Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

8/6/2018
09:50 AM

Mastering MITRE's ATT&CK Matrix

This breakdown of Mitre's model for cyberattacks and defense can help organizations understand the stages of attack events and, ultimately, build better security.
2 of 12

Initial Access
Initial access is exactly what it sounds like, with an attacker first asking contact with your organization. If your security mechanisms recognize and properly respond to the attack at this stage, then the rest of the matrix is simply interesting reading. If not ...
The initial access stage can take many forms, from a spear-phishing link, to a malicious thumb drive found in a parking lot, to a trusted, authorized user who turns evil. In every form, though, a failure of human behavior, IT process, or security mechanism enables the attack to proceed.
While most attacks commonly at this stage, it is not necessarily the only way. As we walk across the horizontal axis of the ATT&CK matrix, we'll see classes of attack that begin further across the process in an attempt to slide beneath the radar of most security products.
(Image: Africa Studio VIA SHUTTERSTOCK)

Initial Access

Initial access is exactly what it sounds like, with an attacker first asking contact with your organization. If your security mechanisms recognize and properly respond to the attack at this stage, then the rest of the matrix is simply interesting reading. If not ...

The initial access stage can take many forms, from a spear-phishing link, to a malicious thumb drive found in a parking lot, to a trusted, authorized user who turns evil. In every form, though, a failure of human behavior, IT process, or security mechanism enables the attack to proceed.

While most attacks commonly at this stage, it is not necessarily the only way. As we walk across the horizontal axis of the ATT&CK matrix, we'll see classes of attack that begin further across the process in an attempt to slide beneath the radar of most security products.

(Image: Africa Studio VIA SHUTTERSTOCK)

2 of 12
Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
Kunchen
100%
0%
Kunchen,
User Rank: Apprentice
8/9/2018 | 2:20:02 PM
Good post
This is indeed a very good post.  I enjoyed reading and I see a sequel in the future? "What happens after C&C?" At least from a an IR, CIRT, or from a security team's perspective.  Lessons learned? Controls review? Mitigation of damages? Investigation? Handling with LEO? 
Sbdr204
100%
0%
Sbdr204,
User Rank: Apprentice
8/9/2018 | 10:46:11 AM
Red Team Integration
Great article! We've integrated the MITRE framework in our red team engagements to drive more value to our customers. Traditional red team penetration testing is dead, or it should be. Just going after privileged access like DA is a waste of time, as it's almost always easily accomplished through SE, MiTM, or trivial payload obfuscation. A much more valuable pentest involves evaluating the effectiveness of your controls against a number of probable attack vectors. That's where MITRE comes in. MITRE does a great job of identifying a wide range of attacks, and allows you to understand how effective your controls are in detecting and preventing it. Not to mention providing interpretable metrics that better establish what your organizations risk really is.
fredheen
50%
50%
fredheen,
User Rank: Apprentice
8/8/2018 | 5:57:47 AM
My opinion
In my opinion, it's quite interesting to read 
7 Truths About BEC Scams
Ericka Chickowski, Contributing Writer,  6/13/2019
DNS Firewalls Could Prevent Billions in Losses to Cybercrime
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/13/2019
Can Your Patching Strategy Keep Up with the Demands of Open Source?
Tim Mackey, Principal Security Strategist, CyRC, at Synopsys,  6/18/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-3896
PUBLISHED: 2019-06-19
A double-free can happen in idr_remove_all() in lib/idr.c in the Linux kernel 2.6 branch. An unprivileged local attacker can use this flaw for a privilege escalation or for a system crash and a denial of service (DoS).
CVE-2019-3954
PUBLISHED: 2019-06-19
Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.0 allows a remote, unauthenticated attacker to execute arbitrary code by sending a crafted IOCTL 81024 RPC call.
CVE-2019-10085
PUBLISHED: 2019-06-19
In Apache Allura prior to 1.11.0, a vulnerability exists for stored XSS on the user dropdown selector when creating or editing tickets. The XSS executes when a user engages with that dropdown on that page.
CVE-2019-11038
PUBLISHED: 2019-06-19
When using gdImageCreateFromXbm() function of gd extension in versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been ...
CVE-2019-11039
PUBLISHED: 2019-06-19
Function iconv_mime_decode_headers() in versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.