Helping Small Companies Leverage CTI with an Open Source Threat Mapping

•

0 j'aime•668 vues

From MITRE ATT&CKcon Power Hour December 2020 By Valentina Palacín, Sr. Cyber Threat Intelligence Analyst No one can deny the tremendous impact that ATT&CK had on the cybersecurity industry, nor the usefulness of having a good Threat Library at your disposal. But the question Valentina gets asked over and over by people from small companies is always the same: “How could I leverage threat intelligence using ATT&CK with limited time and resources?” And so far, there hasn't been a good answer. That’s why she decided to come up with the Threat Mapping Catalogue (TMC), a tool that combines the power of the mappings already available in the ATT&CK website, TRAM and the ATT&CK Navigator, to better process, consume and incorporate new mappings while organizing them around different categories.

Gouvernement et associations à but non lucratif

Valentina Palacín
THREAT MAPPING
CATALOGUE

TABLE OF CONTENTS
01
ABOUT ME
02
INSPIRATION
03
IDEA
04
EXPECTATIONS
05
REALITY
06
FUTURE

01 ABOUT MEValentina Palacín
@fierytermite

VALENTINA PALACÍN
@FIERYTERMITE
Translator
Threat Intelligence Analyst
Threat Hunter & Python Developer in progress

THREAT LIBRARY
Knowledge Base for
distilled and curated
intelligence insights
produced by CTI
Research Teams &
OSINT Sources.

HowCAN I LEVERAGE SOMETHING LIKE THIS
IF I DON’T HAVE A DEDICATED TEAM?

MY
WISHLIST
● Load DB with ATT&CK content
● Use TRAM to load new relationships
● Manually add adversary mappings
● Create more relationships (industries,
dates, adversary types…)
● Explore relationships through GUI
● Edit selected data through GUI
● Edit relationships through GUI
● Export data to ATT&CK Navigator
● Dockerize everything for easy deployment

SO FAR…
● Load DB with ATT&CK content
● Use TRAM to load new relationships
● Manually add adversary mappings
● Create more relationships (industries,
dates, adversary types…)
● Explore relationships through GUI
● Edit selected data through GUI
● Edit relationships through GUI
● Export data to ATT&CK Navigator
● Dockerize everything for easy deployment

/first-time
git clone
https://github.com/fierytermite/attack-navigator
git clone --branch tmc
https://github.com/fierytermite/tram-1
git clone
https://github.com/intelforge/tmc
* Register and Login with the new user

localhost:4200/fetch/http:%2F%2Flocalhost:5000%2Fstatic%2Fexport%2Fadversary_1_60ba8984-3b68-11eb-834e-080027bab013.json

GOALS
● Create more relationships (dates,
adversary types…)
● Manually load new mapping
● Edit relationships through UI
● Dockerize everything for easy
deployment
● Add relational graphs to study the
adversaries

CREDITS: This presentation template was
created by Slidesgo, including icons by
Flaticon, and infographics& images by
Freepik.
THANKS!
Please keep this slide for attribution.
Do you have any questions?
@fierytermite
linkedin.com/in/valentinapalacin
Credits: This presentation template was created by Slidesg, including
icons by Flaticon and infographics & images by Freepik.

Recommandé

Sharpening your Threat-Hunting Program with ATTACK FrameworkMITRE - ATT&CKcon

Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and ResearchMITRE - ATT&CKcon

Transforming Adversary Emulation Into a Data Analysis QuestionMITRE - ATT&CKcon

Starting Over with Sub-TechniquesMITRE - ATT&CKcon

Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...MITRE - ATT&CKcon

Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...MITRE ATT&CK

State of the ATTACKMITRE - ATT&CKcon

MITRE ATT&CKcon 2018: Helping Your Non-Security Executives Understand ATT&CK ...MITRE - ATT&CKcon

Recommandé

Sharpening your Threat-Hunting Program with ATTACK FrameworkMITRE - ATT&CKcon

Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and ResearchMITRE - ATT&CKcon

Transforming Adversary Emulation Into a Data Analysis QuestionMITRE - ATT&CKcon

Starting Over with Sub-TechniquesMITRE - ATT&CKcon

Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...MITRE - ATT&CKcon

Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...MITRE ATT&CK

State of the ATTACKMITRE - ATT&CKcon

MITRE ATT&CKcon 2018: Helping Your Non-Security Executives Understand ATT&CK ...MITRE - ATT&CKcon

From Theory to Practice: How My ATTACK Perspectives Have ChangedMITRE - ATT&CKcon

Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...MITRE ATT&CK

Knowledge for the masses: Storytelling with ATT&CKMITRE ATT&CK

Using ATTACK to Create Cyber DBTS for Nuclear Power PlantsMITRE - ATT&CKcon

Tracking Noisy Behavior and Risk-Based Alerting with ATT&CKMITRE ATT&CK

ATT&CK Updates- ATT&CK's Open SourceMITRE ATT&CK

Projects to Impact- Operationalizing Work from the CenterMITRE ATT&CK

The ATT&CK Latin American APT PlaybookMITRE ATT&CK

Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...MITRE ATT&CK

When Insiders ATT&CK!MITRE ATT&CK

Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...MITRE ATT&CK

Threat hunting - Every day is hunting seasonBen Boyd

State of the ATT&CKMITRE ATT&CK

ATT&CKING Containers in The CloudMITRE ATT&CK

ATTACKers Think in Graphs: Building Graphs for Threat IntelligenceMITRE - ATT&CKcon

Threat Modelling - It's not just for developersMITRE ATT&CK

It's just a jump to the left (of boom): Prioritizing detection implementation...MITRE ATT&CK

Threat Hunting Report Morane Decriem

Introduction to MITRE ATT&CKArpan Raval

Red Team Framework👀 Joe Gray

ATTACK-Onomics: Attacking the Economics Behind Techniques Used by AdversariesMITRE - ATT&CKcon

MITRE ATTACKcon Power Hour - JanuaryMITRE - ATT&CKcon

Contenu connexe

Tendances

From Theory to Practice: How My ATTACK Perspectives Have ChangedMITRE - ATT&CKcon

Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...MITRE ATT&CK

Knowledge for the masses: Storytelling with ATT&CKMITRE ATT&CK

Using ATTACK to Create Cyber DBTS for Nuclear Power PlantsMITRE - ATT&CKcon

Tracking Noisy Behavior and Risk-Based Alerting with ATT&CKMITRE ATT&CK

ATT&CK Updates- ATT&CK's Open SourceMITRE ATT&CK

Projects to Impact- Operationalizing Work from the CenterMITRE ATT&CK

The ATT&CK Latin American APT PlaybookMITRE ATT&CK

Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...MITRE ATT&CK

When Insiders ATT&CK!MITRE ATT&CK

Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...MITRE ATT&CK

Threat hunting - Every day is hunting seasonBen Boyd

State of the ATT&CKMITRE ATT&CK

ATT&CKING Containers in The CloudMITRE ATT&CK

ATTACKers Think in Graphs: Building Graphs for Threat IntelligenceMITRE - ATT&CKcon

Threat Modelling - It's not just for developersMITRE ATT&CK

It's just a jump to the left (of boom): Prioritizing detection implementation...MITRE ATT&CK

Threat Hunting Report Morane Decriem

Introduction to MITRE ATT&CKArpan Raval

Red Team Framework👀 Joe Gray

Tendances (20)

From Theory to Practice: How My ATTACK Perspectives Have Changed

Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...

Knowledge for the masses: Storytelling with ATT&CK

Using ATTACK to Create Cyber DBTS for Nuclear Power Plants

Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK

ATT&CK Updates- ATT&CK's Open Source

Projects to Impact- Operationalizing Work from the Center

The ATT&CK Latin American APT Playbook

Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...

When Insiders ATT&CK!

Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...

Threat hunting - Every day is hunting season

State of the ATT&CK

ATT&CKING Containers in The Cloud

ATTACKers Think in Graphs: Building Graphs for Threat Intelligence

Threat Modelling - It's not just for developers

It's just a jump to the left (of boom): Prioritizing detection implementation...

Threat Hunting Report

Introduction to MITRE ATT&CK

Red Team Framework

Plus de MITRE - ATT&CKcon

ATTACK-Onomics: Attacking the Economics Behind Techniques Used by AdversariesMITRE - ATT&CKcon

MITRE ATTACKcon Power Hour - JanuaryMITRE - ATT&CKcon

What's New with ATTACK for ICS?MITRE - ATT&CKcon

Putting the PRE into ATTACKMITRE - ATT&CKcon

What's a MITRE with your Security?MITRE - ATT&CKcon

ATTACKing the Cloud: Hopping Between the MatricesMITRE - ATT&CKcon

Mapping the EventBot Mobile Banking Trojan with MITRE ATTACK for MobileMITRE - ATT&CKcon

TA505: A Study of High End Big Game Hunting in 2020MITRE - ATT&CKcon

What's New with ATTACK for Cloud?MITRE - ATT&CKcon

MITRE ATTACKCon Power Hour - DecemberMITRE - ATT&CKcon

MITRE ATT&CKcon Power Hour - NovemberMITRE - ATT&CKcon

MITRE ATTACKcon Power Hour - OctoberMITRE - ATT&CKcon

MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...MITRE - ATT&CKcon

MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...MITRE - ATT&CKcon

MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...MITRE - ATT&CKcon

MITRE ATT&CKcon 2.0: Keynote Address - The Friends We Made Along the Way; Ton...MITRE - ATT&CKcon

MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...MITRE - ATT&CKcon

MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE - ATT&CKcon

MITRE ATT&CKcon 2.0: Alertable Techniques for Linux Using ATT&CK; Tony Lamber...MITRE - ATT&CKcon

MITRE ATT&CKcon 2.0: ATT&CK Coverage Assessment from a Data Perspective; Olaf...MITRE - ATT&CKcon

Plus de MITRE - ATT&CKcon (20)

ATTACK-Onomics: Attacking the Economics Behind Techniques Used by Adversaries

MITRE ATTACKcon Power Hour - January

What's New with ATTACK for ICS?

Putting the PRE into ATTACK

What's a MITRE with your Security?

ATTACKing the Cloud: Hopping Between the Matrices

Mapping the EventBot Mobile Banking Trojan with MITRE ATTACK for Mobile

TA505: A Study of High End Big Game Hunting in 2020

What's New with ATTACK for Cloud?

MITRE ATTACKCon Power Hour - December

MITRE ATT&CKcon Power Hour - November

MITRE ATTACKcon Power Hour - October

MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...

MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...

MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...

MITRE ATT&CKcon 2.0: Keynote Address - The Friends We Made Along the Way; Ton...

MITRE ATT&CKcon 2.0: Prioritizing Data Sources for Minimum Viable Detection; ...

MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...

MITRE ATT&CKcon 2.0: Alertable Techniques for Linux Using ATT&CK; Tony Lamber...

MITRE ATT&CKcon 2.0: ATT&CK Coverage Assessment from a Data Perspective; Olaf...

Dernier

call girls in Model Town DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️saminamagar

2024: The FAR, Federal Acquisition Regulations - Part 26JSchaus & Associates

Call Girl Benson Town - Phone No 7001305949 For Ultimate Sexual Urgesnarwatsonia7

call girls in sector 22 Gurgaon 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️saminamagar

In credit? Assessing where Universal Credit’s long rollout has left the benef...ResolutionFoundation

call girls in Punjabi Bagh DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️saminamagar

Hot Sexy call girls in Palam Vihar🔝 9953056974 🔝 escort Service9953056974 Low Rate Call Girls In Saket, Delhi NCR

Premium Call Girls Btm Layout - 7001305949 Escorts Service with Real Photos a...narwatsonia7

Stop throwing your old clothes and start donatingSERUDS INDIA

Call Girls In Pullman Hotel New Delhi Aerocity 9873777170Sonam Pathan

If there is a Hell on Earth, it is the Lives of Children in Gaza.pdfKatrina Sriranpong

call girls in Kirti Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️saminamagar

Russian Call Girl Hebbagodi ! 7001305949 ₹2999 Only and Free Hotel Delivery 2...narwatsonia7

Panet vs.Plastics - Earth Day 2024 - 22 APRILChristina Parmionova

How to design healthy team dynamics to deliver successful digital projects.pptxTechSoupConnectLondo

WORLD CREATIVITY AND INNOVATION DAY 2024.Christina Parmionova

High-Level Thematic Event on Tourism - SUSTAINABILITY WEEK 2024- United Natio...Christina Parmionova

YHR Fall 2023 Issue (Joseph Manning Interview) (2).pdfyalehistoricalreview

call girls in Narela DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️saminamagar

call girls in sector 24 Gurgaon 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️saminamagar

Dernier (20)

call girls in Model Town DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️

2024: The FAR, Federal Acquisition Regulations - Part 26

Call Girl Benson Town - Phone No 7001305949 For Ultimate Sexual Urges

call girls in sector 22 Gurgaon 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️

In credit? Assessing where Universal Credit’s long rollout has left the benef...

call girls in Punjabi Bagh DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️

Hot Sexy call girls in Palam Vihar🔝 9953056974 🔝 escort Service

Premium Call Girls Btm Layout - 7001305949 Escorts Service with Real Photos a...

Stop throwing your old clothes and start donating

Call Girls In Pullman Hotel New Delhi Aerocity 9873777170

If there is a Hell on Earth, it is the Lives of Children in Gaza.pdf

call girls in Kirti Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️

Russian Call Girl Hebbagodi ! 7001305949 ₹2999 Only and Free Hotel Delivery 2...

Panet vs.Plastics - Earth Day 2024 - 22 APRIL

How to design healthy team dynamics to deliver successful digital projects.pptx

WORLD CREATIVITY AND INNOVATION DAY 2024.

High-Level Thematic Event on Tourism - SUSTAINABILITY WEEK 2024- United Natio...

YHR Fall 2023 Issue (Joseph Manning Interview) (2).pdf

call girls in Narela DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️

call girls in sector 24 Gurgaon 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️

Helping Small Companies Leverage CTI with an Open Source Threat Mapping

1. Valentina Palacín THREAT MAPPING CATALOGUE

2. TABLE OF CONTENTS 01 ABOUT ME 02 INSPIRATION 03 IDEA 04 EXPECTATIONS 05 REALITY 06 FUTURE

3. 01 ABOUT MEValentina Palacín @fierytermite

4. VALENTINA PALACÍN @FIERYTERMITE Translator Threat Intelligence Analyst Threat Hunter & Python Developer in progress

5. 02 INSPIRATIONHow was the idea born ?

6. THREAT LIBRARY Knowledge Base for distilled and curated intelligence insights produced by CTI Research Teams & OSINT Sources.

7. HowCAN I LEVERAGE SOMETHING LIKE THIS IF I DON’T HAVE A DEDICATED TEAM?

8. 03 IDEAThreat Mapping Catalogue

9. WHAT IF…? TMC ATT&CK

10. 04 EXPECTATIONS Capabilities

11. MY WISHLIST ● Load DB with ATT&CK content ● Use TRAM to load new relationships ● Manually add adversary mappings ● Create more relationships (industries, dates, adversary types…) ● Explore relationships through GUI ● Edit selected data through GUI ● Edit relationships through GUI ● Export data to ATT&CK Navigator ● Dockerize everything for easy deployment

12. But2020

13.

14. WHY DID I DO THIS TO MYSELF?

15. 05 REALITYCapabilities

16. SO FAR… ● Load DB with ATT&CK content ● Use TRAM to load new relationships ● Manually add adversary mappings ● Create more relationships (industries, dates, adversary types…) ● Explore relationships through GUI ● Edit selected data through GUI ● Edit relationships through GUI ● Export data to ATT&CK Navigator ● Dockerize everything for easy deployment

17. /first-time git clone https://github.com/fierytermite/attack-navigator git clone --branch tmc https://github.com/fierytermite/tram-1 git clone https://github.com/intelforge/tmc * Register and Login with the new user

18. FIRST…

19. FIRST… 1.3H

20.

21.

22. localhost:4200/fetch/http:%2F%2Flocalhost:5000%2Fstatic%2Fexport%2Fadversary_1_60ba8984-3b68-11eb-834e-080027bab013.json

23.

24.

25.

26.

27.

28.

29.

30.

31. 06 FUTURECapabilities

32. GOALS ● Create more relationships (dates, adversary types…) ● Manually load new mapping ● Edit relationships through UI ● Dockerize everything for easy deployment ● Add relational graphs to study the adversaries

33. BUT FOR NOW…

34. CREDITS: This presentation template was created by Slidesgo, including icons by Flaticon, and infographics& images by Freepik. THANKS! Please keep this slide for attribution. Do you have any questions? @fierytermite linkedin.com/in/valentinapalacin Credits: This presentation template was created by Slidesg, including icons by Flaticon and infographics & images by Freepik.