[Can be used in the field] MITRE ATT&CK Utilization Guide! Strengthen your defenses by gaining visibility into attacker modus operandi

"ATT&CK seems difficult because there are a lot of tables..."
"How can I use it for my company's security measures?"

For security professionals who have such questions, we will explain in an easy-to-understand manner everything from the structure of ATT&CK to how to use it!

Understanding the "Structure" of MITRE ATT&CK

ATT&CK is not just a list, but a systematized structure of attacks.
It is mainly composed of the following three elements. These are called "TTPs".

1. Tactics: The "objective" of the attacker

"What does the attacker want to do?"
For example, "Initial Access", "Execution", "Privilege Escalation", etc., are goals for each phase of the attack.
Currently, there are 14 tactics in the matrix for enterprises.

2. Techniques: The "means" of the attacker

It expresses "what exactly will you do to achieve your goal?"
For example, they use a method called "phishing" for the purpose of "initial access".

3. Procedures: The attacker's "specific how"

It is a detailed procedure of "How did you implement the technology?"
This includes the commands used by a particular malware and the behavior of each tool.

Tactics > "Technology" > Procedure (Details)
Understanding this hierarchical structure is the first step in deciphering ATT&CK!

How to view the ATT&CK Matrix

If you go to the ATT&CK website, you will see a huge table (matrix).

• Horizontal axis : Tactics = flow of attack (often from left to right)
• Vertical axis : Techniques = specific methods

By looking at this, you can predict what attackers might do next after they break in.

How to use it in the field? 3 examples of ATT&CK use

"It's meaningless just to look at it!"
That's right. Here are three ways to use it from tomorrow.

(1) Gap Analysis

Let's map which ATT&CK techniques your security products support.
"We are strong against 'malware execution', but we don't have any detection rules for 'stealing credentials'" can **** be seen.

(2) Leveraging Threat Intelligence

If you hear in the news that a new attack group 'APTxx' is trending, search for it in ATT&CK.
You can see the list of techniques they often use.
"Will this group use PowerShell a lot?

(3) Scenario Creation for Penetration Testing

Rather than "trying to attack somehow", you can test according to ATT&CK scenarios to assess your resistance to more realistic attacks.

Use MITRE ATT&CK Navigator

MITRE has released a useful tool called "ATT&CK Navigator" .
You can use it to color the matrix and leave notes on the browser.
Just "paint the techniques that your company has already taken measures in green" to complete a heatmap that visualizes the defense situation!
It is also very good as a report material to your boss.

Summary: Know the enemy's modus operandi and change your defense from "point" to "face"

• Understand the structure of Tactics, Techniques, and Procedures .
• Identify your company's weaknesses with gap analysis .
• Use Navigator to visualize your defenses.

By leveraging ATT&CK, you can evolve from "point" defense in alert response to "face" defense with an overall view of the attack scenario.

Let's use ATT&CK to create a strong security operation that is not inferior to attackers!