⚠️ This post has moved to our new blog and is kept here for archival purposes. https://ctid.mitre.org/blog/2025/01/03/stacked-defense-from-the-hardware-up/

Advanced security features in hardware can be partnered with operating system (OS) and software security features to optimize mitigations against cyber threats. However, these hardware-based capabilities are typically not well known to security practitioners. With modern chips deployed to tens of millions of enterprise systems there is a tremendous opportunity create defense-in-depth to counter adversarial threats to systems and data.

To meet this need, the Center for Threat-Informed Defense (Center) created Security Stack Mappings (SSM) - Intel vPro in partnership with Center participants AttackIQ, CrowdStrike, Intel Corporation, and Microsoft Corporation. The SSM-Intel vPro project connects adversarial behaviors as described in MITRE ATT&CK® to integrated hardware, OS, and security software capabilities of standard enterprise-class systems. With this, threat-informed defenders apply these additive capabilities to mitigate real-world adversary behaviors.

The resources for the SSM-Intel vPro project — including the mappings, ATT&CK Navigator layers, and the mapping methodology — are all available in Mappings Explorer. Mappings Explorer enables cyber defenders to easily access and explore the Center’s mapped security capabilities, bridging the gap between a threat-informed approach to cybersecurity and the traditional perspective of security controls.

What Does the Hardware Do for Defense?

The SSM-Intel vPro project illustrates the security capabilities of recent generation system hardware when stacked with OS and security software. Defensive capabilities available within enterprise hardware used in conjunction with OS security and with security software solutions can defend against specific ATT&CK adversary techniques.

Project Scope

Setting the project scope involved determining which OS and security software capabilities were enabled or enhanced by the underlying hardware. The integrated security capabilities included in scope were derived from the following product areas:

• Intel Core Ultra vPro Enterprise
• Microsoft Windows 11 with Microsoft Defender
• CrowdStrike Falcon

For each product area, the security capabilities considered in scope for this project are:

• integrated hardware capabilities with OS or software implementation
• included as part of the product’s native security offering
• technical in nature (versus administrative or physical)
• technically documented with publicly available security information, indicating protection from, detection of, or response to adversary behaviors as described in ATT&CK.

Capabilities included in project scope are integrated hardware capabilities with OS or security software implementation. The mappings show how software uses features of the hardware, and OS and software capabilities that are not hardware-enabled were not mapped as those are outside of this project’s solution set.

Mapping Methodology

We applied a tailored Security Stack Mapping Methodology to connect the combined hardware-level and OS, or combined hardware-level and security software protection, detection, and response capabilities. The methodology utilizes the information in the ATT&CK knowledge base and its underlying data model to understand, assess, and record the real-world threats that security controls can potentially mitigate.

The methodology follows these steps:

1. Identify security capabilities in scope. Identify the Intel hardware capabilities used by CrowdStrike Falcon and Windows 11 Enterprise with Microsoft Defender to be mapped.
2. Review security capability documentation. For in-scope integrated capabilities, identify and evaluate the mitigating security features provided for adversarial threats.
3. Identify mappable ATT&CK Techniques & Sub-techniques. Identify the ATT&CKv15.1 techniques and sub-techniques mappable to the integrated capability.
4. Score the effectiveness of the capability for the adversary behavior. Assess the effectiveness of the type of capability provided for the identified ATT&CK techniques and sub-techniques.

• Protect: capability limits or contains the impact of a (sub-)technique.
• Detect: capability identifies the potential occurrence of a (sub-)technique.
• Respond: capability provides actions to take for detected (sub-)technique.

5. Create a mapping of integrated capabilities to ATT&CK (sub-)technique. Creating a mapping of the integrated capabilities based on the information gathered from the previous steps.

By documenting and sharing our scoping decisions and methodology, we aim to accelerate community collaboration. Due to the nature of mapping security controls to ATT&CK, we anticipate differences in perspective on overall approach and possibly even the mapping of specific controls to specific techniques. We welcome your feedback and perspectives.

Mapping Summary

The SSM-Intel vPro project mapped Microsoft Windows 11 Enterprise with Microsoft Defender and CrowdStrike Falcon hardware-enabled capabilities under the security categories of Hardware — Advanced Threat Protection, Hardware — Trusted Computing, Hardware — Encryption and Data Protection, and Hardware — Virtualization, resulting in over 230 mappings of integrated mitigations to adversary behaviors. The mappings depict the practical application of the hardware for specific adversarial threats, and how hardware-enabled security can be used in conjunction with OS security solutions and with security software to provide defense-in-depth solutions. The table below provides an overview of the security features in hardware leveraged by OS and security software features mapped under this project.

Integrated Mapping Examples

An example of Hardware — Advanced Threat Protection integration is Intel Threat Detection Technology (TDT) with CrowdStrike Falcon Accelerated Memory Scanning (AMS). AMS enhances visibility of in-memory patterns and threats, such as attempts to cover up malicious activity or code execution masquerading as legitimate processes. This combination enables faster detection of cyber threats earlier in the kill chain and in real-time, with minimal impact on system performance. With this integration we identified protect and detect coverage for over 90 ATT&CK (sub-)techniques, depicted below.

Intel Platform Trust Technology (PTT) and Microsoft Windows Hello Enhanced Sign-in Security (ESS) yield a Hardware — Trusted Computing integrated mapping. The Trusted Platform Module (TPM) offered by Intel Platform Trust Technology (PTT) stores authentication data including public/private key pairs. Windows Hello ESS protects against the risk of credentials being stored in files by eliminating the need for passwords in many authentication scenarios. This integration resulted in mappings for protect and detect coverage for over 20 ATT&CK (sub-)techniques, as depicted below.

Get Involved

We welcome your feedback and contributions to continue to advance the SSM-Intel vPro Mapping project. There are several ways that you can get involved with this and other mapping projects to help advance threat-informed defense:

• Review the mappings, use them, and tell us what you think. We welcome your review and feedback on the SSM-Intel vPro mappings, our methodology, and resources.
• Analyze and map your security capabilities. We encourage use of our methodology to map security capabilities of additional products and we welcome mapping contributions.
• Help us prioritize additional platforms to map. Let us know what platforms you would like to see mapped to ATT&CK. Your input will help us prioritize how we expand our mappings.
• Share your ideas. Share your ideas or suggestions for additional tools and resources for helping the community to understand and make threat-informed decisions.

You are also welcome to submit issues for any technical questions/concerns or contact the Center directly for more general inquiries.

About the Center for Threat-Informed Defense

The Center is a non-profit, privately funded research and development organization operated by MITRE. The Center’s mission is to advance the state of the art and the state of the practice in threat-informed defense globally. Comprised of participant organizations from around the globe with highly sophisticated security teams, the Center builds on MITRE ATT&CK®, an important foundation for threat-informed defense used by security teams and vendors in their enterprise security operations. Because the Center operates for the public good, outputs of its research and development are available publicly and for the benefit of all.

© 2024 MITRE Engenuity. Approved for Public Release. Document number CT0137.

Stacked Defense from the Hardware Up was originally published in Center for Threat-Informed Defense on Medium, where people are continuing the conversation by highlighting and responding to this story.

⚠️ This post has moved to our new blog and is kept here for archival purposes. https://ctid.mitre.org/blog/2024/12/16/summiting-the-pyramid-bring-the-pain/

David Bianco’s The Pyramid of Pain introduced the world to the idea that if defenders focused on identifying and detecting adversary tactics, techniques, and procedures (TTPs), it would be harder for adversaries to evade detection. The higher up the Pyramid a defender can detect, the greater the cost imposed on the adversary.

In 2023, the Center for Threat-Informed Defense created and released Summiting the Pyramid. Summiting the Pyramid (STP) provided a methodology to score analytics against the pyramid of pain, helping defenders create more robust detections against adversary behavior. The methodology scores analytics against the pyramid of pain and changes the way we assess about detection engineering by scrutinizing the components within the analytic. Since its release, Summiting the Pyramid has been used by organizations to improve their detections of adversary behavior, and the Sigma analytics repository now has an STP flag to score the robustness of open-source analytics.

The initial research broke ground on the new dimension of robustness, and immediately the community asked for more. Two requests in particular inspired our next research area:

• Fewer false positives. How can we write robust detection analytics that are resistant to adversary evasion without introducing too many false positives?
• Determining analytic robustness scoring for network-based analytics. How could we expand the scoring framework to include analytics from both a network-based sensing and host-based sensing perspective? The initial release of Summiting provided a framework for scoring host-based analytics, primarily from the Windows Operating System (OS).

In partnership with AttackIQ, Fortinet, IBM Security, Lloyds Banking Group, and The Microsoft Corporation, Summiting the Pyramid now includes resources for defenders to build accurate, robust analytics for host and network data that are difficult for an adversary to evade.

Build a Robust Detection

Ideally, our detections will be accurate and resistant to adversary evasion over time.

An accurate analytic has low false positives and low false negatives (i.e., good precision and recall). A robust analytic will remain accurate, even as adversaries implement new and sneakier versions of ATT&CK techniques.

The methodology now provides three actionable steps to build robust detections:

1. Identify sets of observables which will trigger no matter how a technique is implemented, known as a spanning set.
2. Select spanning sets which are most specific to malicious behavior, focusing on resistance to adversary evasion first, and then on accuracy.
3. Add false positive exclusions, making the detection more accurate. These exclusions use specific values of fields that are difficult for the adversary to modify. This is necessary to preclude an adversary “hiding” within the exclusion itself.

Summiting the Pyramid has introduced Detection Decomposition Diagrams (D3) to facilitate this process. These D3 visuals give defenders a view across multiple implementations of a technique to identify analytic and event observables for robust detections. D3 visuals include benign and malicious implementations of the technique. Observables which span across multiple implementations provide higher robustness; that is, resistance to adversary evasion over time. Other observables may be used for better accuracy rates.

There will be tradeoffs between robustness and accuracy when building more robust detections. For some technique a detection’s, resistance to adversary evasion might be more important than accuracy, or vice versa. The robust detection guidance and D3 visuals provide defenders the tools and steps to evaluate the tradeoffs, determine how each component impacts the detection, and build the most impactful detection for their environment.

Expanding to Network Detections

Summiting the Pyramid now has two frameworks for scoring detections: host-based model and network traffic model. These are separate because OS-based robustness looks different from network traffic robustness.

The host-based model consists of three event-robustness columns. It measures the increasing cost or difficulty for the adversary to avoid host-based sensors. This includes host-based network events. To incorporate these events, the rows have been updated to account for detections or events which may occur on the outside boundary (Level 2) or within the defender’s environment (Level 3).

The network traffic model scores detections based on the increasing cost or difficulty for the adversary to avoid sensor visibility into the relevant network protocol. This model has two columns: protocol header and protocol payload. Network traffic robustness increases as you move into the header, since a defender will not need to rely on obfuscated network traffic payloads to detect adversarial activity.

With these two models, defenders can analyze robustness from both a host-based and network perspective.

Increasing Difficulty on Adversaries in v2

Summiting the Pyramid provides a framework to understand how adversaries can evade detections, helping defenders build more accurate, robust detections. In this continuation of Summiting the Pyramid, defenders can:

• Utilize step-by-step guidance and D3 visuals to build robust detections which are accurate and resistant to adversary evasion over time.
• Scoring to network detections and improve them through pre-scored observables.
• Use the Summiting the Pyramid analytics repository.

Future work will include how to build more robust detections against non-malicious (living-off-the-land) techniques and will expand the Summiting the Pyramid framework to more OS’s and environments.

Get Involved

We would love to hear about how you’re using our work! If you have any feedback, technical questions, concerns, or contributions you’d like to make to the project, please email us at ctid@mitre-engenuity.org or submit an issue via Github!

About the Center for Threat-Informed Defense

The Center is a non-profit, privately funded research and development organization operated by MITRE. The Center’s mission is to advance the state of the art and the state of the practice in threat-informed defense globally. Comprised of participant organizations from around the globe with highly sophisticated security teams, the Center builds on MITRE ATT&CK®, an important foundation for threat-informed defense used by security teams and vendors in their enterprise security operations. Because the Center operates for the public good, outputs of its research and development are available publicly and for the benefit of all.

© 2024 MITRE Engenuity. Approved for Public Release. Document number CT0128.

Summiting the Pyramid: Bring the Pain with Robust and Accurate Detection was originally published in Center for Threat-Informed Defense on Medium, where people are continuing the conversation by highlighting and responding to this story.

⚠️ This post has moved to our new blog and is kept here for archival purposes. https://ctid.mitre.org/blog/2024/12/13/best-defense-is-a-security-capability-mapped-to-attack/

Preventing adversary behaviors can seem like an impossible task, particularly when advanced persistent threats (APTs) are again in the news with another high-profile attack. If an adversary can breach a Fortune 500 company, what chance do you have? With the Center for Threat-Informed Defense (Center) security capability mappings, you will improve your odds.

Most organizations have access to security control frameworks, either through native controls, e.g. Microsoft Windows security feature, or vendor-provided controls, e.g. AWS Security. When we draw a clear path from a security control to an adversary tactic, technique, or procedure (TTP), you can see their defensive power. The Center created the standard to illuminate a clear path, or mapping, from control to TTP.

These mappings are a transparent way for defenders to apply MITRE ATT&CK® in their environments. However, ATT&CK updates twice a year which means the techniques advance while the control mappings are left behind. Security control frameworks are also updated, furthering the divide. As a result, the capabilities contained in each mappings project at their time of publication do not reflect recent adversary techniques or defensive measures. When the mappings are out of sync with a version of ATT&CK, they lose: a version 8 defense may not protect against a version 12 adversary. Keeping an organization’s mappings current with recent versions of ATT&CK is a good practice, but ad hoc updates of mappings to ATT&CK are costly. In partnership with Center members Center for Internet Security, Citigroup, HCA Healthcare, JPMorgan Chase Bank N.A., Lloyds Banking Group, Microsoft Corporation, and Verizon Business, we have committed to an enduring effort that will update and share mappings on a regular cadence, keeping in sync with ATT&CK. Organizations will be able to choose the version of mappings that best meets the needs of their own, unique cybersecurity programs.

Three years of defense in under six weeks

We launched this project on November 1 and have completed our first update: AWS to ATT&CK v16! AWS was originally mapped to ATT&CK v9, over 3 years ago. You’ll find this update, all our existing mappings, and our upcoming releases in the our Mappings Explorer. Since v9 was released, 107 techniques have been added and 480 have been modified (we figured out those numbers using ATT&CK Sync, which shows you all changes in ATT&CK from any version to another).

What’s on the horizon?

We are updating all our existing security capability mappings. You can expect a new mapping release every six weeks. The mappings we have scheduled, and the current version to which they are mapped, are the following:

• AWS (currently mapped to ATT&CK version 9.0) COMPLETED!
• Azure (currently mapped to ATT&CK version 8.2)
• Google Cloud Platform (currently mapped to ATT&CK version 10.0)
• VERIS (currently mapped to ATT&CK versions 12.1, 9.0)
• NIST 800–53 (currently mapped to ATT&CK versions 14.1, 12.1, 10.1, 9.0, 8.2)
• M365 (currently mapped to ATT&CK version 14.1)
• CVE (currently mapped to ATT&CK version 9.0; upcoming mappings to 15.1)

We will also improve the mappings user experience. Mappings Explorer will include new data formats that expand the scope of our mappings. We will bring ATT&CK Sync into the Mappings Editor, providing a one-stop shop for all the mappings work. We are currently researching how Intel vPro processors can be used to enhance software security. This is a new area for our mappings program so we had to rethink our data model and how we present the information in Mappings Explorer.

Along with our Mappings Explorer update, we are updating our Mappings Editor. This freely available tool is what our team uses to perform our mappings. Mappings Editor moves the community from spreadsheets to a polished interface that reduces your time to identify a path from control to technique. Please check out Mappings Editor for your internal use cases, share your successes, and how we can improve it.

Defend Yourself

Through this Center work, each of our mappings will be current with the latest adversary TTPs, ensuring that you can defend against the latest threats. This is a low-cost opportunity to improve your defenses by fully using the features already available to you, so use these resources. We believe that a rising tide lifts all boats and there’s no easier way to raise the tide than to enable native security controls that directly protect, detect, or respond to adversary threats.

We welcome your feedback and contributions to continue to advance our work. You can reach us at ctid@mitre-engenuity.org.

About the Center for Threat-Informed Defense

The Center is a non-profit, privately funded research and development organization operated by MITRE. The Center’s mission is to advance the state of the art and the state of the practice in threat-informed defense globally. Comprised of participant organizations from around the globe with highly sophisticated security teams, the Center builds on MITRE ATT&CK®, an important foundation for threat-informed defense used by security teams and vendors in their enterprise security operations. Because the Center operates for the public good, outputs of its research and development are available publicly and for the benefit of all.

© 2024 MITRE Engenuity, LLC. Approved for Public Release. Document number CT0136

The Best Defense is a Security Capability Mapped to ATT&CK was originally published in Center for Threat-Informed Defense on Medium, where people are continuing the conversation by highlighting and responding to this story.

Written by Suneel Sundar.

⚠️ This post has moved to our new blog and is kept here for archival purposes. https://ctid.mitre.org/blog/2024/11/22/share-the-how-2024-rd-roadmap-update/

In Part One of our 2024 Roadmap Update, we shared that the Center for Threat-Informed Defense shaped our R&D program upon three principles; first was

Good work becomes better work. We observed which prior Center publications are impactful to the community, and we heard from you how our research can provide further solutions. Some of our 2024 projects build upon Summiting the Pyramid, Security Capability Mappings, and Attack Flow.

Our mission is to advance the state of the art and state of the practice in threat-informed defense globally. To make that transition from art to practice for all defenders, our second principle is Share the how.

We made a conscious investment to make new releases more accessible. What once might have been a GitHub directory is now a mobile-friendly browser-based application. And we went one step further by developing resources to train threat-informed defenders how to apply our work. Threat-informed defense enables the collective resources of all defenders to be greater than those of any one adversary. So we develop those resources for the collective in the course of delivering our research.

Share the How

In 2024, we actively participated with the community in the application of threat-informed defense through virtual and in-person training, threat-informed exercises, and bespoke applications of our project resources in specific environments.

This Center initiative began at the Asia-Pacific ATT&CK Community Workshop in April 2024. Prior to the workshop the Center offered training to identify which data sources identify particular adversary techniques and practical instruction in how to refine detection rules based on those data sources. These derive from the Center’s Sensor Mappings to ATT&CK and Summiting the Pyramid project releases.

We learned from our training cohort how these resources would be impactful in their threat scenarios. To continue our learning loop, we offered that training virtually and in-person through 2024. We were so inspired by the engagement with our work that we have developed project training resources for more of your favorite Center projects.

Operational Technology Table Top Exercise

Our Defending Operational Technology (OT) with ATT&CK project was inspired by the observation that adversaries who target OT systems avail themselves of techniques on IT systems. We developed a methodology to model threats to a hybrid IT/OT environment that includes multiple domains and provides a customizable and repeatable framework for analyzing and building threat collections. Furthermore, we developed a reference architecture to visualize the technologies in an IT/OT environment so that defenders can determine the attack surface where a threat actor can generate a cyber effect.

And to demonstrate the threat, we built a custom collection of threats based on a compilation of real-world adversary behaviors associated with the 20 architectural assets outlined in the reference architecture. This process resulted in a comprehensive threat collection comprising 251 techniques and 441 sub-techniques.

With these resources we developed an ATT&CK-based Cyber Tabletop Exercise to discuss a real-world example and understand the best defensive capabilities to counter those threats. We selected the 2022 Ukraine Electric Power attack by Sandworm, because the campaign utilized a mix of techniques from ATT&CK for Enterprise and ICS to infiltrate a Ukrainian electric utility and send unauthorized commands from their SCADA system. Please run this exercise with us by contacting the Center here.

Turn Your Threat Model into a Supermodel with ATT&CK

Threat-informed defense is a team sport, and the Center’s Threat Modeling with ATT&CK project brings the security architects and threat modelers onto the field with security operators and threat intelligence. We observed that there is a lack of guidance on how to best utilize existing tools and data with ATT&CK to improve existing threat modeling methodologies. This project applied the Four Questions Framework and integrates ATT&CK into existing threat modeling methodologies like Attack Trees. Apply this process to identify critical assets, assess threats, measure existing defensive capabilities, and recommend threat and defense informed mitigations.

Organizations of any size or maturity level can use this process to model threats to their own assets using their existing tools and CTI data. Even with this process published and available for all, there remains a need to introduce threat modelers and security operators to this common language. We offer a guided beta test integrating Threat Modeling with ATT&CK into your threat modeling practice.

Teams that are planning to conduct threat modeling exercises should join this beta. Your team will identify the most likely techniques adversaries will use, evaluate these techniques against your existing defensive capabilities, and recommend security investments in areas of residual risk. Your team will apply the step-by-step threat modeling guidance provided on the Threat Modeling with ATT&CK website to a real threat modeling task in your organization. This is an opportunity to integrate ATT&CK into your threat modeling process. Contacting the Center here to participate.

Secure AI Training

Our Secure AI project had a featured role at the Asia-Pacific FIRST conference in 2024, where workshop participants learned how to navigate the ATLAS matrix and case studies and created a new case study and incident report using the new incident page launched through the Secure AI project.

The workshop participants represented 17 organizations from 15 countries and all were familiar with MITRE ATT&CK. For most it was their first hands-on experience with the unique adversarial attacks that have been leveraged against AI systems in real-world incidents and realistic red-teaming demonstrations. Join the AI-incident sharing progrma here.

Threat-Informed Defense is a Continual Process

In March 2024, the Center undertook the ambitious effort to Measure, Maximize, and Mature Threat-Informed Defense (M3TID). M3TID created an actionable definition of threat-informed defense and its associated key activities, and a formalized approach to measure your threat-informed defense. This maturity model complements existing cybersecurity maturity models by incorporating a measure of how well threat information is leveraged. M3TID gives organizations the ability to measure the current state of their defense, to identify and prioritize areas to advance, and a repeatable method to track their progress.

In 2025, the Center will deliver a survey for organizations to calibrate their posture. Completing the survey will generate actionable recommendations as to how to improve. In addition, the Center will debut training for defenders at the March 2025 APAC ATT&CK Community Workshop in Singapore. This training will cover topics in each component area, leading to a holistic advancement of threat-informed defense in your enterprise.

It Takes a Village

Threat-informed defense changes the game on the adversary, and it will always be a team sport. We are grateful for your feedback on the products of our research, on how you use Center resources, and the content of our trainings, workshops, and other engagements. We aim to create widely used, easily accessible, and practical resources through our R&D program. That is only possible with community support and engaged Center Participants. Your feedback is key to evolving our work and maximizing its impact. Your hard problems and ideas inform our R&D program.

Please read the rest of our 2024 R&D Roadmap Update

• Part One Good Work Becomes Better Work and
• Part Three Threat-Informed Defense Applies Broadly

Stay informed — Be the first to know about R&D project releases by signing up for our newsletter and following us on LinkedIn.

Use Center R&D and share your feedback — Using our work to advance threat-informed defense in your organization goes a long way to ultimately changing the game on the adversary. Letting us know how you are using Center R&D allows us to continually refine our work, making it more accessible and impactful.

Join us to advance Threat-Informed Defense — Our Participants are thought leaders with sophisticated security teams that are advanced practitioners of threat-informed defense and users of ATT&CK. With the understanding that the cyber challenges we face are bigger than ourselves, our members join the Center prepared to tackle hard problems in a uniquely collaborative environment. If this sounds like your organization, learn more here about how to become a Center Participant.

About the Center for Threat-Informed Defense

The Center is a non-profit, privately funded research and development organization operated by MITRE Engenuity. The Center’s mission is to advance the state of the art and the state of the practice in threat-informed defense globally. Comprised of participant organizations from around the globe with highly sophisticated security teams, the Center builds on MITRE ATT&CK®, an important foundation for threat-informed defense used by security teams and vendors in their enterprise security operations. Because the Center operates for the public good, outputs of its research and development are available publicly and for the benefit of all.

© 2024 MITRE Engenuity, LLC. Approved for Public Release. Document number CT0132

Share the How was originally published in Center for Threat-Informed Defense on Medium, where people are continuing the conversation by highlighting and responding to this story.

Written by Suneel Sundar.

⚠️ This post has moved to our new blog and is kept here for archival purposes. https://ctid.mitre.org/blog/2024/11/22/good-work-becomes-better-work-2024-rd-roadmap/

“Threat-Informed Defense is the systematic application of a deep understanding of adversary tradecraft and technology to improve defenses.”

It identifies known adversary behavior, relevant to an organization’s threat model, and fosters a community-driven approach to enable an organization to proactively defend, self-assess, and improve defenses against those known threats.

Good work becomes better work

The three dimensions of threat-informed defense are:

1. Cyber Threat Intelligence: knowing the adversary, their objectives, and their tactics, techniques, and procedures (TTPs).

2. Defensive Measures: implement prevention, detection, and mitigation tailored to known threats.

3. Testing & Evaluation: assess defenses by emulating realistic adversary behaviors and TTPs.

We observed which prior Center publications are impactful to the community, and we heard from you how our research can provide further solutions. Some of our 2024 projects build upon Summiting the Pyramid, Security Capability Mappings, and Attack Flow.

Summiting the Pyramid — detection that resists adversary evasion

Many analytics depend on specific tools or artifacts, making them susceptible to low-cost evasion techniques by adversaries. In September 2023, we published the Summiting the Pyramid (STP) methodology that defines and quantifies robustness, or how difficult it is for adversaries to evade certain detections. Practically the project resources include a framework for scoring robustness and a repository of scored analytics, including analytic improvements.

Since that release, we have observed community adoption and application of STP including a “STP score” field in SIGMA analytics, and real-world assessments that evaluate and improve threat detection rule resilience by applying the STP framework at scale.

Motivated by your use of STP, we extended our research into analytic precision and recall with robustness, and network observables. Now STP provides guidance on how to build robust detections, focusing on precision, accuracy, and resistance to adversary evasion. These materials will be available to all in December 2024. In addition to the practical guidance, you will also find visuals to break down technique implementations and identify observables for detections, and frameworks to score both host-based events and network traffic observables.

This is ongoing research, and your examples will drive us to our next solution. Please stay involved with Summiting the Pyramid by:

• Sending additional observables to add to our Model Mapping Pages, both for our host-based and network traffic models
• Providing your worked examples to add to our scored analytics repository

Security Capability Mappings

Over the Center’s five years, the mappings program has grown to represent one-fourth of all Center research with over half our members participating across cloud platforms, security controls, incident sharing, and more. We have united these individuated efforts and our future work into Mappings Explorer.

ATT&CK is updated to a new major version twice per year, and security vendors constantly change their offerings. As a result, the snapshots of capabilities contained in the mappings projects do not reflect current adversary techniques or defensive measures. Now we update all the mapping resources to reflect the most current version of adversary techniques, in perpetuity.

Security capability mappings correlate the defensive measures you have procured to the threats that keep you awake. You will see updated mappings resources released to the community about every six weeks, starting in December 2024 with an update to our AWS mappings from ATT&CK v9 to ATT&CK v16.

We previously created a methodology to map Common Vulnerabilities and Exposures (CVEs) to ATT&CK. Now we focus on CVEs that the Cybersecurity and Infrastructure Security Agency has confirmed as being exploited in the wild: the Known Exploited Vulnerabilities (KEVs) Catalog. The Prioritize Known Exploited Vulnerabilities with ATT&CK project bridges threat management and vulnerability management by connecting CVEs that have been exploited to the impact of exploitation, and will be available to you in February 2025.

We also endeavor to map security capabilities in hardware to adversary behaviors in Security Stack Mappings — Hardware-Enabled Defense. In this project we will extend our mappings methodology to determine how hardware capabilities, in tandem with an operating system, can:

• identify the potential occurrence of a (sub-)technique,
• limit the impact of a (sub-)technique, or
• provide actions to take for detected (sub-)technique.

Such integration is essential for proactive and robust threat-informed defense for enterprise environments. We will include emulation plans to demonstrate the effectiveness of the hardware capability with anti-virus or endpoint detection and response software features. These results will be published in January 2025 and affect billions of enterprise-class systems worldwide.

The Cyber Risk Institute (CRI) built a financial sector profile of the NIST Cyber Security Framework, tailoring the framework to financial sector needs. Our Threat-Informed Defense for the Financial Sector project will map the CRI profile to adversary behaviors giving cyber defenders in financial services organizations resources for threat-informed analysis and decision-making.

In addition to mappings that are tailored to sector specific needs, we will map adversary behaviors to a technology platform. Threats to cloud computing cover multiple security domains, objectives, and aspects of cloud technology. Our Threat-Informed Defense for Cloud research will create a common technical foundation for implementing cloud-native capabilities to mitigate threats to cloud environments.

See Adversary Behaviors in Attack Flow

We built Attack Flow as the data model for representing sequences of adversary behaviors.

To defend against the adversaries’ attacks, we must understand the sequence of behaviors. We have a data model with a web application that allows you to build and visualize those attack flows. But Attack Flow as it stands today has left some users wanting to get started faster, and our Flow Visualization project will remedy that. Flow Visualization will reap the benefits of this powerful data model by providing a new users’ guide to Attack Flow Builder and template visualizations for important use cases. We will also build more flows into our set of examples.

In the next part of this 2024 Center Roadmap update, please read about our second guiding principle: Share the How.

This is Part One of the Center’s 2024 R&D Roadmap Update. Please read
Part Two and Part Three and then…

Join us to advance Threat-Informed Defense — Our Participants are thought leaders with sophisticated security teams that are advanced practitioners of threat-informed defense and users of ATT&CK. With the understanding that the cyber challenges we face are bigger than ourselves, our members join the Center prepared to tackle hard problems in a uniquely collaborative environment. If this sounds like your organization, learn more here about how to become a Center Participant.

About the Center for Threat-Informed Defense

The Center is a non-profit, privately funded research and development organization operated by MITRE Engenuity. The Center’s mission is to advance the state of the art and the state of the practice in threat-informed defense globally. Comprised of participant organizations from around the globe with highly sophisticated security teams, the Center builds on MITRE ATT&CK®, an important foundation for threat-informed defense used by security teams and vendors in their enterprise security operations. Because the Center operates for the public good, outputs of its research and development are available publicly and for the benefit of all.

© 2024 MITRE Engenuity, LLC. Approved for Public Release. Document number CT0132

Good Work Becomes Better Work was originally published in Center for Threat-Informed Defense on Medium, where people are continuing the conversation by highlighting and responding to this story.

Written by Suneel Sundar.

⚠️ This post has moved to our new blog and is kept here for archival purposes. https://ctid.mitre.org/blog/2024/11/22/threat-informed-defense-applies-broadly-2024-rd-roadmap/

This is the third and final part of the Center for Threat-Informed Defense 2024 R&D Roadmap. In Part One and Part Two, we shared the Center’s guiding principles for research in 2024.

1. Good work becomes better work. We observed which prior Center publications are impactful to the community, and we heard from you how our research can provide further solutions. Some of our 2024 projects build upon Summiting the Pyramid, Security Capability Mappings, and Attack Flow.
2. Share the how. We made a conscious investment to make new releases more accessible. What once might have been a GitHub directory is now a mobile-friendly browser-based application. And we went one step further by developing resources to train threat-informed defenders how to apply our work.

Threat-informed defense aligns defensive measures to real-world observations of adversary tradecraft. Where cybersecurity often focused on brittle indicators of compromise that are easy for an adversary to change, threat-informed defense focuses energy on adversary behavior, which is more stable over time and more expensive for adversaries to evade. The result is more efficient use of defenders’ resources and a more robust program of prevention, detection, and response.

The third principle for our 2024 research program is Threat-Informed Defense applies broadly. You will find Center projects that apply threat-informed defense to artificial intelligence enabled systems, to hardware, and a variety of platforms.

Threat-Informed Defense Applies Broadly

Artificial Intelligence meets Threat-Informed Defense

In 2024, the Center and 16 of our member organizations applied the principles of threat-informed defense to AI-enabled systems in our first Secure AI project. This resulted in a significant expansion of the MITRE ATLAS database with case studies that are curated by and relevant to industry partners, as well as the launch of the AI Incident Sharing Initiative.

These successes demonstrated that there is more the Center can and will do in AI security research. In 2025, we will further our AI Focus Area in four ways:

1. Expand the ATLAS Knowledge Base with domain-specific vulnerabilities and mitigations
2. Expedite AI Incident Sharing
3. Verifiable AI Vulnerability Discovery
4. AI Red Teaming and Adversary Emulation

Demystify Ambiguous Techniques

MITRE ATT&CK techniques are not all intrinsically malicious. In fact, threat actors commonly achieve their objectives by living-off-the-land, leveraging native platform capabilities that may be critical business enablers. These ambiguous techniques are difficult to detect as adversary behaviors due to the need to separate benign activity from malicious activity. Our Ambiguous Techniques project will identify core behaviors and observables associated with ambiguous techniques and build robust detections for them. ​​​​​​This research will lower the false positive rate of ambiguous techniques.

Full Stack Threat-Informed Defense

We endeavor to map security capabilities in hardware to adversary behaviors in Security Stack Mappings — Hardware-Enabled Defense. This will require us to extend our mappings methodology. In this project we will determine how hardware capabilities, in tandem with an operating system,

• identify the potential occurrence of a (sub-)technique,
• limit the impact of a (sub-)technique, or
• provide actions to take for detected (sub-)technique.

Such integration is essential for proactive and robust threat-informed defense for enterprise environments. We have included emulation plans for some techniques to demonstrate the effectiveness of the hardware capability with anti-virus or endpoint detection and response software features. These results will be published in January 2025 and affect billions of enterprise-class systems worldwide.

TID Beyond Windows, TID Beyond Humans

Following the development of the Center’s first Linux-based adversary emulation plan OceanLotus, we see the need for Linux defenders to possess the expanded resources and awareness as every other threat-informed defender. Currently, Linux OS native security functions have not matured to log data required to detect adversarial behaviors using ATT&CK-based hunting methodologies. The Center’s Threat-Informed Defense for Linux project will create and validate open-source tooling configurations for Linux compatible with ATT&CK-based hunting methodologies that are suitable for operational environments.​

Cybersecurity analysts encounter novel situations every day and must research, study, and evaluate exponentially more options for defense than attackers. This GenAI for Threat-Informed Defense project will use Generative AI, such as LLMs and chatbots, to provide contextual information for cybersecurity scenarios and automate common tasks in the analyst’s workflow.​ This research will demonstrate that GenAI can deliver actionable advice to cyber analysts at scale, enabling defenders to respond to novel situations while automating repetitive tasks out of the analyst’s queue.

What’s Next?

Our R&D program grows with the needs of defenders — your needs. So you influence our next research project, as you have influenced all that we have released to the community to date. Here are your next steps to make a difference as a threat-informed defender.

Read Part One and Part Two of the Center’s 2024 R&D Roadmap Update.

Stay informed — Be the first to know about R&D project releases by signing up for our newsletter and following us on LinkedIn.

Use Center R&D and share your feedback — Using our work to advance threat-informed defense in your organization goes a long way to ultimately changing the game on the adversary. Letting us know how you are using Center R&D allows us to continually refine our work, making it more accessible and impactful.

Join us to advance Threat-Informed Defense — Our Participants are thought leaders with sophisticated security teams that are advanced practitioners of threat-informed defense and users of ATT&CK. With the understanding that the cyber challenges we face are bigger than ourselves, our members join the Center prepared to tackle hard problems in a uniquely collaborative environment. If this sounds like your organization, learn more here about how to become a Center Participant.

About the Center for Threat-Informed Defense

The Center is a non-profit, privately funded research and development organization operated by MITRE Engenuity. The Center’s mission is to advance the state of the art and the state of the practice in threat-informed defense globally. Comprised of participant organizations from around the globe with highly sophisticated security teams, the Center builds on MITRE ATT&CK®, an important foundation for threat-informed defense used by security teams and vendors in their enterprise security operations. Because the Center operates for the public good, outputs of its research and development are available publicly and for the benefit of all.

© 2024 MITRE Engenuity, LLC. Approved for Public Release. Document number CT0132

Threat-Informed Defense Applies Broadly was originally published in Center for Threat-Informed Defense on Medium, where people are continuing the conversation by highlighting and responding to this story.

⚠️ This post has moved to our new blog and is kept here for archival purposes. https://ctid.mitre.org/blog/2024/09/30/threat-informed-defense-to-secure-ai/

The Secure AI research project is a collaborative effort between MITRE ATLAS™ and the Center for Threat-Informed Defense (Center) designed to facilitate rapid communication of evolving vulnerabilities in the AI security space through effective incident sharing. This research effort will boost community knowledge of threats to Artificial Intelligence-enabled systems. With AI technology and adoption advancing exponentially across critical domains, new threat vectors and vulnerabilities are emerging every day, and they require novel security procedures.

In partnership with AttackIQ, BlueRock, Booz Allen Hamilton, CATO Networks, Citigroup, CrowdStrike, FS-ISAC, Fujitsu, HCA Healthcare, HiddenLayer, Intel Corporation, JPMorgan Chase Bank, Microsoft Corporation, Standard Chartered, and Verizon Business, we deployed a system for improved AI incident capture and added new case studies, techniques, and mitigations to the ATLAS knowledge base. These case studies illustrate novel AI attack procedures that organizations should be aware of and defend against.

Rapid Information Sharing for AI Incidents

Organizations across government, industry, academia, and nonprofit sectors continue to incorporate AI components into their software systems. Commensurately, incidents involving these systems will increasingly occur. Standardized and rapid information sharing about these AI incidents will empower the entire community to improve the collective defense of such systems and prevent external harms. Sharing information about the affected AI artifacts, affected system and users, attacker, and incident detection can be vital to improving those defenses. For this reason, we focused on aligning the capture of information for AI incident expression with existing cybersecurity standards, using a STIX 2.1 bundle as our basis.

This project developed the AI Incident Sharing initiative as a mechanism for a community of trusted contributors to both receive and share protected and anonymized data on real world AI incidents that are occurring across operational AI-enabled systems. Just as MITRE operates CVE for the cyber community or ASIAS for the aviation community, this AI Incident Sharing initiative will serve as the safe space for AI assurance incident sharing at the intersection of the industry, government, and extended community. In capturing and carefully distributing the appropriately sanitized and technically focused AI incident data, this effort aims to enable more data driven risk intelligence and analysis at scale across the community.

The first version of the AI Incident Sharing website launched in September at https://ai-incidents.mitre.org/.

Case Studies About Attacks Against AI-Enabled Systems Expand Community Knowledge

Since AI-enabled systems are susceptible to both traditional cybersecurity vulnerabilities and new attacks that exploit unique characteristics of AI, we knew mapping these new threats would be a crucial aspect of securing organizations against those unique and emergent attack surfaces. For this release, we identified a swath of new case studies based on real-world attacks or realistic red teaming exercises that are designed to inform organizations about the latest threats to AI-enabled systems. We highlight one case study below and the rest are published as part of ATLAS’s most recent update:

• ShadowRay AI Infrastructure Data Leak: In late 2023, the Ray software team addressed multiple newly discovered vulnerabilities, including a lack of Authorization in the Jobs API that was not included in security scans because of an ongoing dispute about whether it was a feature or a vulnerability. As a result, unknown attackers were able to use the vulnerability over the span of 7 months to invoke arbitrary jobs on the remote host with access to Ray production clusters, allowing for the theft of sensitive information and unauthorized access to compute power to mine cryptocurrency. User cost to pay for hijacked machines and compute time was estimated at almost $1 billion.

Through our research on these case studies, we added the following new techniques to the ATLAS matrix:

• Acquire Infrastructure: Domains — Tactic: Resource Development
• Erode Database Integrity — Tactic: Impact
• Discover LLM Hallucinations
• Publish Hallucinated Entities

The Secure AI research participants also collaborated to identify other cutting-edge threats against AI-enabled systems such as:

• Privacy/Membership Inference Attacks: Organizations need to prepare for membership inference attacks. Booz Allen Hamilton gathered resources that illustrate the existing Exfiltration via ML Inference APIL: Infer Training Data Membership technique. These resources highlight the way that adversaries can infer the membership of a data sample within a model’s training set, raising privacy concerns and risking the leak of private information or intellectual property. Another example involved researchers recovering over 10,000 examples of training data from ChatGPT for only $200 in query cost. The membership inference attack was then used to distinguish which examples were hallucinated and which came from ground truth memorized examples, exfiltrating data that contained personally identifiable information.
• LLM Behavior Modification: Standard Chartered helped identify the potential for attackers to modify the behavior of large language models (LLMs) whose model weights are accessible and modifiable by attackers. Malicious threat actors can then use known techniques to effectively “kill switch” current alignment methods and gain access to powerful models that are now unaligned. Potential uses for this type of unaligned model include assistance with cyber attacks, biological or chemical weapon production, and human sentiment manipulation.
• LLM Jailbreaking: Verizon showcased an attacker who repeatedly posts demonstrations of jailbreaking the latest Generative AI models including text and image generators. The X user — Pliny the Prompter — has also released a repository of jailbreaking methods that can be used on frontier models on GitHub and further illustrate the LLM Jailbreak technique.
• Tensor Steganography: Borrowing on the concept of steganography from cybersecurity, tensor steganography allows an attacker to hide either data or malware within a model. In a recent example, researchers at HiddenLayer hid malware that executed quantum ransomware automatically within ResNet18, an open-source image recognition model.

Relevant Mitigations

Identifying novel vulnerabilities and attack methods is an important first step in improving the security of our AI-enabled systems. However, the increased adoption of AI within existing systems means that the mitigation of those vulnerabilities is critical to organizational success across the AI lifecycle. That’s why the ATLAS knowledge base also includes mitigations as a list of security concepts and classes of technologies that can be used to prevent a (sub)technique from being successfully executed against an AI-enabled system. In addition to the identification of new case studies and attack techniques, we also collaborated on the identification of new mitigations that can help minimize or prevent harms within AI-enabled systems. These included:

• Generative AI Model Alignment: Utilizing techniques to improve model alignment with safety, security, and content policies can be done when training or fine-tuning a model. This can include using techniques like Supervised Fine-Tuning, Reinforcement Learning from Human or AI Feedback, and Targeted Safety Context Distillation to improve the safety and alignment of the model.
• Guardrails for Generative AI: Based on ongoing efforts by organizations such as NIST and FS-ISAC, guardrails refer to measures within a GenAI model’s structure that limit the model’s output. These guardrails allow the model to adhere to model objectives, content guidelines, and model safety and security. By defining out-of-bounds and unacceptable behaviors and outputs and using real-time output monitoring, organizations can use these guardrails to ensure that generated outputs stay within scope and fulfill the intended purpose.
• Guidelines for Generative AI: Guidelines are safety controls placed between user-provided input and a generative AI model to direct the model to produce desired outputs and prevent undesired outputs.
• AI Bill of Materials: Generating an AI bill of materials (AI BOM) containing information about the raw AI model, sub-AI systems, and greater AI-enabled system components, and delivering it to an end-user will allow for improved detection of vulnerable AI artifacts used to create the target ML model such as pre-trained models and datasets.
• AI Telemetry Logging: Intel emphasized the importance of this mitigation approach that relies on logging to help collect events related to access of AI models and artifacts, including inference API invocation. Monitoring logs can also help to detect security threats and prevent impact.

ATLAS and ATT&CK Integration

As the ground truth of adversarial TTPs for traditional cybersecurity, MITRE ATT&CK® is already widely adopted within the security community. ATLAS is modeled after and complementary to ATT&CK in order to raise the awareness of rapidly evolving vulnerabilities of AI-enabled systems as they extend beyond cyber. To continue facilitating the improved understanding of these vulnerabilities and how they relate to and differ from TTPs seen within ATT&CK, we have synchronized updates between the two knowledge bases. When ATT&CK releases a new version, ATLAS will update in kind.

The ATLAS STIX data has now been updated to include ATT&CK Enterprise v15.1 and the ATLAS matrix has now been expressed as a STIX 2.1 bundle following the ATT&CK data model. That ATLAS STIX 2.1 data has now been combined with the ATT&CK Enterprise data and can be used as domain data within the ATLAS Navigator.

Get Involved

Our collective research has provided actionable documentation of novel threat vectors for AI-enabled systems, steps for mitigating those novel threats, and improved incident capture for AI incidents. But we’re not done. AI security needs evolve as new AI applications are adopted. We welcome community feedback and additional suggestions for other real-world attacks that can be included in future work as we advance community awareness of threats to AI-enabled systems. There are several ways you can get involved with this and other projects to continue advancing AI security and threat-informed defense:

• Test out the new AI incident sharing form and report ongoing threats your organization has witnessed.
• Review the new case studies, adversarial techniques, and mitigations, then tell us what you think.
• Share your additional case studies, tools, or resources that can help our community understand and make threat-informed decisions for AI-enabled systems.

Contact us at ctid@mitre-engenuity.org for any questions about this and future AI security work.

About the Center for Threat-Informed Defense

The Center is a non-profit, privately funded research and development organization operated by MITRE Engenuity. The Center’s mission is to advance the state of the art and the state of the practice in threat-informed defense globally. Comprised of participant organizations from around the globe with highly sophisticated security teams, the Center builds on MITRE ATT&CK®, an important foundation for threat-informed defense used by security teams and vendors in their enterprise security operations. Because the Center operates for the public good, outputs of its research and development are available publicly and for the benefit of all.

About ATLAS

MITRE Adversarial Threat Landscape for AI Systems (ATLAS™) is a globally accessible, living knowledge base of adversary tactics and techniques based on real-world attack observations and realistic demonstrations from artificial intelligence (AI) red teams and security groups. There are a growing number of vulnerabilities in AI-enabled systems as the incorporation of AI increases the attack surfaces of existing systems beyond those of traditional cyberattacks. We developed ATLAS to raise community awareness and readiness for these unique threats, vulnerabilities, and risks in the broader AI assurance landscape. ATLAS is modeled after the MITRE ATT&CK® framework and its tactics, techniques, and procedures (TTPs) are complementary to those in ATT&CK.

© 2024 MITRE Engenuity, LLC. Approved for Public Release. Document number CT0123

Threat-Informed Defense to Secure AI was originally published in Center for Threat-Informed Defense on Medium, where people are continuing the conversation by highlighting and responding to this story.

⚠️ This post has moved to our new blog and is kept here for archival purposes. https://ctid.mitre.org/blog/2024/09/09/know-your-adversarys-next-move-with-tie/

Describing adversarial behaviors in the form of tactics, techniques, and procedures (TTPs) using MITRE ATT&CK® revolutionized detection and response. Focusing on TTPs creates an opportunity for high-fidelity detection of adversaries. If we can detect a behavior, the adversary will need to change behaviors — increasing cost and risk for the adversary.

Detecting adversary behaviors is challenging. There are often many approaches to implementing a single behavior and adversaries commonly use native capabilities (living off the land), making it difficult to differentiate adversary activity from normal user activity.

Adversary TTPs occur in sequences. Understanding these sequences creates an opportunity to improve detection. If we know that Phishing is followed by Process Injection and then Hijack Execution Flow, we can begin looking for this pattern of TTPs. This sounds good in theory, but how does a defender know which behaviors are likely to have occurred together?

The Technique Inference Engine (TIE) uses a machine learning model trained on cyber threat intelligence to recommend likely TTPs based on a known input TTP. TIE will help analysts quickly understand what is likely to have happened next based on a broad corpus of threat intelligence. In collaboration with experts from Citigroup, Cyber Threat Alliance, Fortinet, Google Cloud, HCA Healthcare, IBM Security, Lloyds Banking Group, Tenable, and Verizon Business, we have built TIE to be a practical resource with immediate benefit for all security teams and designed it to easily enable further research and innovation.

The right dataset is critical for prediction

Having the right dataset is critical to the predictive nature of the model. We identified four key attributes of our dataset to assure our model delivers relevant results.

• The data is based on real-world observations of adversary activity.
• The data represents sets of techniques that have occurred as part of the same activity.
• The data contains multiple implementations covered by each technique. The model has sufficiently many TTP examples to discover trends in activity and avoid bias towards predicting the most common or popular techniques.
• We exclude contrived or speculative data. For our purposes, we did not augment the data set with artificial data to prevent introducing non-existent associations between techniques.

Cyber threat intelligence (CTI) reports meet all the above criteria as they are crafted through expert analysis of cyber intrusions and observed adversary activity. By combining data used in previous Center research projects, CTI repositories, and contributions from our research partners we generated over 6,200 reports, covering 96% of the techniques in ATT&CK.

A common challenge among machine learning and threat-informed defense research is obtaining sufficient data to develop effective models. To support future research, we published our training data, which includes attributes such as campaigns, CTI references, and technique frequency to encourage researchers to build new models and discover novel associations.

The Model

Our recommender model uses a simple and powerful method to characterize each technique in the training data. This approach delivers technique predictions in a fraction of a second and is written in a way that is easily interpreted by security teams and machine learning experts alike. Advanced users can launch our code in a Jupyter notebook to adjust model parameters, retrain the model with a custom data set, and more.

Technique Inference Engine

Context is crucial in information fusion. Security teams require more than just a list of techniques to respond to incidents, emulate the adversary, or derive actionable threat intelligence. To make our predictions accessible to the broadest possible audience, we integrated TIE directly into your browser.

The web tool is the most accessible way to get a complete picture of the adversary. TIE uses on-device machine learning to predict related techniques — no information is sent over the network or stored. The predicted techniques can be organized by technique name, rank, or tactic. Filter results based on inference score, threat actor, campaign, or platform. Use TIE to visualize results through ATT&CK navigator to add emphasis via a heatmap or compare to other reports in a common format.

We’re delighted to provide the community with a tool that gives defenders a way to identify what you don’t detect. Our documentation walks through each step of our research and has examples of how TIE augments new lead generation for SOC teams, improves post-mortem incident analysis by filling in potential reporting gaps, and can create more comprehensive adversary emulation plans.

Community involvement makes us better!

Building solutions that improve threat-informed defense is a community effort. Here are a few ways to stay involved:

• Use our inference engine and share your feedback. Github issues are the best way to send questions, bug reports, and feature requests.
• Retrain the model for better results. When you share new training data with us, our automation retrains the model and publishes an updated version of the site.
• If you create a model that bests our Technique Inference Engine — we’d love to hear about it!

Email us at ctid@mitre-engenuity.org for more general inquiries

About the Center for Threat-Informed Defense

The Center is a non-profit, privately funded research and development organization operated by MITRE Engenuity. The Center’s mission is to advance the state of the art and the state of the practice in threat-informed defense globally. Comprised of participant organizations from around the globe with highly sophisticated security teams, the Center builds on MITRE ATT&CK®, an important foundation for threat-informed defense used by security teams and vendors in their enterprise security operations. Because the Center operates for the public good, outputs of its research and development are available publicly and for the benefit of all.

© 2024 MITRE Engenuity. Approved for Public Release. Document number CT0124.

Know your Adversary’s next move with TIE was originally published in Center for Threat-Informed Defense on Medium, where people are continuing the conversation by highlighting and responding to this story.

Introduction: Round 2 of ATT&CK Evaluations Managed Services

Round 2 of ATT&CK Evaluations: Managed Services has concluded, where 11 participants underwent rigorous testing. In the ever-evolving realm of cybersecurity, threat actors like menuPass and ALPHV BlackCat continue to pose significant challenges to organizations worldwide. These adversaries are known for their sophisticated tactics, including the use of Defense Evasion and specifically — fileless malware, which presents a formidable challenge for defenders. In this blog post, we’ll delve into one such technique employed by these threat groups: Reflective Code Loading (T1620). We’ll explore how adversaries leverage this technique to conceal their malicious activities, examine real-world examples, discuss detection strategies, and provide remediation techniques to bolster your organization’s defenses.

Evolution is the name of the game in our field. Just as species adapt to their environment, technology evolves to meet new challenges. As threat hunters, we’re constantly exploring uncharted territories, evolving our capabilities to keep pace. Round 2 was all about adaption, reflecting the demands of an ever-changing landscape.

Understanding Fileless Malware

Defense evasion is a sophisticated tactic employed by cyber adversaries to bypass security measures and evade detection while carrying out malicious activities. When it comes to fileless malware, which operates entirely in memory without leaving traces on the disk, defense evasion becomes even more challenging to detect.

Traditionally, malware operates by infecting files on a system, executing code when those files are opened or executed. However, fileless malware takes a different approach. Instead of relying on malicious files, fileless malware operates in memory, using legitimate system processes and tools to carry out its nefarious activities. This makes it incredibly stealthy and difficult to detect using traditional security products.

Reflective Code Loading

Let’s look at some of those examples and follow the trail through Reflective code loading. You can find Reflective Code Loading techniques executed across multiple platforms such as Linux, Mac OSX, and Windows. Round 2 showcased eight Windows specific Reflective code loading techniques from both Defense Evasion (TA0005) and Execution (TA0002) tactics. Although not a new technique and one that is widely used today, participants often misclassified the activity or did not report on it at all.

Adversaries rely on the ability to execute a payload while avoiding touching the file system altogether and reflective code loading gives them that advantage. Instead of executing payloads by creating a thread or process backed by a file path on disk, reflective code loading allocates the executing payload directly in memory. This allows adversaries to hide the execution of their payloads. The dominance of memory execution increases their flexibility, stealth, and ability to deter basic defenses.

Facing the Threat: menuPass

menuPass, also known as APT10, is a state-sponsored advanced persistent threat (APT) group linked to espionage activities. They target a wide range of industries, particularly focusing on organizations in the healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally. menuPass is known for their use of complex malware and techniques, including initial access via harvested credentials for sensitive information and intellectual property. For Managed Services, menuPass used a suite of malware including Sigloader, P8RAT, FYAnti, Impacket, and QuasarRat.

An Example from menuPass

menuPass diversified their performance providing us with these examples which gave us insight on how participants handled their fileless maneuvers. For example, SigLoader is a multi-layer loader that loads and decrypts the target payload. Eventually, SigLoader will load the first payload, FYAnti, in memory. FYAnti decrypts the first embedded .NET module and reflectively loads executing the module using the CppHostCLR technique to avoid dropping additional files to disk. The malware makes use of CppHostCLR due its ability to inject and execute the .NET loader assembly without extraction to disk. The clr.dll is loaded into memory of the host followed by the .NET code loaded into the C++ process space.

Detecting and Defending Against Fileless Malware

Detecting fileless malware and adversary techniques requires a multi-faceted approach. Relying on traditional host logs such as Windows event logs and Sysmon solely will not reveal enough fidelity to create a solid assurance that this activity is taking place in your environment. Traditional signature-based antivirus solutions may struggle to identify these threats as well, highlighting tools such as those that monitor module loads can be used as a means of detecting processes loading the Common Language Runtime (CLR).

In our menuPass scenario, we often detect reflective code loading on Windows by examining signatures associated with the .NET CLR, such as mscor.dll, mscoree.dll, and clr.dll. These DLLs can be loaded into unconventional processes like notepad.exe, a behavior frequently observed in menuPass operations. While adversaries may refine their techniques over time, certain indicators remain consistent for in-memory .NET execution. These include the presence of CLR-related modules within a process, specific page permissions (such as Read Execute or Read Write), and Portable Executable (PE) headers within these pages. Defenders can enhance detection efforts by monitoring for code artifacts indicative of reflective code loading, such as the misuse of .NET functions like Assembly.Load() and Native API functions like CreateThread().

To detect reflective code loading and other fileless malware techniques, security teams can leverage:

Memory Analysis

Monitor processes for abnormal behavior, such as unexpected memory allocations or executions.

• Use memory analysis tools (e.g., Volatility, Rekall) to examine memory dumps from potentially compromised systems.
• Look for suspicious memory allocations that indicate the loading of executable code into memory without using traditional file-based execution.
• Specifically, focus on memory regions marked as executable (RWX) but not associated with known legitimate processes or system components. These regions could indicate memory-based execution of malicious code.
• Pay attention to memory regions that are unusually large or have unexpected permissions, as they may be indicative of reflective code loading.

API Execution

Tracking system API calls associated with reflective code loading, such as VirtualAlloc and WriteProcessMemory

• Analyze memory dump data to identify API calls commonly associated with reflective code loading, such as VirtualAlloc, VirtualProtect, and CreateRemoteThread.
• Look for patterns of API calls that suggest the injection of malicious code into legitimate processes or the modification of memory permissions to enable code execution.
• Check for anomalies in the sequence or frequency of API calls, as well as unusual parameters passed to these functions, which may indicate malicious activity.

Behavioral Analytics

Look for anomalies in process behavior, such as processes spawning child processes without legitimate reasons.

• Conduct behavioral analysis of processes to identify suspicious behavior, such as processes spawning child processes with unexpected characteristics or exhibiting code injection techniques.
• Look for processes that exhibit characteristics commonly associated with reflective code loading, such as loading libraries or executing code directly from memory.
• Monitor for processes exhibiting code execution behavior without the creation of corresponding file-based artifacts, which could indicate memory-based execution techniques.

Test for Reflective Code Loading in your Environment

To understand how different adversaries live off the land with this technique, we recommend monitoring for this activity with in your environment or virtual lab. Atomic Red Team, Caldera, and the ATT&CK Evaluations Library is a great place to start. You can also reflectively load a tool into memory using Mimikatz and other common red team tools and frameworks. Those of you familiar with Cobalt Strike’s execute-assembly take advantage of this post-exploitation capability of loading .NET assemblies in memory via unmanaged code without dropping files to disk. Execute-assembly runs .NET executable within memory of sacrificial process by loading the CLR. This technique allows red teamers to get away with all types of actions.

Understanding the variety of ways reflective code loading takes place in your own environment, allows you to not only understand possible capability gaps but gain newfound knowledge and gives you competence to initiate those conversations with the security product’s team. Here are a few examples to help you begin those discussions.

Example questions to pose conversations to your vendors:

• Are you able to detect Reflective Code Loading (T1620) in your environment? What is your logic for detection or how does your tool detect the activity?
• What were your thoughts of participating in MITRE ATT&CK Evals MSR2?
• Do you have any feedback for developers to enhance your product’s analytics or logic?
• Where did you feel you did well?
• What could you have done better?
• Can we execute some of these attacks in a virtual environment and see how your tool performs?
• Based on the results of MSR2, do you have a plan to make any changes to advance your tool?

Conclusion: Lessons Learned and the Path Forward

Understanding fileless malware and adversary techniques is crucial for modern cybersecurity defense. Organizations must stay vigilant and adapt their defenses as cyber threats continue to evolve. By understanding the techniques employed by threat actors like menuPass, and implementing robust detection strategies, organizations can enhance their security posture and effectively mitigate the risk of fileless malware attacks. Remember, proactive defense is key to staying one step ahead of cyber adversaries.

About MITRE Engenuity ATT&CK® Evaluations

ATT&CK® Evaluations is built on the backbone of MITRE’s objective insight and conflict-free perspective. Cybersecurity vendors turn to the ATT&CK Evals program to improve their offerings and to provide defenders with insights into their product’s capabilities and performance. ATT&CK Evals enables defenders to make better informed decisions on how to leverage the products that secure their networks. The program follows a rigorous, transparent methodology, using a collaborative, threat-informed, purple-teaming approach that brings together vendors and MITRE experts to evaluate solutions within the context of ATT&CK. In line with MITRE Engenuity’s commitment to serve the public good, ATT&CK Evals results and threat emulation plans are freely accessible. https://attackevals.mitre-engenuity.org/

© 2024 MITRE Engenuity, LLC. Approved for Public Release. Document number 23–03986–2.

Exploring the Frontier: Insights from ATT&CK Evaluations Managed Services Round 2 was originally published in Center for Threat-Informed Defense on Medium, where people are continuing the conversation by highlighting and responding to this story.

⚠️ This post has moved to our new blog and is kept here for archival purposes. https://ctid.mitre.org/blog/2024/08/14/guarding-the-grid-defending-operational-technology-with-attack/

Critical infrastructure such as electrical generation facilities, water treatment plants, and transportation systems are a lifeline for our communities. Unfortunately, this dependence has made critical infrastructure a prime target for threat actors. Furthermore, these systems often lack security measures we see in enterprise networks, making them easier to attack. By identifying the threat landscape and communicating adversary behaviors affecting information technology (IT) and operational technology (OT) systems, organizations can evaluate and employ security controls for real-world adversary behaviors targeting those environments.

In collaboration with AttackIQ, Booz Allen Hamilton, Ensign InfoSecurity, Global Cyber Alliance and Siemens, the Center for Threat-Informed Defense created Defending OT with ATT&CK to identify and defend against adversarial techniques that impact operations on critical infrastructure. We created three resources to identify assets and technologies in complex IT/OT environments and present an approach to comprehensively identify adversarial behaviors targeting those systems.

• A threat model methodology
• A reference architecture
• A threat collection of unique adversary behaviors

This information is essential to implement defensive measures against the techniques that adversaries use against critical infrastructure.

Threat Model Methodology

To ensure a thorough analysis and documentation of potential adversarial techniques, this research project developed a methodology to model threats to a hybrid IT/OT environment that includes multiple domains and provides a customizable and repeatable framework for analyzing and building threat collections. The methodology expands the Center’s Defending IaaS with ATT&CK approach by presenting a comprehensive view of adversary behavior that could impact overall operations within a hybrid IT/OT environment.

For Defending OT with ATT&CK, we applied this methodology to identify the assets that constitute the attack surface of a hybrid IT/OT environment. From these assets we developed the reference architecture. We then established selection criteria to assess the threats posed by each one of these technologies based on relevant factors, such as operating system risks or industrial control system (ICS) processes affected.

Step 1. Identify Attack Surface

Identify security boundaries and understand the technologies that form their architecture.

Step 2. Compile Sources

Generate a comprehensive picture of adversarial risks; it is necessary to include CTI sources for the listed assets.

Step 3. Define Selection Criteria

Identify which adversarial risks apply to your scenario and asset and omit irrelevant sources.

Step 4. Select Techniques

Review and evaluate adversarial techniques for each asset to curate the final collection.

Step 5. Build Collection

Assemble the techniques into a custom threat collection to share throughout your organization.

Reference Architecture

To determine the attack surface where a threat actor can generate a cyber effect, we developed a reference architecture that aligns with the Purdue Model to visualize the technologies within a IT/OT environment. In defining architectural assets, we considered several factors to ensure comprehensive coverage of risks.

• Evaluate the boundaries between IT and OT systems
• Identifying relevant attack vectors
• Understand the adversary’s goals when targeting assets that could disrupt or impact operations.

This reference architecture provides a common, reusable view of assets and technologies used in IT/OT environments where a threat actor can impact operations. It serves as a framework for depicting assets through functional components across the technology stack of an OT environment in hierarchical levels. All assets depicted in the architecture were mapped to ATT&CK for Enterprise’s platforms or ATT&CK for ICS’ assets, with nine hybrid assets overlapping techniques from multiple domains of ATT&CK. The architecture aids in evaluating security boundaries between different operational zones and assessing plausible attack vectors between IT and OT assets.

Multi-Domain Threat Collection

The Defending OT with ATT&CK threat collection is a set of ATT&CK techniques tailored to the attack surface and threat model for OT environments. To identify and define this multi-domain collection, we analyzed adversarial tactics, techniques, and procedures (TTPs) as contained in ATT&CK for Enterprise, ATT&CK for ICS, and other relevant ATT&CK datasets such as Cloud and Containers. The threat collection is designed to evaluate, plan, and employ mitigating security controls for adversarial techniques within an IT/OT architecture.

We utilized the Center’s ATT&CK Workbench to build a custom collection of threats based on a compilation of real-world adversary behaviors documented in ATT&CK v15. ATT&CK Workbench provides the flexibility and customization needed to identify specific adversarial risks associated with the 20 architectural assets outlined in the reference architecture. This process resulted in a comprehensive threat collection comprising 251 techniques and 441 sub-techniques. ATT&CK Workbench streamlined the analysis of threats and facilitated the communication of various risks for each asset. Additionally, we created a custom threat collection that can be exported and shared as a STIX bundle.

Recommended Use Cases

Organizations looking to tailor research for specific needs can view the collection of techniques using the latest version of ATT&CK Workbench. These resources offer a template for organizations looking to extend our approach for their intended use cases, including:

• Threat Intelligence Mapping: Leverage real-world threats to understand how adversarial behaviors might impact assets across an environment.
• Red Teaming and Penetration Testing: Conduct strategic adversarial simulation and scenarios to comprehensively evaluate real-world risk across the attack surface.
• Security Architecture and Operations: Develop capabilities for effective threat hunting, response to malicious activity, and eradicating threats within an IT/OT ecosystem.
• Collaborative Cyber Tabletop Exercises: Assess adversarial risks and compare them with the organization’s existing security technologies.

Get Involved

There are several ways that you can get involved with this project and help advance threat-informed defense. Please review the project resources, use them, and tell us what you think.

We welcome your contributions to help advance Defending OT with ATT&CK in the form of pull requests; please review the contributor notice before making a pull request.

For any technical questions or requests, please submit issues on GitHub . You may also contact ctid@mitre-engenuity.org directly for more general inquiries about the Center for Threat-Informed Defense.

About the Center for Threat-Informed Defense

The Center is a non-profit, privately funded research and development organization operated by MITRE Engenuity. The Center’s mission is to advance the state of the art and the state of the practice in threat-informed defense globally. Comprised of participant organizations from around the globe with highly sophisticated security teams, the Center builds on MITRE ATT&CK®, an important foundation for threat-informed defense used by security teams and vendors in their enterprise security operations. Because the Center operates for the public good, outputs of its research and development are available publicly and for the benefit of all.

© 2024 MITRE Engenuity. Approved for Public Release. Document number CT0121.

Guarding the Grid: Defending Operational Technology with ATT&CK was originally published in Center for Threat-Informed Defense on Medium, where people are continuing the conversation by highlighting and responding to this story.