In this demonstration, we will briefly cover
how to navigate the MITRE ATT&CK framework
which is a widely used tool in the field of cybersecurity.
It was developed to improve
our understanding of threat behaviors
and better our defenses.
We'll just touch bases on a few of the techniques used,
starting by looking at active scanning,
then we're going to switch to content injection,
and then finishing things off
with access token manipulation.
So, let's go to active scanning here
and every one of these techniques
are going to have a similar breakdown. You know,
we'll have the Active Scanning at the top
and we see here we have three sub-techniques.
So first, we have IP Block scanning
where instead of targeting a specific IP address,
you're scanning entire subnets,
whole blocks of IPs.
Now when there's the traditional Vulnerability Scanning
which helps us identify the software
and what different vulnerabilities they may have.
And then finally, we have the Wordlist Scanning,
so for example, adversaries might use
web content discovery tools like there Dirb, DirBuster,
and Gobuster to list out
the website's pages and directories.
And after that if you scroll down,
you'll see Procedure Examples
and that's one thing I really like about MITRE,
they really lay things out
and give you real-world examples.
So let's go to this Triton Safety Instrument System Attack.
So we see here
that the Triton Safety Instrumented System Attack
was the campaign employed by TEMP.Veles
which leveraged a Triton malware framework
against a petrochemical organization.
So it gives us a brief introduction
of what actually happened
and then it lets us know
all the techniques used in the group
'cause again, it's tracking all these APTs,
so these advanced persistent threats,
and it's given us a nice organization
of how they accomplish the attack
which I think is very fascinating.
And then also some of the software used as mentioned before
which is one that's familiar with us
that we're going to notice,
it's going to be Mimikatz
which is good for going through a system,
dumping hashes, dumping passwords,
things of that nature.
Then it has more references
about the full scope of the attack
if you're interested in that.
Okay, next we're going to move on to Content Injection,
so that's going to be under Initial Access.
All right, so we see adversaries may gain access
and continuously communicate with victims
by injecting malicious content into systems
through online network traffic.
So again, this is where we're going to really focus
on how to mitigate these things,
thinking about things like input validation
and just sanitizing inputs in general.
There's also multiple techniques that we can use
to mitigate as we see here.
And again, similar to active scanning,
we see we have the procedure examples.
We have one with Disco,
we have one with MustacheBouncer,
and then we have a few mitigation techniques.
So encrypt sensitive information,
restrict web-based content, all right?
And then it also gives us a way to focus on detection,
how to detect these type of attempts as they are happening.
And the last one that we're going to cover,
again, just to briefly go over
and see the layout of this website,
it's going to be Access Token Manipulation.
Okay, so again, as we saw with Active Scanning,
we have multiple sub-techniques
along with Access Token Manipulation.
We're going to focus on Token Impersonation,
Create a Process with a Token,
Make and Impersonate a Token, Parent PID Spoofing,
SID-History Injection, et cetera.
So it's going to give us a lot of information about this
if we wanted to go
and investigate further of how to execute
some of these more advanced techniques.
But again, as we saw before,
we have multiple examples of these procedures, right?
We see under Procedure Examples,
there's a lot of things happening here.
So we see that this is a consistent
and highly-used type of attack
which makes a lot of sense
because everything's becoming
very web-based and network-based.
These things are very useful
in the actual online interactions
when we're not actually worried about being attacked,
but again, this is where attackers come through
to make sure that they're going to manipulate the system
to gain some type of unauthorized access.
So again, similar to before,
we have the different mitigation techniques.
We have detection, we have the references
of the full attacks here.
All right, that wraps up this demonstration.
Again, MITRE is a great website to explore
if you want to see the different types of attacks
and how various APTs can carry them out.
Sometimes just talking about the theory behind these attacks
makes it harder to really grasp them,
but when you see how someone else did it,
it makes it much clearer.
I hope you enjoyed this demonstration
and I'll see you in the next one.