diff --git a/attack-theme/templates/general/attackcon-overview.html b/attack-theme/templates/general/attackcon-overview.html
index 39bb0d5dd2c..a244fc1915c 100644
--- a/attack-theme/templates/general/attackcon-overview.html
+++ b/attack-theme/templates/general/attackcon-overview.html
@@ -13,13 +13,20 @@
-{{ con.title }} Presentations and Sponsors
+ {% else %} +{{ con.title }} Presentations
+ {% endif %} + {% set ifSponsor = "sponsors_img_list" in con %} {% if "banner_img" in con %}@@ -119,12 +126,7 @@
{% endfor %}Sponsors
-Sponsors
Sponsors
Related Projects
-
- ATT&CK GitHub Organization
-The MITRE ATT&CK GitHub organization was created to hold current and future ATT&CK-related content, including this website!
-CALDERA
-Caldera is the world’s leading open-source, scalable adversary emulation platform. With the ATT&CK knowledge base as its backbone, Caldera empowers cyber practitioners to save time, money, and energy through automated adversary emulation operations, security assessments, and red-teaming.
-
- ATT&CK Navigator GitHub Repository
-The ATT&CK Navigator is designed to provide basic navigation and annotation of ATT&CK matrices.
-CASCADE
-CASCADE is a research project at MITRE which seeks to automate much of the investigative work a “blue-team” team would perform to determine the scope and maliciousness of suspicious behavior on a network using host data.
-
- ATT&CK Expressed in STIX
-Structured Threat Information Expression (STIX™) is a language and serialization format used to exchange cyber threat intelligence (CTI).
-CAR
-The Cyber Analytics Repository (CAR) is a knowledge base of analytics developed by MITRE based on the ATT&CK® adversary model.
-Related Standardization Efforts
-
- CAPEC
-- Common Attack Pattern Enumeration and Classification (CAPEC™) is an effort to provide a publicly available catalog of common attack patterns classified in an intuitive manner, along with a comprehensive schema for describing related attacks and sharing information about those attacks. Understanding adversary behavior is increasingly important in cybersecurity. Two approaches exist for organizing knowledge about adversary behavior – CAPEC and ATT&CK, each focused on a specific set of use-cases. Please visit the CAPEC and ATT&CK Comparison page that explains the similarities, differences, and relationship between CAPEC and ATT&CK and the role of each in cybersecurity. -
-- The ATT&CK and CAPEC efforts are collaborating to map related details between ATT&CK techniques and CAPEC attack patterns. CAPEC has incorporated an initial mapping of ATT&CK techniques in version 2.8 and related ATT&CK techniques have CAPEC ID references. -
-
-
- MAEC
-- Malware Attribute Enumeration and Characterization (MAEC™) is a collaborative community-driven effort to define and develop a standardized language for sharing structured information about malware based upon attributes such as behaviors, artifacts, and attack patterns. The characterization of malware using abstract patterns offers a wide range of benefits over the usage of physical signatures. It allows for the accurate encoding of how malware operates and the specific actions that it performs. Such information can not only be used for malware detection but also for assessing the end-goal the malware is pursuing and the corresponding threat that it represents. Focusing on the attributes and behaviors of malware facilitates detection and analysis of emerging, sophisticated malware threats that circumvent the traditional signature-based and heuristic approaches. Characterizing malware in a standard way supports collaboration across organizations and the identification of common behavior, functionality, and code bases across instances of malware. -
-- There exists alignment and overlap between some of the post-access techniques covered by ATT&CK and the capability and behavior abstractions that are part of MAEC’s standardized characterization of malware behavior. While ATT&CK takes a general approach, remaining agnostic to specific tools adversaries may use, there is still value in relating back to standardized methods of describing certain attributes of malware wherever applicable. -
-Papers
-Philosophy Papers: These whitepapers provide an in-depth look at why we created these ATT&CK domains, how we maintain and update them, and what the community commonly uses them for.
--
-
- - - -
-
-
- ATT&CK for ICS extension (pdf): - This document does not represent a comprehensive resource on MITRE ATT&CK. - For individuals already familiar with ATT&CK, this document can be viewed as an extension to the - ATT&CK Design and Philosophy whitepaper above that highlights unique, as well as some common, aspects of the design and philosophy of ATT&CK for ICS. -
-
-
Finding Cyber Threats with ATT&CK-Based Analytics: This paper presents a methodology for using ATT&CK to build, test, and refine behavioral-based analytic detection capabilities using adversary emulation.
-Presentations
--
- {% for presentation in parsed.presentations %}
-
-
- - - - --- {{ presentation.date }} -- -- {{ presentation.description }} ++-+- -+- - {% endfor %} - -
Get Started
++++ Jump to Section ++-
+
- + What is ATT&CK? + +
- + How can I use ATT&CK? + +
- + How should I not use ATT&CK? + +
- + Next Steps + +
+ +++What is ATT&CK?
++ ATT&CK is knowledge base of adversarial techniques based on real-world observations. ATT&CK focuses on how adversaries interact with systems during an operation, reflecting the various phases of an adversary’s attack lifecycle and the platforms they are known to target. +
++ Read the ATT&CK 101 Blog post for more information on the basics of ATT&CK and check the short video below. +
++ ++
+Key Concepts
+++ For more information on the principles behind ATT&CK, its creation, and its ongoing maintenance, read the ATT&CK Philosophy Paper. For additional information focused on ATT&CK for ICS, including the unique elements and commonalities with ATT&CK, read the ATT&CK for ICS Extension. ++ ATT&CK is a model that attempts to systematically categorize adversary behavior. The main components of the model are: ++-
+
- + Tactics, represents “why” or the reason an adversary is performing an action + +
- + Techniques, represents “how” adversaries achieve tactical goals by performing an action + +
- + Sub-techniques, a more specific or lower-level description of adversarial behavior + +
- + Procedures, specific implementation or in-the-wild use the adversary uses for techniques or sub-techniques + +
+ ATT&CK is organized in a series of technology domains, the ecosystem an adversary operates within. Currently, there are three technology domains: ++-
+
- + Enterprise, representing traditional enterprise networks and cloud technologies + +
- + Mobile for mobile communication devices + +
- + ICS for industrial control systems + +
++ ++++How can I use ATT&CK?
+ The following four use cases are the most common way that users report applying ATT&CK to their work. + ++ {{contact_card.render("Detections and Analytics", "", "+ATT&CK can help cyber defenders develop analytics that detect the techniques used by an adversary. +
", + fa_icon=None, invert_icon=True, buttons=None, header_background=True,footer_description="View more resources about Detections and Analytics")}} + {{contact_card.render("Threat Intelligence ", "", "
Getting Started with ATT&CK: Detection and Analytics Blog Post
+ This blog post describes how you can get started using ATT&CK for detection and analytics at three different levels of sophistication. (June 2019) +
Finding Cyber Threats with ATT&CK-Based Analytics
+ Presents a methodology for using ATT&CK to build, test, and refine behavioral-based analytic detection capabilities. (June 2017) +
ATT&CKing the Status Quo Presentation
+ The latter part of this presentation provides an introduction to using ATT&CK to create analytics. Slides are also available. (August 2018)ATT&CK gives analysts a common language to structure, compare, and analyze threat intelligence. +
", + fa_icon=None, invert_icon=True, buttons=None, header_background=True,footer_description="View more resources about Threat Intelligence")}} +
Getting Started with ATT&CK: Threat Intelligence Blog Post
+ This blog post describes how you can get started using ATT&CK for detection and analytics at three different levels of sophistication. (June 2019) +
ATT&CKing Your Adversaries Presentation
+ This presentation covers how to use ATT&CK to take cyber threat intelligence and operationalize it into behaviors that can drive relevant detections. (August 2019) +
Blog posts on threat intelligence
+ These blog posts explain the fundamentals of how to use ATT&CK for threat intelligence. (September 2018)
++ {{contact_card.render("Adversary Emulation and Red Teaming", "", "+ATT&CK provides a common language and framework that red teams can use to emulate specific threats and plan their operations. +
", + fa_icon=None, invert_icon=True, buttons=None, header_background=True,footer_description="View more resources about Adversary Emulation and Red Teaming")}} + {{contact_card.render("Assessment and Engineering", "", "
Getting Started with ATT&CK: Adversary Emulation and Red Teaming Blog Post
+ This blog post describes how you can get started using ATT&CK for adversary emulation and red teaming at three different levels of sophistication. (July 2019) +
Do-It-Yourself ATT&CK Evaluations to Improve Your Security Posture Presentation
+ This presentation explains how defenders can improve their security posture through the use of adversary emulation by performing their very own ATT&CK Evaluations. (June 2019) +
APT ATT&CK - Threat-based Purple Teaming with ATT&CK Continued Presentation
+ This presentation covers how to use ATT&CK to take cyber threat intelligence and operationalize it into behaviors that can drive relevant detections. (May 2019)ATT&CK can be used to assess your organization’s capabilities and drive engineering decisions like what tools or logging you should implement. +
", + fa_icon=None, invert_icon=True, buttons=None, header_background=True,footer_description="View more resources about Assessment and Engineering")}} +
Getting Started with ATT&CK: Assessments and Engineering Blog Post
+ This blog post describes how you can get started using ATT&CK for assessments and engineering at three different levels of sophistication. (August 2019) +
Lessons Learned Applying ATT&CK-Based SOC Assessments
+ This keynote presentation discusses a process to gauge a SOC’s detective capabilities as they relate to ATT&CK, including MITRE’s practical experiences and lessons learned. (June 2019) +
Finding Cyber Threats with ATT&CK-Based Analytics
+ Presents a methodology for using ATT&CK to build, test, and refine behavioral-based analytic detection capabilities. (June 2017)
++ Learn more about the Use Cases through the Sp4rkcon Presentation: Putting MITRE ATT&CK™ into Action with What You Have, Where You Are and the Getting Started with ATT&CK eBook. +
+
+ For additional ATT&CK topics and to explore presentations and training: +
+ + + + +
++ ++++How should I not use ATT&CK?
+ ATT&CK is just as much about the mindset and process of using it as much as it is the knowledge base itself. When it comes to information security, the threats we face, new technologies, and the adaptability of goal-based adversaries, we cannot consider filling out a checklist as “done”. + +++ ++ ++ ++ Don’t try to achieve 100% coverage. Every organization faces its own unique cyber threat. Not every tactic or technique will apply to everyone. Prioritize ones that are most relevant to you and ensure you are prepared for them. ++++ ++ ++ ++ Don’t shout “Bingo” when you have one technique. Just because you have identified a single way an adversary has done a technique, doesn’t mean it’s time to declare success and color a box green. Adversaries have multiple ways they can perform most techniques. Look for and understand other ways a technique may be accomplished. +++++ ++ ++ Don’t limit yourself to the matrix. Remember the ATT&CK matrix only documents observed real-world behaviors. Adversaries may have a series of other behaviors they use that have not been documented yet. To get a full picture of threats your organization faces, (1) Leverage your own intelligence sources, (2) create and document your own observed techniques, and (3) don’t limit yourselves to behaviors, a timely indicator can catch an adversary. ++
++ ++++Next Steps
+ATT&CK Navigator
+ Use it to visualize defensive coverage, red/blue team planning, the frequency of detected techniques, and more. For more information on how to use Navigator, ATT&CK Navigator Use Case for Threat Intelligence. +
+
+ + + +
+
+
+Community
+ + Stay informed on the latest updates and engage with the ATT&CK Community through Medium, Slack, and Twitter. +
+
+ + + +---- -Other ATT&CK Efforts
-- ---- -- ATT&CK Sightings --- Building a community around sharing observations of ATT&CK techniques in the wild. --- -- -- Plans that showcase the practical use of ATT&CK for offensive operators and defenders. --- -- -- Evaluations of cybersecurity products using an open methodology based on ATT&CK. ---- -Graphics
-- ---- -
- - MITRE ATT&CK Roadmap --Last updated October 2022
--- - - -
- - MITRE ATT&CK Matrix Poster --Last updated April 2023
---Other Resources
--
-
- - ATT&CK Update Log: Recent changes to the ATT&CK content. - -
- - Access Data & Tools: Tools we've developed for accessing and manipulating the ATT&CK content. - -
ATT&CK Training
- - Using MITRE ATT&CK for Cyber Threat Intelligence Training: This training by Katie Nickels and Adam Pennington of the ATT&CK team will help you learn how to apply ATT&CK and improve your threat intelligence practices. + Using MITRE ATT&CK for Cyber Threat Intelligence Training: This training by Katie Nickels and Adam Pennington of the ATT&CK team will help you learn how to apply ATT&CK and improve your threat intelligence practices.
-
Free Cybrary Courses:
diff --git a/modules/resources/templates/update-post.html b/modules/resources/templates/update-post.html
index ff97e8d8ce1..81155c5fc38 100644
--- a/modules/resources/templates/update-post.html
+++ b/modules/resources/templates/update-post.html
@@ -12,8 +12,8 @@
{{ article.title }}
diff --git a/modules/resources/templates/use-cases.html b/modules/resources/templates/use-cases.html index 53c9aa577dc..71d7a0f1337 100644 --- a/modules/resources/templates/use-cases.html +++ b/modules/resources/templates/use-cases.html @@ -15,7 +15,7 @@ @@ -35,7 +35,7 @@{{parsed.title}}
- Return to Get Started + Return to Get Started