwords Exfiltrates Collected Data to its C2 Server EXFILTRATION BYPASS Steals SMS Messages to Bypass 2FA
WHAT DOES THE FUTURE LOOK LIKE?
THANK YOU. QUESTIONS? allie@cybereason.com @hackerxbella
Q&A Jamie Williams Lead Cyber Adversarial Engineer MITRE
Anthony Randazzo Global Response Lead Expel
© 2020 Expel, Inc.© 2020 Expel, Inc. ATT&CKing the Cloud: Hopping Between the Matrices November 12, 2020 | Anthony Randazzo
© 2020 Expel, Inc. GetCallerIdentity ~ 1.5 years leading response @ Expel â–Ș 12+ years of SecOps ▫ iSIGHT/FireEye ▫ Fortune 25 Detection & Response â–Ș Disclaimer: not a cloud expert but frequent AWS D&R blog contributor â–Ș Kids, LEGO, whiskey expel.io/blog
© 2020 Expel, Inc. Agenda â–Ș ATT&CK for Cloud as we see it â–Ș Defending the control plane â–Ș Real world incident â–Ș Other applications of ATT&CK for Cloud â–Ș Takeaways
© 2020 Expel, Inc. So what exactly is ATT&CK for Cloud? Infra-as-a-Service Software-as-a-Service It’s a way to communicate how attackers are misusing or abusing cloud services!
© 2020 Expel, Inc. How is this different from Enterprise ATT&CK? Enterprise Matrices Cloud Matrices Very different attack surfaces!
© 2020 Expel, Inc. Control plane is primary attack surface...but wait there’s more! Control/Management Plane And many more...
© 2020 Expel, Inc. A shared responsibility... Source: AWS
© 2020 Expel, Inc. We have to protect this control plane, right? â–Ș Informs our detection strategy for this cloud attack surface â–Ș What do we detect? Where do we even start? â–Ș How many AWS APIs are available in this control plane? Almost 10,000, you say?
© 2020 Expel, Inc. How'd we build detections? Using OSTs, of course! Source: Rhino Security Labs
© 2020 Expel, Inc. What did an attack look like? An unconventional coin miner...
© 2020 Expel, Inc. What did the ATT&CK look like? AWS [IaaS] Cloud
© 2020 Expel, Inc. What did the ATT&CK look like? Enterprise Linux
© 2020 Expel, Inc. More examples of hopping between matrices! â–Ș AWS CLI access from multiple compromised keys > SSH access into EC2 â–Ș boto3 SDK access of AWS SSM > sudo linux access (red team) â–Ș SSRF exploitation > EC2 instance credential access to control plane â–Ș RDS database ransom > used CloudTrail to identify when weak password change occured
© 2020 Expel, Inc. AWS mind map for investigations and incidents MITRE ATT&CK Tactics Sign up for an advanced copy of our cheat sheet and AWS mind map: http://expel.io/mindmap
© 2020 Expel, Inc. Takeaways â–Ș With lots of attack surface in the cloud, understanding both cloud and enterprise ATT&CK will help. â–Ș We need more information sharing! We don’t know nearly as much about attacks in the cloud than in an enterprise [Windows] environment. â–Ș Cloud control planes are a target for automated attacks. This is the trend we’re observing today.
Q&A Jamie Williams Lead Cyber Adversarial Engineer MITRE
Matt Snyder Senior Threat Analytics Engineer VMWare
What’s a MITRE With Your Security? VMware’s Use of MITRE ATT&CK Matt Snyder November 2020
Sr. Threat Analytics Engineer ‱ 15+ Years in IT/Security. ‱ In 2013, I was on the Incident Response team during one the 1st major Credit Card breaches. ‱ I’ve built many SecOps programs over the last 10 years. ‱ I’ve been at VMware for 3+ years, and it’s a great place to work! Matt Snyder Speaker Introduction
Agenda Leveraging MITRE ATT&CK ‱What logs do you need for security monitoring? ‱How do you build balanced alerting? ‱Evaluating New Security Tools
Fundamental Flaw in Operationalizing Security Stuck in Survivor Bias mode
 o Most companies’ security planning is done around breaches/incidents they or their peers in the industry have had. o This leads to target fixation and wasting resources. o Prevents proactive detection of new threats.
What logs do you need for Security Monitoring?
Log All The Things!!
Log All The Things!!
Now You Are Logging with Focus
 By mapping our logging requirements with MITRE and CIS, we can articulate what we need, why we need it, and how to enable the proper level of logging. - Reduce the guess work - Minimize the impact on the service owners, no more back and forth or asking for more logs - Reduce gaps in logs that would allow and incident to go undetected - Help educate service owners to the threats out there
Typical Security Monitoring

Building a Balanced Portfolio
Alerts with Meaning Allows you to see a clearer picture of what’s happening in your environment. - What tactics and techniques are being discovered - Able to better understand your risk profile and where compensating controls are needed - Test areas that no detections are being found - Gives you the freedom to do things like risk- based alerting, where you can take lower fidelity events and chain them together to see a much clearer picture of an attack.
Tracking Maturity and Growth Starting Out - Aligning with ATT&CK gives us targets to track against - Helps us set what is a priority and ensure that those priorities make sense - Allows you to see in one place where gaps exist.
Tracking Maturity and Growth Future Check-In - Over time, you can see your growth and evaluate how that matches your needs. - Help reduce scope creep in your alerting (ATT&CK are things that exist in the wild and not hypothetical) - Help track the work being done and ensure you aren’t stacking alerts in certain areas
Evaluating New SecurityTools As seen on tv
. - With ATT&CK, we can focus on specific deliverables that are measurable and based on real world attacks - Helps to identify those 1 hit wonder vendors that don’t offer a well-rounded portfolio
Questions? Thank you!
Q&A Jamie Williams Lead Cyber Adversarial Engineer MITRE
Jamie Williams Mike Hartley MITRE
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2. Mike Hartley @thecookiewanter PUTTING THE INTO ATT&CK Jamie Williams @jamieantisocial @MITREattack
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2. Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact Active Scanning Acquire Infrastructure Valid Accounts Scheduled Task/Job Modify Authentication Process System Service Discovery Remote Services Data from Local System Data Obfuscation Exfiltration Over Other Network Medium Data Destruction Gather Victim Host Information Compromise Accounts Replication Through Removable Media Windows Management Instrumentation Valid Accounts Network Sniffing Software Deployment Tools Data from Removable Media Fallback Channels Data Encrypted for Impact Gather Victim Identity Information Compromise Infrastructure Hijack Execution Flow OS Credential Dumping Application Window Discovery Application Layer Protocol Scheduled Transfer Service Stop Gather Victim Network Information Develop Capabilities Trusted Relationship Software Deployment Tools Boot or Logon Initialization Scripts Direct Volume Access Input Capture Replication Through Removable Media Input Capture Proxy Data Transfer Size Limits Inhibit System Recovery Gather Victim Org Information Establish Accounts Supply Chain Compromise Create or Modify System Process Rootkit Brute Force System Network Configuration Discovery Data Staged Communication Through Removable Media Exfiltration Over C2 Channel Defacement Phishing for Information Obtain Capabilities Hardware Additions Shared Modules Event Triggered Execution Obfuscated Files or Information Two-Factor Authentication Interception Internal Spearphishing Screen Capture Firmware Corruption Search Closed Sources Exploit Public-Facing Application User Execution Boot or Logon Autostart Execution System Owner/User Discovery Use Alternate Authentication Material Email Collection Web Service Exfiltration Over Physical Medium Resource Hijacking Search Open Technical Databases Exploitation for Client Execution Account Manipulation Process Injection Exploitation for Credential Access Clipboard Data Multi-Stage Channels Network Denial of Service Search Open Websites/Domains Phishing External Remote Services Access Token Manipulation System Network Connections Discovery Lateral Tool Transfer Automated Collection Ingress Tool Transfer Exfiltration Over Web Service Endpoint Denial of Service Search Victim-Owned Websites External Remote Services System Services Office Application Startup Group Policy Modification Steal Web Session Cookie Taint Shared Content Audio Capture Data Encoding System Shutdown/Reboot Drive-by Compromise Command and Scripting Interpreter Create Account Abuse Elevation Control Mechanism Unsecured Credentials Permission Groups Discovery Exploitation of Remote Services Video Capture Traffic Signaling Automated Exfiltration Account Access Removal Browser Extensions Exploitation for Privilege Escalation Indicator Removal on Host Credentials from Password Stores Man in the Browser Remote Access Software Exfiltration Over Alternative Protocol Disk Wipe Native API Traffic Signaling Modify Registry File and Directory Discovery Remote Service Session Hijacking Data from Information Repositories Dynamic Resolution Data Manipulation Inter-Process Communication BITS Jobs Trusted Developer Utilities Proxy Execution Steal or Forge Kerberos Tickets Non-Standard Port Transfer Data to Cloud AccountServer Software Component Peripheral Device Discovery Man-in-the-Middle Protocol Tunneling Traffic Signaling Forced Authentication Archive Collected Data Encrypted Channel Pre-OS Boot Signed Script Proxy Execution Steal Application Access Token Network Share Discovery Data from Network Shared Drive Non-Application Layer ProtocolCompromise Client Software Binary Password Policy Discovery Rogue Domain Controller Man-in-the-Middle Browser Bookmark Discovery Data from Cloud Storage ObjectImplant Container Image Indirect Command Execution Virtualization/Sandbox EvasionBITS Jobs XSL Script Processing Cloud Service Dashboard Template Injection Software Discovery File and Directory Permissions Modification Query Registry Remote System Discovery Virtualization/Sandbox Evasion Network Service Scanning Process Discovery Unused/Unsupported Cloud Regions System Information Discovery Use Alternate Authentication Material Account Discovery System Time Discovery Impair Defenses Domain Trust Discovery Hide Artifacts Cloud Service Discovery Masquerading Cloud Infrastructure Discovery Deobfuscate/Decode Files or Information Signed Binary Proxy Execution Exploitation for Defense Evasion Execution Guardrails Modify Cloud Compute Infrastructure Pre-OS Boot Subvert Trust Controls Source: http://gph.is/1cEuQWX
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2.
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2. History of PRE-ATT&CK ‱ Initially released in 2017 ‱ Separate matrix w/ 17 Tactics ‱ Adversary behaviors leading to compromise ‱ Example use cases: ‱ Are there signs that an adversary might be targeting you? ‱ Prioritize open-source intelligence gathering / sharing
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2. The Long Con ‱ In 2018 (v2) the Launch and Compromise Tactics were refactored into Initial Access
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2. Final Merge ‱ Deprecated PRE-ATT&CK matrix for PRE Enterprise platform ‱ 2 new Tactics ‱ Criteria for inclusion: 1. Technical 2. Visible to some defenders 3. Evidence of adversary use
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2. Reconnaissance ‱ Actively or passively gathering information that can be used to support targeting. ‱ 10 Techniques & 31 Sub-techniques ‱ Split into what & how
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2. Resource Development ‱ Building, buying, or compromising resources that can be used during targeting ‱ Infrastructure ‱ Accounts ‱ Capabilities ‱ 6 Techniques & 26 Sub-techniques
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2. Technique Metadata ‱ New PRE platform ‱ New Pre-compromise Mitigation ‱ ex: This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on... ‱ Data sources and Detections relevant to potential Enterprise artifacts Source: https://i.pinimg.com/originals/71/6a/5b/716a5b5b8847470b77dde4a4b67f2a2b.gif
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2. Why? ‱ Promote more adoption and contributions ‱ More integration across spectrum of adversary behaviors Source: https://gph.is/g/Z5K7bQE
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2. Gone But Not Forgotten Previous versions (< v8) will retain the full matrix as well as individual techniques
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2. How Can You Help? ‱ Feedback and contributions! ‱ New techniques + scoping of existing techniques ‱ Documentation of potential detections and mitigations ‱ Reported instances of adversary procedure examples Source: http://gph.is/2colVQl
©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2. Special Thanks
Join our next session on December 11 Register now! https://na.eventscloud.com/ATTACKcon-november

Recomendados

MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...MITRE - ATT&CKcon
 
State of the ATT&CK - ATT&CKcon Power Hour
State of the ATT&CK - ATT&CKcon Power HourState of the ATT&CK - ATT&CKcon Power Hour
State of the ATT&CK - ATT&CKcon Power HourAdam Pennington
 
Mapping the EventBot Mobile Banking Trojan with MITRE ATTACK for Mobile
Mapping the EventBot Mobile Banking Trojan with MITRE ATTACK for MobileMapping the EventBot Mobile Banking Trojan with MITRE ATTACK for Mobile
Mapping the EventBot Mobile Banking Trojan with MITRE ATTACK for MobileMITRE - ATT&CKcon
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CKTracking Noisy Behavior and Risk-Based Alerting with ATT&CK
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CKMITRE ATT&CK
 
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and ResearchUsing MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and ResearchMITRE - ATT&CKcon
 
Sharpening your Threat-Hunting Program with ATTACK Framework
Sharpening your Threat-Hunting Program with ATTACK FrameworkSharpening your Threat-Hunting Program with ATTACK Framework
Sharpening your Threat-Hunting Program with ATTACK FrameworkMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...MITRE - ATT&CKcon
 
When Insiders ATT&CK!
When Insiders ATT&CK!When Insiders ATT&CK!
When Insiders ATT&CK!MITRE ATT&CK
 

Recomendados

MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...MITRE - ATT&CKcon
 
State of the ATT&CK - ATT&CKcon Power Hour
State of the ATT&CK - ATT&CKcon Power HourState of the ATT&CK - ATT&CKcon Power Hour
State of the ATT&CK - ATT&CKcon Power HourAdam Pennington
 
Mapping the EventBot Mobile Banking Trojan with MITRE ATTACK for Mobile
Mapping the EventBot Mobile Banking Trojan with MITRE ATTACK for MobileMapping the EventBot Mobile Banking Trojan with MITRE ATTACK for Mobile
Mapping the EventBot Mobile Banking Trojan with MITRE ATTACK for MobileMITRE - ATT&CKcon
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CKTracking Noisy Behavior and Risk-Based Alerting with ATT&CK
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CKMITRE ATT&CK
 
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and ResearchUsing MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and ResearchMITRE - ATT&CKcon
 
Sharpening your Threat-Hunting Program with ATTACK Framework
Sharpening your Threat-Hunting Program with ATTACK FrameworkSharpening your Threat-Hunting Program with ATTACK Framework
Sharpening your Threat-Hunting Program with ATTACK FrameworkMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...MITRE - ATT&CKcon
 
When Insiders ATT&CK!
When Insiders ATT&CK!When Insiders ATT&CK!
When Insiders ATT&CK!MITRE ATT&CK
 
Automation: The Wonderful Wizard of CTI (or is it?)
Automation: The Wonderful Wizard of CTI (or is it?) Automation: The Wonderful Wizard of CTI (or is it?)
Automation: The Wonderful Wizard of CTI (or is it?) MITRE ATT&CK
 
Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...
Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...
Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...Adam Pennington
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsSergey Soldatov
 
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE - ATT&CKcon
 
TA505: A Study of High End Big Game Hunting in 2020
TA505: A Study of High End Big Game Hunting in 2020TA505: A Study of High End Big Game Hunting in 2020
TA505: A Study of High End Big Game Hunting in 2020MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...
MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...
MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...MITRE - ATT&CKcon
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You ArePutting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You AreKatie Nickels
 
MITRE ATTACKcon Power Hour - October
MITRE ATTACKcon Power Hour - OctoberMITRE ATTACKcon Power Hour - October
MITRE ATTACKcon Power Hour - OctoberMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE - ATT&CKcon
 
ATT&CKcon Power Hour - ATT&CK-onomics - gert-jan bruggink
ATT&CKcon Power Hour - ATT&CK-onomics - gert-jan brugginkATT&CKcon Power Hour - ATT&CK-onomics - gert-jan bruggink
ATT&CKcon Power Hour - ATT&CK-onomics - gert-jan brugginkGert-Jan Bruggink
 
MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,...
MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,...MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,...
MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,...MITRE - ATT&CKcon
 
MITRE ATTACKCon Power Hour - December
MITRE ATTACKCon Power Hour - DecemberMITRE ATTACKCon Power Hour - December
MITRE ATTACKCon Power Hour - DecemberMITRE - ATT&CKcon
 
Threat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKKatie Nickels
 
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...MITRE - ATT&CKcon
 
What's a MITRE with your Security?
What's a MITRE with your Security?What's a MITRE with your Security?
What's a MITRE with your Security?MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...
MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...
MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...MITRE - ATT&CKcon
 
Mitre getting-started-with-attack-october-2019
Mitre getting-started-with-attack-october-2019Mitre getting-started-with-attack-october-2019
Mitre getting-started-with-attack-october-2019Thang Nguyen
 
MITRE ATT&CKcon 2.0: The World's Most Dangerous ATT&CKers; Robert Lipovsky, ESET
MITRE ATT&CKcon 2.0: The World's Most Dangerous ATT&CKers; Robert Lipovsky, ESETMITRE ATT&CKcon 2.0: The World's Most Dangerous ATT&CKers; Robert Lipovsky, ESET
MITRE ATT&CKcon 2.0: The World's Most Dangerous ATT&CKers; Robert Lipovsky, ESETMITRE - ATT&CKcon
 
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation PlansEvolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation PlansChristopher Korban
 
Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018Christopher Korban
 
How BlueHat Cyber Uses SanerNow to Automate Patch Management and Beyond
How BlueHat Cyber Uses SanerNow to Automate Patch Management and BeyondHow BlueHat Cyber Uses SanerNow to Automate Patch Management and Beyond
How BlueHat Cyber Uses SanerNow to Automate Patch Management and BeyondSecPod Technologies
 
How to Predict, Detect and Protect Against Mobile Cyber Attacks
How to Predict, Detect and Protect Against Mobile Cyber AttacksHow to Predict, Detect and Protect Against Mobile Cyber Attacks
How to Predict, Detect and Protect Against Mobile Cyber AttacksSkycure
 

Mais conteĂșdo relacionado

Mais procurados

Automation: The Wonderful Wizard of CTI (or is it?)
Automation: The Wonderful Wizard of CTI (or is it?) Automation: The Wonderful Wizard of CTI (or is it?)
Automation: The Wonderful Wizard of CTI (or is it?) MITRE ATT&CK
 
Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...
Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...
Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...Adam Pennington
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsSergey Soldatov
 
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE - ATT&CKcon
 
TA505: A Study of High End Big Game Hunting in 2020
TA505: A Study of High End Big Game Hunting in 2020TA505: A Study of High End Big Game Hunting in 2020
TA505: A Study of High End Big Game Hunting in 2020MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...
MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...
MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...MITRE - ATT&CKcon
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You ArePutting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You AreKatie Nickels
 
MITRE ATTACKcon Power Hour - October
MITRE ATTACKcon Power Hour - OctoberMITRE ATTACKcon Power Hour - October
MITRE ATTACKcon Power Hour - OctoberMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE - ATT&CKcon
 
ATT&CKcon Power Hour - ATT&CK-onomics - gert-jan bruggink
ATT&CKcon Power Hour - ATT&CK-onomics - gert-jan brugginkATT&CKcon Power Hour - ATT&CK-onomics - gert-jan bruggink
ATT&CKcon Power Hour - ATT&CK-onomics - gert-jan brugginkGert-Jan Bruggink
 
MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,...
MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,...MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,...
MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,...MITRE - ATT&CKcon
 
MITRE ATTACKCon Power Hour - December
MITRE ATTACKCon Power Hour - DecemberMITRE ATTACKCon Power Hour - December
MITRE ATTACKCon Power Hour - DecemberMITRE - ATT&CKcon
 
Threat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKKatie Nickels
 
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...MITRE - ATT&CKcon
 
What's a MITRE with your Security?
What's a MITRE with your Security?What's a MITRE with your Security?
What's a MITRE with your Security?MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...
MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...
MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...MITRE - ATT&CKcon
 
Mitre getting-started-with-attack-october-2019
Mitre getting-started-with-attack-october-2019Mitre getting-started-with-attack-october-2019
Mitre getting-started-with-attack-october-2019Thang Nguyen
 
MITRE ATT&CKcon 2.0: The World's Most Dangerous ATT&CKers; Robert Lipovsky, ESET
MITRE ATT&CKcon 2.0: The World's Most Dangerous ATT&CKers; Robert Lipovsky, ESETMITRE ATT&CKcon 2.0: The World's Most Dangerous ATT&CKers; Robert Lipovsky, ESET
MITRE ATT&CKcon 2.0: The World's Most Dangerous ATT&CKers; Robert Lipovsky, ESETMITRE - ATT&CKcon
 
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation PlansEvolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation PlansChristopher Korban
 
Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018Christopher Korban
 

Mais procurados (20)

Automation: The Wonderful Wizard of CTI (or is it?)
Automation: The Wonderful Wizard of CTI (or is it?) Automation: The Wonderful Wizard of CTI (or is it?)
Automation: The Wonderful Wizard of CTI (or is it?)
 
Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...
Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...
Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operations
 
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
 
TA505: A Study of High End Big Game Hunting in 2020
TA505: A Study of High End Big Game Hunting in 2020TA505: A Study of High End Big Game Hunting in 2020
TA505: A Study of High End Big Game Hunting in 2020
 
MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...
MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...
MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You ArePutting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You Are
 
MITRE ATTACKcon Power Hour - October
MITRE ATTACKcon Power Hour - OctoberMITRE ATTACKcon Power Hour - October
MITRE ATTACKcon Power Hour - October
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
 
ATT&CKcon Power Hour - ATT&CK-onomics - gert-jan bruggink
ATT&CKcon Power Hour - ATT&CK-onomics - gert-jan brugginkATT&CKcon Power Hour - ATT&CK-onomics - gert-jan bruggink
ATT&CKcon Power Hour - ATT&CK-onomics - gert-jan bruggink
 
MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,...
MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,...MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,...
MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,...
 
MITRE ATTACKCon Power Hour - December
MITRE ATTACKCon Power Hour - DecemberMITRE ATTACKCon Power Hour - December
MITRE ATTACKCon Power Hour - December
 
Threat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CK
 
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...
 
What's a MITRE with your Security?
What's a MITRE with your Security?What's a MITRE with your Security?
What's a MITRE with your Security?
 
MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...
MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...
MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...
 
Mitre getting-started-with-attack-october-2019
Mitre getting-started-with-attack-october-2019Mitre getting-started-with-attack-october-2019
Mitre getting-started-with-attack-october-2019
 
MITRE ATT&CKcon 2.0: The World's Most Dangerous ATT&CKers; Robert Lipovsky, ESET
MITRE ATT&CKcon 2.0: The World's Most Dangerous ATT&CKers; Robert Lipovsky, ESETMITRE ATT&CKcon 2.0: The World's Most Dangerous ATT&CKers; Robert Lipovsky, ESET
MITRE ATT&CKcon 2.0: The World's Most Dangerous ATT&CKers; Robert Lipovsky, ESET
 
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation PlansEvolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
 
Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018
 

Semelhante a MITRE ATT&CKcon Power Hour - November

How BlueHat Cyber Uses SanerNow to Automate Patch Management and Beyond
How BlueHat Cyber Uses SanerNow to Automate Patch Management and BeyondHow BlueHat Cyber Uses SanerNow to Automate Patch Management and Beyond
How BlueHat Cyber Uses SanerNow to Automate Patch Management and BeyondSecPod Technologies
 
How to Predict, Detect and Protect Against Mobile Cyber Attacks
How to Predict, Detect and Protect Against Mobile Cyber AttacksHow to Predict, Detect and Protect Against Mobile Cyber Attacks
How to Predict, Detect and Protect Against Mobile Cyber AttacksSkycure
 
Advanced Threat protection – Digital Era - Ajit Pillai, Director Sales – Indi...
Advanced Threat protection – Digital Era - Ajit Pillai, Director Sales – Indi...Advanced Threat protection – Digital Era - Ajit Pillai, Director Sales – Indi...
Advanced Threat protection – Digital Era - Ajit Pillai, Director Sales – Indi...eGov Magazine
 
Security Opening Keynote Address: Security Drives DIGITAL TRANSFORMATION in...
Security Opening Keynote Address: Security Drives DIGITAL TRANSFORMATION in...Security Opening Keynote Address: Security Drives DIGITAL TRANSFORMATION in...
Security Opening Keynote Address: Security Drives DIGITAL TRANSFORMATION in...CA Technologies
 
ICS Cyber Security Effectiveness Measurement
ICS Cyber Security Effectiveness MeasurementICS Cyber Security Effectiveness Measurement
ICS Cyber Security Effectiveness MeasurementAleksey Lukatskiy
 
Company_Profile_Updated_17032016
Company_Profile_Updated_17032016Company_Profile_Updated_17032016
Company_Profile_Updated_17032016Dr. Afnan Ullah Khan
 
Webinar | Cybersecurity vulnerabilities of your business - Berezha Security G...
Webinar | Cybersecurity vulnerabilities of your business - Berezha Security G...Webinar | Cybersecurity vulnerabilities of your business - Berezha Security G...
Webinar | Cybersecurity vulnerabilities of your business - Berezha Security G...Berezha Security Group
 
How policymakers can fulfill promises of security for cloud services - SEP205...
How policymakers can fulfill promises of security for cloud services - SEP205...How policymakers can fulfill promises of security for cloud services - SEP205...
How policymakers can fulfill promises of security for cloud services - SEP205...Amazon Web Services
 
Introduction to the Current Threat Landscape
Introduction to the Current Threat LandscapeIntroduction to the Current Threat Landscape
Introduction to the Current Threat LandscapeMelbourne IT
 
Exploring the Defender's Advantage
Exploring the Defender's AdvantageExploring the Defender's Advantage
Exploring the Defender's AdvantageRaffael Marty
 
Latest Cybersecurity Trends
Latest Cybersecurity TrendsLatest Cybersecurity Trends
Latest Cybersecurity TrendsIRJET Journal
 
Seceon 2023 Cybersecurity Predictions by Seceon Thought Leadership - Seceon.pptx
Seceon 2023 Cybersecurity Predictions by Seceon Thought Leadership - Seceon.pptxSeceon 2023 Cybersecurity Predictions by Seceon Thought Leadership - Seceon.pptx
Seceon 2023 Cybersecurity Predictions by Seceon Thought Leadership - Seceon.pptxCompanySeceon
 
Reading the Security Tea Leaves
Reading the Security Tea LeavesReading the Security Tea Leaves
Reading the Security Tea LeavesEd Bellis
 
Implementing Governance as Code
Implementing Governance as CodeImplementing Governance as Code
Implementing Governance as CodeAmazon Web Services
 
Symantec Webinar | How to ï»żDetect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to ï»żDetect Targeted Ransomware with MITRE ATT&CKSymantec Webinar | How to ï»żDetect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to ï»żDetect Targeted Ransomware with MITRE ATT&CKSymantec
 
Cyber Security Management in a Highly Innovative World
Cyber Security Management in a Highly Innovative WorldCyber Security Management in a Highly Innovative World
Cyber Security Management in a Highly Innovative WorldSafeNet
 
GISEC 2015 Your Network in the Eyes of a Hacker - DTS Solution
GISEC 2015 Your Network in the Eyes of a Hacker - DTS SolutionGISEC 2015 Your Network in the Eyes of a Hacker - DTS Solution
GISEC 2015 Your Network in the Eyes of a Hacker - DTS SolutionShah Sheikh
 
Surviving the lions den - how to sell SaaS services to security oriented cust...
Surviving the lions den - how to sell SaaS services to security oriented cust...Surviving the lions den - how to sell SaaS services to security oriented cust...
Surviving the lions den - how to sell SaaS services to security oriented cust...Moshe Ferber
 
Security event presentation 3.4.2016-final
Security event presentation 3.4.2016-finalSecurity event presentation 3.4.2016-final
Security event presentation 3.4.2016-finalCal Net Technology Group
 

Semelhante a MITRE ATT&CKcon Power Hour - November (20)

How BlueHat Cyber Uses SanerNow to Automate Patch Management and Beyond
How BlueHat Cyber Uses SanerNow to Automate Patch Management and BeyondHow BlueHat Cyber Uses SanerNow to Automate Patch Management and Beyond
How BlueHat Cyber Uses SanerNow to Automate Patch Management and Beyond
 
How to Predict, Detect and Protect Against Mobile Cyber Attacks
How to Predict, Detect and Protect Against Mobile Cyber AttacksHow to Predict, Detect and Protect Against Mobile Cyber Attacks
How to Predict, Detect and Protect Against Mobile Cyber Attacks
 
Advanced Threat protection – Digital Era - Ajit Pillai, Director Sales – Indi...
Advanced Threat protection – Digital Era - Ajit Pillai, Director Sales – Indi...Advanced Threat protection – Digital Era - Ajit Pillai, Director Sales – Indi...
Advanced Threat protection – Digital Era - Ajit Pillai, Director Sales – Indi...
 
Security Opening Keynote Address: Security Drives DIGITAL TRANSFORMATION in...
Security Opening Keynote Address: Security Drives DIGITAL TRANSFORMATION in...Security Opening Keynote Address: Security Drives DIGITAL TRANSFORMATION in...
Security Opening Keynote Address: Security Drives DIGITAL TRANSFORMATION in...
 
ICS Cyber Security Effectiveness Measurement
ICS Cyber Security Effectiveness MeasurementICS Cyber Security Effectiveness Measurement
ICS Cyber Security Effectiveness Measurement
 
Company_Profile_Updated_17032016
Company_Profile_Updated_17032016Company_Profile_Updated_17032016
Company_Profile_Updated_17032016
 
Webinar | Cybersecurity vulnerabilities of your business - Berezha Security G...
Webinar | Cybersecurity vulnerabilities of your business - Berezha Security G...Webinar | Cybersecurity vulnerabilities of your business - Berezha Security G...
Webinar | Cybersecurity vulnerabilities of your business - Berezha Security G...
 
R u hacked
R u hackedR u hacked
R u hacked
 
How policymakers can fulfill promises of security for cloud services - SEP205...
How policymakers can fulfill promises of security for cloud services - SEP205...How policymakers can fulfill promises of security for cloud services - SEP205...
How policymakers can fulfill promises of security for cloud services - SEP205...
 
Introduction to the Current Threat Landscape
Introduction to the Current Threat LandscapeIntroduction to the Current Threat Landscape
Introduction to the Current Threat Landscape
 
Exploring the Defender's Advantage
Exploring the Defender's AdvantageExploring the Defender's Advantage
Exploring the Defender's Advantage
 
Latest Cybersecurity Trends
Latest Cybersecurity TrendsLatest Cybersecurity Trends
Latest Cybersecurity Trends
 
Seceon 2023 Cybersecurity Predictions by Seceon Thought Leadership - Seceon.pptx
Seceon 2023 Cybersecurity Predictions by Seceon Thought Leadership - Seceon.pptxSeceon 2023 Cybersecurity Predictions by Seceon Thought Leadership - Seceon.pptx
Seceon 2023 Cybersecurity Predictions by Seceon Thought Leadership - Seceon.pptx
 
Reading the Security Tea Leaves
Reading the Security Tea LeavesReading the Security Tea Leaves
Reading the Security Tea Leaves
 
Implementing Governance as Code
Implementing Governance as CodeImplementing Governance as Code
Implementing Governance as Code
 
Symantec Webinar | How to ï»żDetect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to ï»żDetect Targeted Ransomware with MITRE ATT&CKSymantec Webinar | How to ï»żDetect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to ï»żDetect Targeted Ransomware with MITRE ATT&CK
 
Cyber Security Management in a Highly Innovative World
Cyber Security Management in a Highly Innovative WorldCyber Security Management in a Highly Innovative World
Cyber Security Management in a Highly Innovative World
 
GISEC 2015 Your Network in the Eyes of a Hacker - DTS Solution
GISEC 2015 Your Network in the Eyes of a Hacker - DTS SolutionGISEC 2015 Your Network in the Eyes of a Hacker - DTS Solution
GISEC 2015 Your Network in the Eyes of a Hacker - DTS Solution
 
Surviving the lions den - how to sell SaaS services to security oriented cust...
Surviving the lions den - how to sell SaaS services to security oriented cust...Surviving the lions den - how to sell SaaS services to security oriented cust...
Surviving the lions den - how to sell SaaS services to security oriented cust...
 
Security event presentation 3.4.2016-final
Security event presentation 3.4.2016-finalSecurity event presentation 3.4.2016-final
Security event presentation 3.4.2016-final
 

Mais de MITRE - ATT&CKcon

ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat IntelligenceATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat IntelligenceMITRE - ATT&CKcon
 
ATTACK-Onomics: Attacking the Economics Behind Techniques Used by Adversaries
ATTACK-Onomics: Attacking the Economics Behind Techniques Used by AdversariesATTACK-Onomics: Attacking the Economics Behind Techniques Used by Adversaries
ATTACK-Onomics: Attacking the Economics Behind Techniques Used by AdversariesMITRE - ATT&CKcon
 
MITRE ATTACKcon Power Hour - January
MITRE ATTACKcon Power Hour - JanuaryMITRE ATTACKcon Power Hour - January
MITRE ATTACKcon Power Hour - JanuaryMITRE - ATT&CKcon
 
Using ATTACK to Create Cyber DBTS for Nuclear Power Plants
Using ATTACK to Create Cyber DBTS for Nuclear Power PlantsUsing ATTACK to Create Cyber DBTS for Nuclear Power Plants
Using ATTACK to Create Cyber DBTS for Nuclear Power PlantsMITRE - ATT&CKcon
 
Helping Small Companies Leverage CTI with an Open Source Threat Mapping
Helping Small Companies Leverage CTI with an Open Source Threat MappingHelping Small Companies Leverage CTI with an Open Source Threat Mapping
Helping Small Companies Leverage CTI with an Open Source Threat MappingMITRE - ATT&CKcon
 
What's New with ATTACK for ICS?
What's New with ATTACK for ICS?What's New with ATTACK for ICS?
What's New with ATTACK for ICS?MITRE - ATT&CKcon
 
From Theory to Practice: How My ATTACK Perspectives Have Changed
From Theory to Practice: How My ATTACK Perspectives Have ChangedFrom Theory to Practice: How My ATTACK Perspectives Have Changed
From Theory to Practice: How My ATTACK Perspectives Have ChangedMITRE - ATT&CKcon
 
Putting the PRE into ATTACK
Putting the PRE into ATTACKPutting the PRE into ATTACK
Putting the PRE into ATTACKMITRE - ATT&CKcon
 
ATTACKing the Cloud: Hopping Between the Matrices
ATTACKing the Cloud: Hopping Between the MatricesATTACKing the Cloud: Hopping Between the Matrices
ATTACKing the Cloud: Hopping Between the MatricesMITRE - ATT&CKcon
 
Transforming Adversary Emulation Into a Data Analysis Question
Transforming Adversary Emulation Into a Data Analysis QuestionTransforming Adversary Emulation Into a Data Analysis Question
Transforming Adversary Emulation Into a Data Analysis QuestionMITRE - ATT&CKcon
 
What's New with ATTACK for Cloud?
What's New with ATTACK for Cloud?What's New with ATTACK for Cloud?
What's New with ATTACK for Cloud?MITRE - ATT&CKcon
 
Starting Over with Sub-Techniques
Starting Over with Sub-TechniquesStarting Over with Sub-Techniques
Starting Over with Sub-TechniquesMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: Keynote Address - The Friends We Made Along the Way; Ton...
MITRE ATT&CKcon 2.0: Keynote Address - The Friends We Made Along the Way; Ton...MITRE ATT&CKcon 2.0: Keynote Address - The Friends We Made Along the Way; Ton...
MITRE ATT&CKcon 2.0: Keynote Address - The Friends We Made Along the Way; Ton...MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: Alertable Techniques for Linux Using ATT&CK; Tony Lamber...
MITRE ATT&CKcon 2.0: Alertable Techniques for Linux Using ATT&CK; Tony Lamber...MITRE ATT&CKcon 2.0: Alertable Techniques for Linux Using ATT&CK; Tony Lamber...
MITRE ATT&CKcon 2.0: Alertable Techniques for Linux Using ATT&CK; Tony Lamber...MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: ATT&CK Coverage Assessment from a Data Perspective; Olaf...
MITRE ATT&CKcon 2.0: ATT&CK Coverage Assessment from a Data Perspective; Olaf...MITRE ATT&CKcon 2.0: ATT&CK Coverage Assessment from a Data Perspective; Olaf...
MITRE ATT&CKcon 2.0: ATT&CK Coverage Assessment from a Data Perspective; Olaf...MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: From Susceptible to ATT&CK - A Threat Hunting Story; Chr...
MITRE ATT&CKcon 2.0: From Susceptible to ATT&CK - A Threat Hunting Story; Chr...MITRE ATT&CKcon 2.0: From Susceptible to ATT&CK - A Threat Hunting Story; Chr...
MITRE ATT&CKcon 2.0: From Susceptible to ATT&CK - A Threat Hunting Story; Chr...MITRE - ATT&CKcon
 

Mais de MITRE - ATT&CKcon (19)

ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat IntelligenceATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
 
State of the ATTACK
State of the ATTACKState of the ATTACK
State of the ATTACK
 
ATTACK-Onomics: Attacking the Economics Behind Techniques Used by Adversaries
ATTACK-Onomics: Attacking the Economics Behind Techniques Used by AdversariesATTACK-Onomics: Attacking the Economics Behind Techniques Used by Adversaries
ATTACK-Onomics: Attacking the Economics Behind Techniques Used by Adversaries
 
MITRE ATTACKcon Power Hour - January
MITRE ATTACKcon Power Hour - JanuaryMITRE ATTACKcon Power Hour - January
MITRE ATTACKcon Power Hour - January
 
Using ATTACK to Create Cyber DBTS for Nuclear Power Plants
Using ATTACK to Create Cyber DBTS for Nuclear Power PlantsUsing ATTACK to Create Cyber DBTS for Nuclear Power Plants
Using ATTACK to Create Cyber DBTS for Nuclear Power Plants
 
Helping Small Companies Leverage CTI with an Open Source Threat Mapping
Helping Small Companies Leverage CTI with an Open Source Threat MappingHelping Small Companies Leverage CTI with an Open Source Threat Mapping
Helping Small Companies Leverage CTI with an Open Source Threat Mapping
 
What's New with ATTACK for ICS?
What's New with ATTACK for ICS?What's New with ATTACK for ICS?
What's New with ATTACK for ICS?
 
From Theory to Practice: How My ATTACK Perspectives Have Changed
From Theory to Practice: How My ATTACK Perspectives Have ChangedFrom Theory to Practice: How My ATTACK Perspectives Have Changed
From Theory to Practice: How My ATTACK Perspectives Have Changed
 
Putting the PRE into ATTACK
Putting the PRE into ATTACKPutting the PRE into ATTACK
Putting the PRE into ATTACK
 
ATTACKing the Cloud: Hopping Between the Matrices
ATTACKing the Cloud: Hopping Between the MatricesATTACKing the Cloud: Hopping Between the Matrices
ATTACKing the Cloud: Hopping Between the Matrices
 
Transforming Adversary Emulation Into a Data Analysis Question
Transforming Adversary Emulation Into a Data Analysis QuestionTransforming Adversary Emulation Into a Data Analysis Question
Transforming Adversary Emulation Into a Data Analysis Question
 
What's New with ATTACK for Cloud?
What's New with ATTACK for Cloud?What's New with ATTACK for Cloud?
What's New with ATTACK for Cloud?
 
Starting Over with Sub-Techniques
Starting Over with Sub-TechniquesStarting Over with Sub-Techniques
Starting Over with Sub-Techniques
 
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
 
MITRE ATT&CKcon 2.0: Keynote Address - The Friends We Made Along the Way; Ton...
MITRE ATT&CKcon 2.0: Keynote Address - The Friends We Made Along the Way; Ton...MITRE ATT&CKcon 2.0: Keynote Address - The Friends We Made Along the Way; Ton...
MITRE ATT&CKcon 2.0: Keynote Address - The Friends We Made Along the Way; Ton...
 
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...
 
MITRE ATT&CKcon 2.0: Alertable Techniques for Linux Using ATT&CK; Tony Lamber...
MITRE ATT&CKcon 2.0: Alertable Techniques for Linux Using ATT&CK; Tony Lamber...MITRE ATT&CKcon 2.0: Alertable Techniques for Linux Using ATT&CK; Tony Lamber...
MITRE ATT&CKcon 2.0: Alertable Techniques for Linux Using ATT&CK; Tony Lamber...
 
MITRE ATT&CKcon 2.0: ATT&CK Coverage Assessment from a Data Perspective; Olaf...
MITRE ATT&CKcon 2.0: ATT&CK Coverage Assessment from a Data Perspective; Olaf...MITRE ATT&CKcon 2.0: ATT&CK Coverage Assessment from a Data Perspective; Olaf...
MITRE ATT&CKcon 2.0: ATT&CK Coverage Assessment from a Data Perspective; Olaf...
 
MITRE ATT&CKcon 2.0: From Susceptible to ATT&CK - A Threat Hunting Story; Chr...
MITRE ATT&CKcon 2.0: From Susceptible to ATT&CK - A Threat Hunting Story; Chr...MITRE ATT&CKcon 2.0: From Susceptible to ATT&CK - A Threat Hunting Story; Chr...
MITRE ATT&CKcon 2.0: From Susceptible to ATT&CK - A Threat Hunting Story; Chr...
 

Último

2024: The FAR, Federal Acquisition Regulations - Part 25
2024: The FAR, Federal Acquisition Regulations - Part 252024: The FAR, Federal Acquisition Regulations - Part 25
2024: The FAR, Federal Acquisition Regulations - Part 25JSchaus & Associates
 
call girls in Kirti Nagar DELHI 🔝 >àŒ’9540349809 🔝 genuine Escort Service đŸ”âœ”ïžâœ”ïž
call girls in Kirti Nagar DELHI 🔝 >àŒ’9540349809 🔝 genuine Escort Service đŸ”âœ”ïžâœ”ïžcall girls in Kirti Nagar DELHI 🔝 >àŒ’9540349809 🔝 genuine Escort Service đŸ”âœ”ïžâœ”ïž
call girls in Kirti Nagar DELHI 🔝 >àŒ’9540349809 🔝 genuine Escort Service đŸ”âœ”ïžâœ”ïžsaminamagar
 
Build Tomorrow’s India Today By Making Charity For Poor Students
Build Tomorrow’s India Today By Making Charity For Poor StudentsBuild Tomorrow’s India Today By Making Charity For Poor Students
Build Tomorrow’s India Today By Making Charity For Poor StudentsSERUDS INDIA
 
2024 ECOSOC YOUTH FORUM -logistical information - United Nations Economic an...
2024 ECOSOC YOUTH FORUM -logistical information - United Nations Economic an...2024 ECOSOC YOUTH FORUM -logistical information - United Nations Economic an...
2024 ECOSOC YOUTH FORUM -logistical information - United Nations Economic an...Christina Parmionova
 
NO1 Certified Best vashikaran specialist in UK USA UAE London Dubai Canada Am...
NO1 Certified Best vashikaran specialist in UK USA UAE London Dubai Canada Am...NO1 Certified Best vashikaran specialist in UK USA UAE London Dubai Canada Am...
NO1 Certified Best vashikaran specialist in UK USA UAE London Dubai Canada Am...Amil Baba Dawood bangali
 
Republic Act 11032 (Ease of Doing Business and Efficient Government Service D...
Republic Act 11032 (Ease of Doing Business and Efficient Government Service D...Republic Act 11032 (Ease of Doing Business and Efficient Government Service D...
Republic Act 11032 (Ease of Doing Business and Efficient Government Service D...MartMantilla1
 
Professional Conduct and ethics lecture.pptx
Professional Conduct and ethics lecture.pptxProfessional Conduct and ethics lecture.pptx
Professional Conduct and ethics lecture.pptxjennysansano2
 
If there is a Hell on Earth, it is the Lives of Children in Gaza.pdf
If there is a Hell on Earth, it is the Lives of Children in Gaza.pdfIf there is a Hell on Earth, it is the Lives of Children in Gaza.pdf
If there is a Hell on Earth, it is the Lives of Children in Gaza.pdfKatrina Sriranpong
 
2023 Ecological Profile of Ilocos Norte.pdf
2023 Ecological Profile of Ilocos Norte.pdf2023 Ecological Profile of Ilocos Norte.pdf
2023 Ecological Profile of Ilocos Norte.pdfilocosnortegovph
 
択理çșŠć…‹ć€§ć­ŠæŻ•äžšèŻæˆç»©ć•|莭äč°ćŠ æ‹żć€§æ–‡ć‡­èŻäčŠ
択理çșŠć…‹ć€§ć­ŠæŻ•äžšèŻæˆç»©ć•|莭äč°ćŠ æ‹żć€§æ–‡ć‡­èŻäčŠćŠžç†çșŠć…‹ć€§ć­ŠæŻ•äžšèŻæˆç»©ć•|莭äč°ćŠ æ‹żć€§æ–‡ć‡­èŻäčŠ
択理çșŠć…‹ć€§ć­ŠæŻ•äžšèŻæˆç»©ć•|莭äč°ćŠ æ‹żć€§æ–‡ć‡­èŻäčŠzdzoqco
 
PETTY CASH FUND - GOVERNMENT ACCOUNTING.pptx
PETTY CASH FUND - GOVERNMENT ACCOUNTING.pptxPETTY CASH FUND - GOVERNMENT ACCOUNTING.pptx
PETTY CASH FUND - GOVERNMENT ACCOUNTING.pptxCrisAnnBusilan
 
23rd Infopoverty World Conference - Agenda programme
23rd Infopoverty World Conference - Agenda programme23rd Infopoverty World Conference - Agenda programme
23rd Infopoverty World Conference - Agenda programmeChristina Parmionova
 
Angels_EDProgrammes & Services 2024.pptx
Angels_EDProgrammes & Services 2024.pptxAngels_EDProgrammes & Services 2024.pptx
Angels_EDProgrammes & Services 2024.pptxLizelle Coombs
 
NL-FR Partnership - Water management roundtable 20240403.pdf
NL-FR Partnership - Water management roundtable 20240403.pdfNL-FR Partnership - Water management roundtable 20240403.pdf
NL-FR Partnership - Water management roundtable 20240403.pdfBertrand Coppin
 
Digital Transformation of the Heritage Sector and its Practical Implications
Digital Transformation of the Heritage Sector and its Practical ImplicationsDigital Transformation of the Heritage Sector and its Practical Implications
Digital Transformation of the Heritage Sector and its Practical ImplicationsBeat Estermann
 
ECOSOC YOUTH FORUM 2024 Side Events Schedule-18 April.
ECOSOC YOUTH FORUM 2024 Side Events Schedule-18 April.ECOSOC YOUTH FORUM 2024 Side Events Schedule-18 April.
ECOSOC YOUTH FORUM 2024 Side Events Schedule-18 April.Christina Parmionova
 
2024: The FAR, Federal Acquisition Regulations - Part 23
2024: The FAR, Federal Acquisition Regulations - Part 232024: The FAR, Federal Acquisition Regulations - Part 23
2024: The FAR, Federal Acquisition Regulations - Part 23JSchaus & Associates
 
High-Level Thematic Event on Tourism - SUSTAINABILITY WEEK 2024- United Natio...
High-Level Thematic Event on Tourism - SUSTAINABILITY WEEK 2024- United Natio...High-Level Thematic Event on Tourism - SUSTAINABILITY WEEK 2024- United Natio...
High-Level Thematic Event on Tourism - SUSTAINABILITY WEEK 2024- United Natio...Christina Parmionova
 
Uk-NO1 Black magic Specialist Expert in Uk Usa Uae London Canada England Amer...
Uk-NO1 Black magic Specialist Expert in Uk Usa Uae London Canada England Amer...Uk-NO1 Black magic Specialist Expert in Uk Usa Uae London Canada England Amer...
Uk-NO1 Black magic Specialist Expert in Uk Usa Uae London Canada England Amer...Amil baba
 
call girls in moti bagh DELHI 🔝 >àŒ’9540349809 🔝 genuine Escort Service đŸ”âœ”ïžâœ”ïž
call girls in moti bagh DELHI 🔝 >àŒ’9540349809 🔝 genuine Escort Service đŸ”âœ”ïžâœ”ïžcall girls in moti bagh DELHI 🔝 >àŒ’9540349809 🔝 genuine Escort Service đŸ”âœ”ïžâœ”ïž
call girls in moti bagh DELHI 🔝 >àŒ’9540349809 🔝 genuine Escort Service đŸ”âœ”ïžâœ”ïžsaminamagar
 

Último (20)

2024: The FAR, Federal Acquisition Regulations - Part 25
2024: The FAR, Federal Acquisition Regulations - Part 252024: The FAR, Federal Acquisition Regulations - Part 25
2024: The FAR, Federal Acquisition Regulations - Part 25
 
call girls in Kirti Nagar DELHI 🔝 >àŒ’9540349809 🔝 genuine Escort Service đŸ”âœ”ïžâœ”ïž
call girls in Kirti Nagar DELHI 🔝 >àŒ’9540349809 🔝 genuine Escort Service đŸ”âœ”ïžâœ”ïžcall girls in Kirti Nagar DELHI 🔝 >àŒ’9540349809 🔝 genuine Escort Service đŸ”âœ”ïžâœ”ïž
call girls in Kirti Nagar DELHI 🔝 >àŒ’9540349809 🔝 genuine Escort Service đŸ”âœ”ïžâœ”ïž
 
Build Tomorrow’s India Today By Making Charity For Poor Students
Build Tomorrow’s India Today By Making Charity For Poor StudentsBuild Tomorrow’s India Today By Making Charity For Poor Students
Build Tomorrow’s India Today By Making Charity For Poor Students
 
2024 ECOSOC YOUTH FORUM -logistical information - United Nations Economic an...
2024 ECOSOC YOUTH FORUM -logistical information - United Nations Economic an...2024 ECOSOC YOUTH FORUM -logistical information - United Nations Economic an...
2024 ECOSOC YOUTH FORUM -logistical information - United Nations Economic an...
 
NO1 Certified Best vashikaran specialist in UK USA UAE London Dubai Canada Am...
NO1 Certified Best vashikaran specialist in UK USA UAE London Dubai Canada Am...NO1 Certified Best vashikaran specialist in UK USA UAE London Dubai Canada Am...
NO1 Certified Best vashikaran specialist in UK USA UAE London Dubai Canada Am...
 
Republic Act 11032 (Ease of Doing Business and Efficient Government Service D...
Republic Act 11032 (Ease of Doing Business and Efficient Government Service D...Republic Act 11032 (Ease of Doing Business and Efficient Government Service D...
Republic Act 11032 (Ease of Doing Business and Efficient Government Service D...
 
Professional Conduct and ethics lecture.pptx
Professional Conduct and ethics lecture.pptxProfessional Conduct and ethics lecture.pptx
Professional Conduct and ethics lecture.pptx
 
If there is a Hell on Earth, it is the Lives of Children in Gaza.pdf
If there is a Hell on Earth, it is the Lives of Children in Gaza.pdfIf there is a Hell on Earth, it is the Lives of Children in Gaza.pdf
If there is a Hell on Earth, it is the Lives of Children in Gaza.pdf
 
2023 Ecological Profile of Ilocos Norte.pdf
2023 Ecological Profile of Ilocos Norte.pdf2023 Ecological Profile of Ilocos Norte.pdf
2023 Ecological Profile of Ilocos Norte.pdf
 
択理çșŠć…‹ć€§ć­ŠæŻ•äžšèŻæˆç»©ć•|莭äč°ćŠ æ‹żć€§æ–‡ć‡­èŻäčŠ
択理çșŠć…‹ć€§ć­ŠæŻ•äžšèŻæˆç»©ć•|莭äč°ćŠ æ‹żć€§æ–‡ć‡­èŻäčŠćŠžç†çșŠć…‹ć€§ć­ŠæŻ•äžšèŻæˆç»©ć•|莭äč°ćŠ æ‹żć€§æ–‡ć‡­èŻäčŠ
択理çșŠć…‹ć€§ć­ŠæŻ•äžšèŻæˆç»©ć•|莭äč°ćŠ æ‹żć€§æ–‡ć‡­èŻäčŠ
 
PETTY CASH FUND - GOVERNMENT ACCOUNTING.pptx
PETTY CASH FUND - GOVERNMENT ACCOUNTING.pptxPETTY CASH FUND - GOVERNMENT ACCOUNTING.pptx
PETTY CASH FUND - GOVERNMENT ACCOUNTING.pptx
 
23rd Infopoverty World Conference - Agenda programme
23rd Infopoverty World Conference - Agenda programme23rd Infopoverty World Conference - Agenda programme
23rd Infopoverty World Conference - Agenda programme
 
Angels_EDProgrammes & Services 2024.pptx
Angels_EDProgrammes & Services 2024.pptxAngels_EDProgrammes & Services 2024.pptx
Angels_EDProgrammes & Services 2024.pptx
 
NL-FR Partnership - Water management roundtable 20240403.pdf
NL-FR Partnership - Water management roundtable 20240403.pdfNL-FR Partnership - Water management roundtable 20240403.pdf
NL-FR Partnership - Water management roundtable 20240403.pdf
 
Digital Transformation of the Heritage Sector and its Practical Implications
Digital Transformation of the Heritage Sector and its Practical ImplicationsDigital Transformation of the Heritage Sector and its Practical Implications
Digital Transformation of the Heritage Sector and its Practical Implications
 
ECOSOC YOUTH FORUM 2024 Side Events Schedule-18 April.
ECOSOC YOUTH FORUM 2024 Side Events Schedule-18 April.ECOSOC YOUTH FORUM 2024 Side Events Schedule-18 April.
ECOSOC YOUTH FORUM 2024 Side Events Schedule-18 April.
 
2024: The FAR, Federal Acquisition Regulations - Part 23
2024: The FAR, Federal Acquisition Regulations - Part 232024: The FAR, Federal Acquisition Regulations - Part 23
2024: The FAR, Federal Acquisition Regulations - Part 23
 
High-Level Thematic Event on Tourism - SUSTAINABILITY WEEK 2024- United Natio...
High-Level Thematic Event on Tourism - SUSTAINABILITY WEEK 2024- United Natio...High-Level Thematic Event on Tourism - SUSTAINABILITY WEEK 2024- United Natio...
High-Level Thematic Event on Tourism - SUSTAINABILITY WEEK 2024- United Natio...
 
Uk-NO1 Black magic Specialist Expert in Uk Usa Uae London Canada England Amer...
Uk-NO1 Black magic Specialist Expert in Uk Usa Uae London Canada England Amer...Uk-NO1 Black magic Specialist Expert in Uk Usa Uae London Canada England Amer...
Uk-NO1 Black magic Specialist Expert in Uk Usa Uae London Canada England Amer...
 
call girls in moti bagh DELHI 🔝 >àŒ’9540349809 🔝 genuine Escort Service đŸ”âœ”ïžâœ”ïž
call girls in moti bagh DELHI 🔝 >àŒ’9540349809 🔝 genuine Escort Service đŸ”âœ”ïžâœ”ïžcall girls in moti bagh DELHI 🔝 >àŒ’9540349809 🔝 genuine Escort Service đŸ”âœ”ïžâœ”ïž
call girls in moti bagh DELHI 🔝 >àŒ’9540349809 🔝 genuine Escort Service đŸ”âœ”ïžâœ”ïž
 

MITRE ATT&CKcon Power Hour - November

  • 1. Welcome Follow the conversation on Slack @MITREattack attack.mitre.org
  • 2. Allie Mellen Security Strategist, Office of the CSO Cybereason
  • 3. Confidential Mapping the EventBot Mobile Banking Trojan with MITRE ATT&CK for Mobile Allie Mellen, Security Strategist, Office of the CSO
  • 4. WHO AM I? ALLIE MELLEN Security Strategist Office of the CSO, Cybereason
  • 5. ● Why MITRE ATT&CK? ● Cybereason Nocturnus Mobile Malware Research ● Aligning to MITRE ATT&CK For Mobile ● How This Drives Future Alignment AGENDA
  • 6. ● Classification ● Purple Teaming ● Knowledge Sharing ○ Community ○ Internally ○ Partners ○ Customers ○ Business WHY MAP TO MITRE ATT&CK?
  • 7. ● Innovative Approach ● Important Target ● Clarity ● Communicate Value WHY MAP TO MITRE ATT&CK FOR MOBILE?
  • 8. THREAT TYPE Banking Trojan NOCTURNUS RESEARCH: EVENTBOT TARGET INDUSTRY Financial ATTACK GOAL User Data IMPACTED GEO USA & Europe
  • 10. INITIAL ACCESS PERSISTENCE DEFENSE EVASION CREDENTIAL ACCESS DISCOVERY COLLECTION EXFILTRATION C2 T1476: Deliver Malicious App via Other Means T1402: App Auto- Start at Device Boot T1444: Masquerade as Legitimate Application T1412: Capture SMS Messages T1418: Application Discovery T1056: Input Capture T1532: Data Encrypted T1521: Standard Cryptographic Protocol T1461: Lockscreen Bypass T1508: Suppress Application Icon T1417: Input Capture T1426: System Information Discovery T1413: Access Sensitive Data in Device Logs T1437: Standard Application Layer Protocol T1407: Download New Code at Runtime T1409: Access Stored Application Data T1516: Input Injection MITRE ATT&CK FOR MOBILE TECHNIQUES
  • 11. NOCTURNUS RESEARCH: EVENTBOT Unsuspecting User Downloads Application Masquerading as Legitimate INITIAL ACCESS CONTROL Gets Control of Accessibility Features, Begins to Run in the Background Collects Reconnaissance Information Like Device Info and the Names of Android Packages DISCOVERY COLLECTION Tracks the Device PIN and Collects Financial Information, Personal Data, Keystrokes, and Passwords Exfiltrates Collected Data to its C2 Server EXFILTRATION BYPASS Steals SMS Messages to Bypass 2FA
  • 12. WHAT DOES THE FUTURE LOOK LIKE?
  • 14. Q&A Jamie Williams Lead Cyber Adversarial Engineer MITRE
  • 16. © 2020 Expel, Inc.© 2020 Expel, Inc. ATT&CKing the Cloud: Hopping Between the Matrices November 12, 2020 | Anthony Randazzo
  • 17. © 2020 Expel, Inc. GetCallerIdentity ~ 1.5 years leading response @ Expel â–Ș 12+ years of SecOps ▫ iSIGHT/FireEye ▫ Fortune 25 Detection & Response â–Ș Disclaimer: not a cloud expert but frequent AWS D&R blog contributor â–Ș Kids, LEGO, whiskey expel.io/blog
  • 18. © 2020 Expel, Inc. Agenda â–Ș ATT&CK for Cloud as we see it â–Ș Defending the control plane â–Ș Real world incident â–Ș Other applications of ATT&CK for Cloud â–Ș Takeaways
  • 19. © 2020 Expel, Inc. So what exactly is ATT&CK for Cloud? Infra-as-a-Service Software-as-a-Service It’s a way to communicate how attackers are misusing or abusing cloud services!
  • 20. © 2020 Expel, Inc. How is this different from Enterprise ATT&CK? Enterprise Matrices Cloud Matrices Very different attack surfaces!
  • 21. © 2020 Expel, Inc. Control plane is primary attack surface...but wait there’s more! Control/Management Plane And many more...
  • 22. © 2020 Expel, Inc. A shared responsibility... Source: AWS
  • 23. © 2020 Expel, Inc. We have to protect this control plane, right? â–Ș Informs our detection strategy for this cloud attack surface â–Ș What do we detect? Where do we even start? â–Ș How many AWS APIs are available in this control plane? Almost 10,000, you say?
  • 24. © 2020 Expel, Inc. How'd we build detections? Using OSTs, of course! Source: Rhino Security Labs
  • 25. © 2020 Expel, Inc. What did an attack look like? An unconventional coin miner...
  • 26. © 2020 Expel, Inc. What did the ATT&CK look like? AWS [IaaS] Cloud
  • 27. © 2020 Expel, Inc. What did the ATT&CK look like? Enterprise Linux
  • 28. © 2020 Expel, Inc. More examples of hopping between matrices! â–Ș AWS CLI access from multiple compromised keys > SSH access into EC2 â–Ș boto3 SDK access of AWS SSM > sudo linux access (red team) â–Ș SSRF exploitation > EC2 instance credential access to control plane â–Ș RDS database ransom > used CloudTrail to identify when weak password change occured
  • 29. © 2020 Expel, Inc. AWS mind map for investigations and incidents MITRE ATT&CK Tactics Sign up for an advanced copy of our cheat sheet and AWS mind map: http://expel.io/mindmap
  • 30. © 2020 Expel, Inc. Takeaways â–Ș With lots of attack surface in the cloud, understanding both cloud and enterprise ATT&CK will help. â–Ș We need more information sharing! We don’t know nearly as much about attacks in the cloud than in an enterprise [Windows] environment. â–Ș Cloud control planes are a target for automated attacks. This is the trend we’re observing today.
  • 31. Q&A Jamie Williams Lead Cyber Adversarial Engineer MITRE
  • 32. Matt Snyder Senior Threat Analytics Engineer VMWare
  • 33. What’s a MITRE With Your Security? VMware’s Use of MITRE ATT&CK Matt Snyder November 2020
  • 34. Sr. Threat Analytics Engineer ‱ 15+ Years in IT/Security. ‱ In 2013, I was on the Incident Response team during one the 1st major Credit Card breaches. ‱ I’ve built many SecOps programs over the last 10 years. ‱ I’ve been at VMware for 3+ years, and it’s a great place to work! Matt Snyder Speaker Introduction
  • 35. Agenda Leveraging MITRE ATT&CK ‱What logs do you need for security monitoring? ‱How do you build balanced alerting? ‱Evaluating New Security Tools
  • 36.
  • 37. Fundamental Flaw in Operationalizing Security Stuck in Survivor Bias mode
 o Most companies’ security planning is done around breaches/incidents they or their peers in the industry have had. o This leads to target fixation and wasting resources. o Prevents proactive detection of new threats.
  • 38. What logs do you need for Security Monitoring?
  • 39. Log All The Things!!
  • 40. Log All The Things!!
  • 41.
  • 42. Now You Are Logging with Focus
 By mapping our logging requirements with MITRE and CIS, we can articulate what we need, why we need it, and how to enable the proper level of logging. - Reduce the guess work - Minimize the impact on the service owners, no more back and forth or asking for more logs - Reduce gaps in logs that would allow and incident to go undetected - Help educate service owners to the threats out there
  • 44. Building a Balanced Portfolio
  • 45. Alerts with Meaning Allows you to see a clearer picture of what’s happening in your environment. - What tactics and techniques are being discovered - Able to better understand your risk profile and where compensating controls are needed - Test areas that no detections are being found - Gives you the freedom to do things like risk- based alerting, where you can take lower fidelity events and chain them together to see a much clearer picture of an attack.
  • 46. Tracking Maturity and Growth Starting Out - Aligning with ATT&CK gives us targets to track against - Helps us set what is a priority and ensure that those priorities make sense - Allows you to see in one place where gaps exist.
  • 47. Tracking Maturity and Growth Future Check-In - Over time, you can see your growth and evaluate how that matches your needs. - Help reduce scope creep in your alerting (ATT&CK are things that exist in the wild and not hypothetical) - Help track the work being done and ensure you aren’t stacking alerts in certain areas
  • 48. Evaluating New SecurityTools As seen on tv
. - With ATT&CK, we can focus on specific deliverables that are measurable and based on real world attacks - Helps to identify those 1 hit wonder vendors that don’t offer a well-rounded portfolio
  • 50. Q&A Jamie Williams Lead Cyber Adversarial Engineer MITRE
  • 52. ©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2. Mike Hartley @thecookiewanter PUTTING THE INTO ATT&CK Jamie Williams @jamieantisocial @MITREattack
  • 53. ©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2. Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact Active Scanning Acquire Infrastructure Valid Accounts Scheduled Task/Job Modify Authentication Process System Service Discovery Remote Services Data from Local System Data Obfuscation Exfiltration Over Other Network Medium Data Destruction Gather Victim Host Information Compromise Accounts Replication Through Removable Media Windows Management Instrumentation Valid Accounts Network Sniffing Software Deployment Tools Data from Removable Media Fallback Channels Data Encrypted for Impact Gather Victim Identity Information Compromise Infrastructure Hijack Execution Flow OS Credential Dumping Application Window Discovery Application Layer Protocol Scheduled Transfer Service Stop Gather Victim Network Information Develop Capabilities Trusted Relationship Software Deployment Tools Boot or Logon Initialization Scripts Direct Volume Access Input Capture Replication Through Removable Media Input Capture Proxy Data Transfer Size Limits Inhibit System Recovery Gather Victim Org Information Establish Accounts Supply Chain Compromise Create or Modify System Process Rootkit Brute Force System Network Configuration Discovery Data Staged Communication Through Removable Media Exfiltration Over C2 Channel Defacement Phishing for Information Obtain Capabilities Hardware Additions Shared Modules Event Triggered Execution Obfuscated Files or Information Two-Factor Authentication Interception Internal Spearphishing Screen Capture Firmware Corruption Search Closed Sources Exploit Public-Facing Application User Execution Boot or Logon Autostart Execution System Owner/User Discovery Use Alternate Authentication Material Email Collection Web Service Exfiltration Over Physical Medium Resource Hijacking Search Open Technical Databases Exploitation for Client Execution Account Manipulation Process Injection Exploitation for Credential Access Clipboard Data Multi-Stage Channels Network Denial of Service Search Open Websites/Domains Phishing External Remote Services Access Token Manipulation System Network Connections Discovery Lateral Tool Transfer Automated Collection Ingress Tool Transfer Exfiltration Over Web Service Endpoint Denial of Service Search Victim-Owned Websites External Remote Services System Services Office Application Startup Group Policy Modification Steal Web Session Cookie Taint Shared Content Audio Capture Data Encoding System Shutdown/Reboot Drive-by Compromise Command and Scripting Interpreter Create Account Abuse Elevation Control Mechanism Unsecured Credentials Permission Groups Discovery Exploitation of Remote Services Video Capture Traffic Signaling Automated Exfiltration Account Access Removal Browser Extensions Exploitation for Privilege Escalation Indicator Removal on Host Credentials from Password Stores Man in the Browser Remote Access Software Exfiltration Over Alternative Protocol Disk Wipe Native API Traffic Signaling Modify Registry File and Directory Discovery Remote Service Session Hijacking Data from Information Repositories Dynamic Resolution Data Manipulation Inter-Process Communication BITS Jobs Trusted Developer Utilities Proxy Execution Steal or Forge Kerberos Tickets Non-Standard Port Transfer Data to Cloud AccountServer Software Component Peripheral Device Discovery Man-in-the-Middle Protocol Tunneling Traffic Signaling Forced Authentication Archive Collected Data Encrypted Channel Pre-OS Boot Signed Script Proxy Execution Steal Application Access Token Network Share Discovery Data from Network Shared Drive Non-Application Layer ProtocolCompromise Client Software Binary Password Policy Discovery Rogue Domain Controller Man-in-the-Middle Browser Bookmark Discovery Data from Cloud Storage ObjectImplant Container Image Indirect Command Execution Virtualization/Sandbox EvasionBITS Jobs XSL Script Processing Cloud Service Dashboard Template Injection Software Discovery File and Directory Permissions Modification Query Registry Remote System Discovery Virtualization/Sandbox Evasion Network Service Scanning Process Discovery Unused/Unsupported Cloud Regions System Information Discovery Use Alternate Authentication Material Account Discovery System Time Discovery Impair Defenses Domain Trust Discovery Hide Artifacts Cloud Service Discovery Masquerading Cloud Infrastructure Discovery Deobfuscate/Decode Files or Information Signed Binary Proxy Execution Exploitation for Defense Evasion Execution Guardrails Modify Cloud Compute Infrastructure Pre-OS Boot Subvert Trust Controls Source: http://gph.is/1cEuQWX
  • 54. ©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2.
  • 55. ©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2. History of PRE-ATT&CK ‱ Initially released in 2017 ‱ Separate matrix w/ 17 Tactics ‱ Adversary behaviors leading to compromise ‱ Example use cases: ‱ Are there signs that an adversary might be targeting you? ‱ Prioritize open-source intelligence gathering / sharing
  • 56. ©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2. The Long Con ‱ In 2018 (v2) the Launch and Compromise Tactics were refactored into Initial Access
  • 57. ©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2. Final Merge ‱ Deprecated PRE-ATT&CK matrix for PRE Enterprise platform ‱ 2 new Tactics ‱ Criteria for inclusion: 1. Technical 2. Visible to some defenders 3. Evidence of adversary use
  • 58. ©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2. Reconnaissance ‱ Actively or passively gathering information that can be used to support targeting. ‱ 10 Techniques & 31 Sub-techniques ‱ Split into what & how
  • 59. ©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2. Resource Development ‱ Building, buying, or compromising resources that can be used during targeting ‱ Infrastructure ‱ Accounts ‱ Capabilities ‱ 6 Techniques & 26 Sub-techniques
  • 60. ©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2. Technique Metadata ‱ New PRE platform ‱ New Pre-compromise Mitigation ‱ ex: This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on... ‱ Data sources and Detections relevant to potential Enterprise artifacts Source: https://i.pinimg.com/originals/71/6a/5b/716a5b5b8847470b77dde4a4b67f2a2b.gif
  • 61. ©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2. Why? ‱ Promote more adoption and contributions ‱ More integration across spectrum of adversary behaviors Source: https://gph.is/g/Z5K7bQE
  • 62. ©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2. Gone But Not Forgotten Previous versions (< v8) will retain the full matrix as well as individual techniques
  • 63. ©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2. How Can You Help? ‱ Feedback and contributions! ‱ New techniques + scoping of existing techniques ‱ Documentation of potential detections and mitigations ‱ Reported instances of adversary procedure examples Source: http://gph.is/2colVQl
  • 64. ©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 20-02605-2. Special Thanks
  • 65. Join our next session on December 11 Register now! https://na.eventscloud.com/ATTACKcon-november