MITRE Practical Use Cases

[@dougthebugwrx]

brilliant thank you . Followed . one of the best explanations i have heard

[@HASecuritySolutions]

Glad it was helpful!

[@ehteramuddinmohammed3995]

Magnificent!! Super cool high level details amazingly put. Thank you very much

[@HASecuritySolutions]

Thank you very much!

[@FRITTY12348546]

Thank you so much for the content, seeing application is what helps me learn

[@FRITTY12348546]

One thought is how do you apply it one model matrix system? Windows servers, linux servers other OS or applications or overall one model

[@MrNightowl1980]

This is a great video! Much appreciated

[@nimaforoughi3008]

Nice High Level talks are always beneficial for wrapping up your knowledge as I did here. Thanks H & A security solutions. Worth watching a couple of times...

[@asklaha4856]

Very nice video, very well done... would like to see more such short videos and learn.

[@HASecuritySolutions]

I will try my best. More to come soon.

[@enderst81]

Great video, eagerly awaiting the next.

[@HASecuritySolutions]

More to come!

[@mauriciozp84]

Thanks for taking the time and answering our concerns!! I am trying to learn a little bit about this framework, am wondering how would you map an EDR, which is a blackbox, like Falcon from Crowdstrike? Or which will be your approach, thanks man.

[@sspoku]

Great video and nice message at the end. I will definitely pay it forward!

[@HASecuritySolutions]

Awesome! Thank you!

[@phogerman]

That's a great video 👏

[@ajaykumarkk3293]

Great video thank you!

[@HASecuritySolutions]

My pleasure!

[@Aleksandra1232]

Thank you, this is very useful.

[@HASecuritySolutions]

You're welcome

[@ekremozdemir99]

This was really useful. Thank you.

[@treasajoshy9232]

Really good 👍

[@linuxlove1912]

Thanks

[@DihCabral]

Brilliant indeed! Thanks

[@HASecuritySolutions]

Glad you liked it!

[@jaikisan3393]

Amazing insight!! Keep it up. May I know what those colors indicate when you upload JSON file to designer?

[@HASecuritySolutions]

The sigma colors of yellow, orange, and red represents how many rules cover a given technique. Yellow means one. Orange means 2. Red means 3+. For dettect imports, the shade of purple represents how much coverage you have by data source to technique. The darker the color the better the coverage

[@jaikisan3393]

@@HASecuritySolutions Many thanks for reply. How did you get those JSON files? Sorry I am new to this.

[@HASecuritySolutions]

@@jaikisan3393 No worries at all. The data source json files came from using the tool DeTTect which I cover here: kzbin.info/www/bejne/e4nRpqeKgbCGa9E and the alert json files come from the Sigma Generic Signatures project when using sigma2attack. I probably should make a video for Sigma :)

[@TheEggroll4321]

My use cases are not in yaml files they are just searches. Should I create them in yaml format and use sigma2attack to properly map them?

[@mauriciozp84]

Thanks for the awesome explanation!! Quick question, around minute 4:00 you uploaded to the Navigator the JSON file of Sysmon, from where that file came from? Was that file generated by DeTTECT? How? That file clearly had more coverage than regular Windows logs, but am wondering how that mapping was done, thanks.

[@HASecuritySolutions]

That file was created from using DeTTECT. I created a data source file stating I have built-in Windows channels, Sysinternals Sysmon coverage, and other Windows channels that there are common community rulesets such as from Sigma Generic Signatures. I then used the DeTTECT command-line script to convert it to a navigator JSON layer that I could upload to MITRE Navigator.

[@mauriciozp84]

@@HASecuritySolutions Probably didn't explain myself right, but I was wondering how the YAML was created (the coverage), please correct me if I am wrong but if we want to include Sysmon as a data source in DeTTECT or any other data source we MUST go to the vendor documentation and manually identify which techniques they provide some coverage according to their capabilities and use that intel in DeTTECT, right? I was under the impression that maybe there is a repository with the most common data sources already mapped, it sounds more like a community project as there are so many data sources out there (just thinking out loud here sorry)

[@HASecuritySolutions]

@@mauriciozp84 I think I understand your question now. For this, I did go to learn.microsoft.com/en-us/sysinternals/downloads/sysmon to look at all the event IDs generated and what they are for. Then, I map those to the corresponding MITRE Data sources which is what DeTTECT's data source list is based on (attack.mitre.org/datasources/). That builds the initial YAML file. To my knowledge, there is not a pre-provided list of software to data sources that you can use to build the YAML. However, while there are a ton of attack techniques in MITRE, there's currently only about 50 data sources. So doing the data source mapping does not take that long. For example, I can compare visibility from Sysmon vs an EDR's telemetry logs in about an hour just by mapping what logs I'm provided access to within MITRE Data Sources (within DeTTECT)

[@mauriciozp84]

@@HASecuritySolutions Got it, I was afraid you will say it was a manual work XD, thanks for the time you took answering our concerns, great video man!!

[@incoquinita]

Great video! Thanks!!

[@HASecuritySolutions]

You're welcome!

[@tradingmind4304]

Very cool.

[@HASecuritySolutions]

Thank you

[@a.gouveia4950]

Hi, you say you use to use another window to sum up the attacks. Can you elaborate on this?

[@HASecuritySolutions]

Mitre navigator let's you create layers. If you assign scores within each layer you can create a layer that combines our subtracts or compares one or more layers together

[@gennarolosappio2766]

Hi, is there a way to guess which hacking group is attacking me via a phishing or password brute force attack?

[@qamar060]

Amazing

[@HASecuritySolutions]

Thank you so much

[@dougthebugwrx]

how do we go about taking sample data into DeTT&CT and run it from a VM should we not have real data to play around with or a real environment . Could you possibly do a more detailed video on DeTT&CT ? how do we take that YAML file to JSON using python script via DeTT&CT ? could you consider showing that process in a short video please

[@HASecuritySolutions]

I've had multiple requests for this so I think I'll make it happen. Stay tuned

[@rv5080]

great video yaml to json doesnt work

[@HASecuritySolutions]

For the YAML to JSON you'll need to use the DeTTECT tool from github.com/rabobank-cdc/DeTTECT. Example below: python /opt/DeTTECT/dettect.py ds -fd input/your_data_source.yaml -l Depending on the version of DeTTECT the command may change.

[@rv5080]

@@HASecuritySolutions You mean the DeTTECT editor. Followed your example in the video, saved yaml file then used a yaml to json tool. get this error WARNING: Uploaded layer version (1) does not match Navigator's layer version (4.1). The layer configuration may not be fully restored. Thanks for the assistance

[@HASecuritySolutions]

@@rv5080 Yes. You are correct. I'll update the video description to clarify my statement that the yaml to JSON is intended to come from the DeTTECT editor's python code.

[@MrEmityushkin]

+

[@HASecuritySolutions]

Thank you

[@HishanShouketh]

Well explained, i say short and damn SWEET 🧁🎂🎂???

[@HASecuritySolutions]

Fantastic. That's the goal.