MITRE's ATT&CK finds a home in the cybersecurity community

The fundamentals of cybersecurity have undergone a shift over the past few years.  It’s now accepted that it's not possible to stop bad actors at the perimeter of a network. That’s why MITRE started trying to understand the actions of attackers once they made it inside.

“About seven years ago … we started on a project that was trying to figure out better ways of detecting adversaries as they’re operating within a network,” Blake Strom, a principal security engineer at MITRE, told GCN.

MITRE, a non-profit that operates research and development centers for the federal government, was looking for ways to place sensors in networks and on endpoints to collect data that would indicate an active intrusion. To test these sensors, MITRE needed scenarios to run against them, Strom said.

But there wasn’t a very good model for creating these scenarios, so MITRE created ATT&CK, which stands for Adversarial Tactics, Techniques and Common Knowledge. It is a matrix of tools that shows how attackers break into a system and how they have been shown to move once inside.

ATT&CK was developed by a four-person team at MITRE that relied largely on publicly available threat reporting and threat intelligence offerings, like Mandiant’s reporting on China’s cyber espionage units.

If a cybersecurity report highlights a new group, MITRE then fully indexes it. If a report focuses on new malware, then MITRE creates a profile for the tool and maps it with ATT&CK to the group using it. To help track attackers that simply leverage the functionality of the operating system to get inside a network, the framework provides insight into how operations are conducted and how these groups interact with systems. It also provides the data sources -- process launches, command line arguments, API calls -- that detect the use of different techniques within a system. ATT&CK also includes mitigation options and descriptions of how actors use what information they exfiltrate.

The importance of the framework was recognized fairly quickly (it was a finalist in GCN’s 2016 digIT awards), and today it’s being integrated into several products and the cybersecurity strategy of organizations.

“This is something the industry has needed for a long time,” said Travis Smith, Tripwire's principal security researcher.

The techniques within the ATT&CK framework aren’t hypothetical; they have been observed in the wild. And security experts were already aware of most of them, but this brings those disparate resources into one shared location.

Carl Wright, the chief revenue officer of AttackIQ, said his company has been using the framework for its cybersecurity product, which allows users to run simulations against their network based on the techniques within ATT&CK.

For example, adversaries can get into the audio and visual equipment in conference rooms and exfiltrate data, Wright said, but with  AttackIQ or the ATT&CK framework, security officials can  tell how prepared their network is to prevent that kind of attack.

The MITRE framework provides more than just the matrix for cybersecurity defense.

“It's one thing for a vendor to say they’re addressing a problem, it's another thing for a third party to validate these claims,” said Lyndon Brown, the director of corporate development at Endgame, which works with AttackIQ.

Endgame partnered with MITRE, asking the researchers to validate the company's tools by emulating attacks against its products. “Endgame successfully stopped APT3 in the emulation exercise before any data theft or damage would have occurred,” the company said in a blog post.

This technology can be used to sniff out specifics attacks like WannaCry or Bad Rabbit. But it can also be helpful for a general check of a network's health. If one company is acquiring another, Brown said, the new owners might want to know if they’re also acquiring cybersecurity problems. The simulations based on ATT&CK can help determine that.

This framework also makes it easier for security professionals to communicate with non-security peers.

“One of the challenges that security teams have is communicating the value of the security investment,” Wright said. “So many times security is like an insurance policy, and it's very difficult to prove the worth of that investment prior to some attack. 

The framework allows red teams to discuss specific techniques, but it also allows for potential weaknesses to be communicated to those making actual budget decisions. Roberto Rodriguez took this a step further in his work as a senior threat hunter at Capital One where he used the framework to create a heat map of the company’s network health.

“I started understanding we weren’t considering some areas that were critical to the organization's security,” Rodriguez said.

The heat map showed the risk the organization faced per technique within ATT&CK, so  Rodriguez developed a risk score for each technique. That information allowed him to talk with leadership about risk with specific metrics, he said.

Since the release of ATT&CK,  the framework has expanded to Windows, Linux, Mac and  mobile. MITRE created Pre-ATT&CK for “left of exploit” knowledge and released the Cyber Analytics Repository for doing more behavioral-based detection.

Wright said the goal of a tool like ATT&CK is finding problems before a bad guy does. That’s important, he said, because “the number of attacks is just going to go up -- it’s not going to go down.”

Editor's note: This article was changed Nov. 28 to correct the title of Endgame's Lyndon Brown and a misspelling of the company name.