Mitre ATT&CK Matrix Used to Evaluate Endpoint Detection and Response Product

itman · Oct 23, 2017

Why I trust SE Labs tests more than other AV Lab test results.

The growing acceptance that it is impossible to detect and block all malware at the perimeter requires some form of response to malware post-breach. Endpoint Detection and Response (EDR), using machine learning behavioral rules to detect an intrusion, is the security industry's reply.

Anti-malware testing, however, is still largely predicated on malware detection, leaving the efficiency of the response side of EDR less well understood. EDR firm Endgame has sought to address this by using the Mitre ATT&CK Matrix to emulate the post-breach tactics used by the China-based APT3 group.

Mitre's Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) Matrix is a curated framework that describes the techniques used by adversaries once they are inside a network. It lists, under 10 tactic categories, all known tactics, techniques, and procedures (TTPs) used by adversaries to make decisions, expand their foothold and execute their intentions. These 10 categories derive from the later stages (control, maintain, and execute) of Lockheed Martin's seven-stage cyber kill chain.

The ATT&CK categories comprise persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, and execution.

This new expansion into using Mitre's ATT&CK Matrix is designed to highlight the ability of the 'response' side of EDR if (and when) detection fails.

SE Labs director Simon Edwards told SecurityWeek in an emailed statement, “We use a similar matrix when building targeted attacks and judging systems designed to detect/ protect against such attacks. We approached the project by analyzing real-world breaches and coming up with different criteria for each part of the attack chain. We did this independently of Mitre but the results are not very different.”
Click to expand...

http://www.securityweek.com/mitre-attck-matrix-used-evaluate-endpoint-detection-and-response-product

guest · Oct 23, 2018

Experts advocate for 'ATT&CK' as go-to framework to share threat intel
October 23, 2018
https://www.cyberscoop.com/mitre-attck-framework-experts-advocate/

Experts say that the “ATT&CK” framework — a model for organizing detailed information about how a threat group behaves — has been gaining in popularity and helping organizations share threat intelligence.

MITRE Corp., a federally funded nonprofit organization that manages public-private technology partnerships, started developing ATT&CK in 2013.

ATT&CK provides defenders with spreadsheet-style matrices that structure the way one can talk about an attacker’s tactics, techniques and procedures (TTP). The tables include different observable methods of persistence, exfiltration, lateral movement and other granular pieces of information.

“Having a framework like ATT&CK, where it’s standardized and you can map it across the kill chain, that’s what you need for defenders to be able to share. It’s also a much easier story that you can tell at higher levels such as the C-level,” said Jen Miller-Osborn, deputy director of threat intelligence at Palo Alto Networks’ Unit 42 research team
Click to expand...

guest · May 13, 2019

MITRE ATT&CK April 2019 Update
May 12, 2019
https://www.tripwire.com/state-of-security/mitre-framework/mitre-attck-update/

MITRE has released an April 2019 update to its ATT&CK framework. It’s been a year since the last major update featuring a new tactic. There are a number of changes for this year: the most major being the addition of a 12th Tactic, Impact, which contains 14 new Techniques. There are also 7 new Techniques under existing Tactics as well as a number of other minor changes.
IMPACT
The Impact Tactic covers integrity and availability attacks against enterprise systems. The 14 Techniques included in this update are as follows: [...]
Click to expand...

Log in or Sign up

Mitre ATT&CK Matrix Used to Evaluate Endpoint Detection and Response Product

itman Registered Member

guest Guest

guest Guest

Log in or Sign up

Mitre ATT&CK Matrix Used to Evaluate Endpoint Detection and Response Product

itman Registered Member

guest Guest

guest Guest

Useful Searches