What is "MITRE" that you often hear in the security community? The engineer answers

"Ah, it's that Matrix guy, isn't it?"
"The one with the vulnerability ID?"

Yes, both are correct!
But when you are asked, "What is MITRE?", don't you feel unexpectedly speechless?

In fact, MITRE is extremely important as a "common language" for SOC (Security Operation Center) and security operations personnel like us.

In this article, we will explain the true nature of "MITRE" and why it is necessary for operation from an engineer's point of view.

 

**What is MITRE in the first place? **

In conclusion, MITRE (The MITRE Corporation) is an American non-profit organization.

It runs a government-backed research and development organization (FFRDC) that conducts research in a wide range of areas of public interest, including aviation systems and healthcare, as well as security.
In other words, it is not a for-profit company, but an image of a "research institute to improve the world" .

They are famous in the security industry because they "standardize and systematize cyberattack information" .

 

Commonly seen "CVEs" are also managed by MITRE

There is an ID like "CVE-2023-XXXX" that you always see when you look at vulnerability information, right?
It is actually MITRE that manages and operates those CVEs (Common Vulnerabilities and Exposures).

Thanks to the fact that we can call the information "There is a bug in this software!" with the same ID around the world, we are able to share information without confusion.

 

**What is MITRE ATT&CK? **

Now, let's get to the main topic.
When SOCs and operations personnel say "MITRE", they are most likely referring to this ** "MITRE ATT&CK (Adversary Tactics, Techniques, and Common Knowledge)"**.

What this means is a catalog of tactics and techniques that attackers actually use.

If the attacker uses

1. Initial access (how to get in)
2. Execution (how to move malicious code)
3. Persistence (how to stay seated)
   ...
   In this way, for each phase of the attack (tactic), the specific methods (techniques) are organized into a matrix table.

 

**Why is ATT&CK important? **

There is a saying, "If you know your enemy and know yourself, you will not be in danger", but ATT&CK is truly a "guide to the enemy's modus operandi" .

By having this, we in charge of operations have the following benefits.

1. See the full picture of the attack
   If it's just a one-off alert, it's over with "a virus found", but if you apply it to ATT&CK, "This is the phase of 'lateral expansion' after the intrusion. And you can guess the story of the attack.
2. Speak a common language
   If you say "There is a trace of execution using ATT&CK's T1059 (command line interface)" instead of "There was some suspicious movement", experts will convey it without misunderstanding.
3. Holes in the defense are found
   It can be used to check for omissions in countermeasures, such as "Our countermeasure product is strong against this tactic, but it is defenseless against this tactic."

 

Real Concerns in Operations

However, .......
"I understand the reasoning, but it's hard to actually use it!"
Isn't that the truth?

As you can see from the matrix of ATT&CK, the items are huge.
I think most sites are full of daily alert responses, but they don't have enough resources to map and analyze each attack method to ATT&CK.

"I want to create detection rules based on MITRE ATT&CK but I need too much expertise."
"There are too many alerts and I don't have time to analyze which phase of the attack it is."

You can almost hear such a scream. (In fact, I hear it a lot, and I understand it painfully...)

MITRE and ATT&CK are powerful weapons, but they require a certain amount of skill and time to master.
It would be a good idea to start by understanding what phases of attack we are responding to/are not able to respond to.

 

Conclusion

• MITRE is an American non-profit organization that manages CVEs and other organizations.
• MITRE ATT&CK is an "encyclopedia" that systematizes the methods of attackers.
• When used in operation, you can see the overall picture of the attack, but it is quite difficult to master it.
• When you're having a hard time, it's a smart choice to rely on a professional SOC service!

Understanding MITRE is the first step towards taking your security operations to the next level.
We hope this helps you analyze the current state of your security environment!