1
00:00:17,620 --> 00:00:20,380
Good evening, Red Team Village.

2
00:00:20,480 --> 00:00:26,900
My name is Adam Pennington, and tonight I'm going to be talking about emulating an adversary with imperfect intelligence.

3
00:00:28,720 --> 00:00:34,380
So before I get into content, I wanted to start off with a little bit about who am I.

4
00:00:35,160 --> 00:00:39,000
So I'm the lead of a project called MITRE ATT&CK.

5
00:00:39,000 --> 00:00:41,440
I'm guessing some of you are probably familiar with it.

6
00:00:41,440 --> 00:00:45,000
Several of the other talks in the Red Team Village have been leveraging it.

7
00:00:45,280 --> 00:00:48,480
I've been with MITRE for about 12 years now.

8
00:00:48,720 --> 00:01:03,300
If you're not familiar with MITRE, we're a not-for-profit who primarily runs federally funded research and development centers for the federal government, and does work in the public interest in things similar to ATT&CK that we're putting out there for people to use.

9
00:01:03,300 --> 00:01:19,380
My principal focus is around threat intelligence and deception, but I've been working with adversary emulation teams for years on looking at what sorts of intelligence they're pulling together, and how well the profiles they're building up look like real adversaries.

10
00:01:19,740 --> 00:01:28,700
Most of my time today is spent on MITRE ATT&CK, but I've been an operational defender, as well as a cyber threat intelligence analyst.

11
00:01:28,700 --> 00:01:31,820
I've spent time in multiple security operations centers.

12
00:01:32,620 --> 00:01:38,500
I've been a part of ATT&CK for quite a while, so I've been around since it was a spreadsheet with no ampersand.

13
00:01:38,960 --> 00:01:48,160
ATT&CK originally was an Excel spreadsheet, and I helped gather a lot of the intelligence that we use to create ATT&CK in the first place.

14
00:01:48,160 --> 00:01:52,700
I was at MITRE, I was at Carnegie Mellon for 11 years trying to collect all the degrees.

15
00:01:52,800 --> 00:01:54,980
I'm also a scuba diver.

16
00:01:54,980 --> 00:01:59,100
I'm certified for technical diving, so decompression, rebreather diving.

17
00:01:59,460 --> 00:02:06,400
And I've spent time as a professional live sound engineer, which might explain some of my taste in home audio equipment.

18
00:02:06,500 --> 00:02:08,740
I've been around DEF CON for quite a while.

19
00:02:08,740 --> 00:02:12,260
Obviously, first one through home, like all the rest of you.

20
00:02:14,240 --> 00:02:17,560
Some of the key points I wanted to get to today.

21
00:02:17,980 --> 00:02:23,720
So I'm going to be looking at a very intelligence-focused approach to adversary emulation.

22
00:02:23,800 --> 00:02:29,780
I want to start off by setting the stage in adversary emulation, getting into the definition I'm using.

23
00:02:30,100 --> 00:02:34,900
Now, I'm not expecting that people here haven't heard of adversary emulation.

24
00:02:34,940 --> 00:02:44,780
I really just want to make sure that we're on the same page using the same definition, because adversary emulation is something that I've seen mean different things to different people.

25
00:02:44,780 --> 00:02:51,080
I'm going to talk about gathering and extracting the intelligence necessary to do adversary emulation.

26
00:02:51,080 --> 00:02:52,060
Where do we find it?

27
00:02:52,060 --> 00:02:53,520
How do we pull it together?

28
00:02:54,260 --> 00:02:56,760
And I'm going to talk about some of the flaws in that intel.

29
00:02:56,760 --> 00:02:58,020
So what's wrong with it?

30
00:02:58,020 --> 00:03:00,880
How do we recognize some of those imperfections?

31
00:03:01,320 --> 00:03:02,520
And then how do we deal with it?

32
00:03:02,520 --> 00:03:11,360
How do we find the gaps in our intel, fill them in, and leverage those to create a complete plan that we can use to actually emulate an adversary?

33
00:03:13,340 --> 00:03:16,300
So I said I was going to start with the definition.

34
00:03:16,500 --> 00:03:21,460
This is the definition of adversary emulation that I'm using for the rest of this talk.

35
00:03:22,080 --> 00:03:33,060
Adversary emulation is a type of red team engagement that mimics a known threat to an organization by leveraging threat intelligence to influence what actions and behaviors the red team does.

36
00:03:33,060 --> 00:03:35,060
Pretty straightforward.

37
00:03:35,240 --> 00:03:40,460
Leveraging threat intel, trying to use that to influence what we're going to do.

38
00:03:41,640 --> 00:03:43,120
So what's different?

39
00:03:43,900 --> 00:03:46,920
The big one is that it's driven by threat intelligence.

40
00:03:46,920 --> 00:03:50,360
So it's driven by how the adversary actually looks.

41
00:03:51,100 --> 00:03:56,980
There's a good chance we're going to use that threat intelligence to scope things more than we might in a normal engagement.

42
00:03:56,980 --> 00:03:59,880
So we want things to look like an actual threat.

43
00:03:59,880 --> 00:04:06,520
And so there are things we might not do and take out of our playbooks in order to stick to that.

44
00:04:07,500 --> 00:04:13,820
There's a good chance it follows a constructed scenario in order to stick to what a real adversary looks like.

45
00:04:13,820 --> 00:04:21,780
We might ahead of time create the set of activities, the set of behaviors that we plan to do so that we can keep to that.

46
00:04:22,640 --> 00:04:30,460
And the hope with all of this is that we're getting some idea of how our defenses might fare against a given adversary.

47
00:04:30,600 --> 00:04:32,360
It's still not the real threat.

48
00:04:32,360 --> 00:04:34,240
It's still not going to be the same.

49
00:04:34,240 --> 00:04:38,960
But we're hoping to get close enough to start to get some ideas.

50
00:04:40,300 --> 00:04:44,600
So there's a bunch of new challenges that emulation brings in around intelligence.

51
00:04:44,800 --> 00:04:48,660
And I'm going to be covering several of these in my talk tonight.

52
00:04:49,480 --> 00:04:53,300
The first and most basic one, the need for intelligence in the first place.

53
00:04:53,320 --> 00:04:56,860
So needing to know what an adversary looks like.

54
00:04:57,660 --> 00:05:03,340
We might not have enough intelligence out there on an adversary that's in a form we can use.

55
00:05:03,340 --> 00:05:11,360
It might not describe the sorts of activities that we need as an adversary emulation team to go out and look like the adversary.

56
00:05:12,360 --> 00:05:16,960
The adversary we want to emulate, there may just not be enough intel on.

57
00:05:16,960 --> 00:05:18,680
We may not know about them.

58
00:05:18,800 --> 00:05:23,460
And so we might need to fill in the picture a little bit more to be able to really emulate them.

59
00:05:24,260 --> 00:05:27,280
And finally, you know, we're pulling all this intel.

60
00:05:27,300 --> 00:05:30,780
We need to be able to turn it into a workable scenario.

61
00:05:32,320 --> 00:05:41,300
So my team has an adversary emulation process that we've used in several other places in presentations, as well as documents.

62
00:05:41,300 --> 00:05:48,000
But it originally comes from a presentation a few years ago by then ATT&CK team members, Katie Nichols and Cody Thomas.

63
00:05:48,740 --> 00:05:53,620
And the process we work from is to first gather threat intelligence.

64
00:05:53,620 --> 00:06:02,240
So figure out who your adversaries are and start to pull in all the information you can find on the adversary you picked to emulate.

65
00:06:03,840 --> 00:06:06,120
Extract techniques from that intelligence.

66
00:06:06,120 --> 00:06:14,960
So start to look at what the behaviors are in that intelligence, so that we can pull them together into a plan to be able to look like those behaviors.

67
00:06:17,240 --> 00:06:19,560
Analyze and organize that intelligence.

68
00:06:19,900 --> 00:06:30,540
So taking those behaviors, looking at what's there, what isn't there, filling in any gaps, and then pulling that together into a plan we can actually use.

69
00:06:31,320 --> 00:06:32,920
Develop tools.

70
00:06:33,280 --> 00:06:38,640
So we need malware utilities and other things to be able to operate with.

71
00:06:38,980 --> 00:06:41,940
And then finally, do the emulation.

72
00:06:44,590 --> 00:06:46,890
So I'm a threat intel guy.

73
00:06:46,890 --> 00:06:52,750
I'm going to cover the most threat intel focused pieces of this process.

74
00:06:52,750 --> 00:06:57,530
And so what I'm going to focus on today is the first three steps in this process.

75
00:06:59,770 --> 00:07:03,270
So start with the first step, gather threat intelligence.

76
00:07:03,870 --> 00:07:10,250
So we're going to need to choose an adversary and then pull in information that we can find about them.

77
00:07:10,590 --> 00:07:14,870
So before we can start gathering data, we need to identify the adversary.

78
00:07:15,350 --> 00:07:26,950
I'll cover two ways to do this in looking at gaps that we're hoping to assess in our environment and considering who is targeting us in the first place.

79
00:07:26,950 --> 00:07:32,110
I'll then go through a couple of processes for gathering data on that adversary.

80
00:07:32,330 --> 00:07:40,330
So pulling in information on things that they do after they break into environments, that's likely to be most of the space of our engagement.

81
00:07:40,830 --> 00:07:46,590
And beyond behaviors, there are some things to think about beyond just what techniques they do.

82
00:07:46,610 --> 00:07:49,490
So what tools are adversaries using?

83
00:07:49,530 --> 00:07:52,010
What other groups are associated with them?

84
00:07:52,010 --> 00:07:56,690
So what other names might we have that are describing some of the same activity?

85
00:07:56,950 --> 00:08:00,030
As well as an adversary's campaigns.

86
00:08:00,250 --> 00:08:07,830
So a series of intrusions that are happening in a time period that are attributed to the same actor.

87
00:08:08,350 --> 00:08:11,630
And on top of all this, we probably want to think about the timeframe.

88
00:08:11,870 --> 00:08:17,790
Some of the actors we might want to emulate might have been in this business a very long time.

89
00:08:17,790 --> 00:08:24,710
So I'll be using an actor later, who is thought to have been around since at least 2004.

90
00:08:24,710 --> 00:08:30,010
What they looked like in 2004 is probably a little bit different than what they look like today.

91
00:08:33,220 --> 00:08:43,820
So there are a lot of ways that you can find lists of adversaries, you know, information on starting points for who it is you want to emulate.

92
00:08:44,320 --> 00:08:49,520
I've got my biases, I'm going to leverage attack, but you don't have to.

93
00:08:49,520 --> 00:08:55,260
But a decent number of red teams we have seen using it for adversary emulation.

94
00:08:55,260 --> 00:08:58,500
So some other options instead of attack.

95
00:08:58,560 --> 00:09:10,920
If you have an internal threat intelligence team that is tracking on groups that are, you know, hitting your own organization, that might be your best source of threat intelligence.

96
00:09:10,920 --> 00:09:15,340
So they know about the threats that matter most to your organization.

97
00:09:15,460 --> 00:09:21,420
They may have the best picture of the techniques that are really relevant to you.

98
00:09:21,420 --> 00:09:24,260
So that could be a really good place to start.

99
00:09:24,260 --> 00:09:30,580
There are people that might be able to sell this information to you.

100
00:09:30,580 --> 00:09:39,240
So there are commercial threat intelligence providers where, you know, for a fee, you can get information on different adversaries you might be interested in.

101
00:09:39,960 --> 00:09:42,480
Or you can go to the same well that we do.

102
00:09:42,480 --> 00:09:47,500
So everything that we're pulling into attack is coming from open source threat intelligence reporting.

103
00:09:47,880 --> 00:09:51,560
And so you can go out and look at some of the same sorts of reports we do ourselves.

104
00:09:52,940 --> 00:10:02,260
Because I'm going to be using ATT&CK for the rest of this talk, I'm just going to quickly get into a few of the specific aspects of it that I'm going to be leveraging here.

105
00:10:02,340 --> 00:10:07,220
So I'm not going to get into, you know, the defensive use cases, things like that.

106
00:10:07,360 --> 00:10:13,080
Just sort of the basics of the framework structure and then the groups information that we're going to be pulling from it.

107
00:10:14,640 --> 00:10:17,980
So I think probably a lot of you have already heard of ATT&CK.

108
00:10:17,980 --> 00:10:22,230
But at its core, ATT&CK is a knowledge base of adversary behaviors.

109
00:10:22,580 --> 00:10:28,640
It's like an encyclopedia of things that real actors have been seen to do in the wild.

110
00:10:28,740 --> 00:10:36,080
So not just things a red team has done, not just theoretical, but it's actual adversary behaviors.

111
00:10:36,300 --> 00:10:38,120
It's freely available.

112
00:10:38,440 --> 00:10:44,500
Everything I'm going to be talking about today, every resource I'm using is out there for free.

113
00:10:44,500 --> 00:10:47,280
And if it's code is open source.

114
00:10:48,140 --> 00:10:50,440
So let's talk about structural here.

115
00:10:50,440 --> 00:10:53,080
This is the view most people use of ATT&CK.

116
00:10:53,080 --> 00:10:54,980
It's what we call the matrix.

117
00:10:56,260 --> 00:11:01,260
It's a layout of different activities that adversaries do.

118
00:11:01,300 --> 00:11:06,020
The way it's organized is across the top here, we have what we call tactics.

119
00:11:06,120 --> 00:11:08,760
These are the adversary's broad technical goals.

120
00:11:08,760 --> 00:11:11,260
So it's something like initial access.

121
00:11:11,640 --> 00:11:17,140
The adversary is trying to get into my network or exfiltration.

122
00:11:17,140 --> 00:11:20,680
The adversary is sending stuff that they've stolen out of my environment.

123
00:11:20,680 --> 00:11:29,200
Or something a little different like impact, where an adversary is trying to cause destruction or disruption to systems or my environment.

124
00:11:30,020 --> 00:11:34,180
Under each of these tactics, we have what we call techniques.

125
00:11:34,280 --> 00:11:37,860
And those are how the technical goals are achieved.

126
00:11:38,400 --> 00:11:41,260
And these are sort of the basic unit of ATT&CK.

127
00:11:41,260 --> 00:11:43,500
I've seen a bunch of techniques.

128
00:11:43,500 --> 00:11:48,020
So Cirio was just using several technique IDs in her talk.

129
00:11:48,280 --> 00:11:52,320
And so these are getting down to more specific ways.

130
00:11:52,320 --> 00:11:55,200
So instead of initial access, we now have something like phishing.

131
00:11:55,200 --> 00:11:57,960
The adversary is sending a malicious email.

132
00:11:58,500 --> 00:12:08,480
That's kind of an exciting talk for me, because this is the first time I've given a talk in years that I've been able to fit the matrix on a single slide.

133
00:12:08,540 --> 00:12:19,080
So we recently did a fairly big refactoring of ATT&CK and going from just tactics and techniques to tactics, techniques, and sub-techniques.

134
00:12:19,080 --> 00:12:23,720
So there's now another layer of abstraction under a lot of the techniques.

135
00:12:24,640 --> 00:12:27,660
Sub-techniques are just more specific techniques.

136
00:12:27,660 --> 00:12:33,000
So instead of phishing, we have something like spear phishing attachment or spear phishing link.

137
00:12:33,000 --> 00:12:35,600
So it's, again, getting more specific.

138
00:12:35,780 --> 00:12:40,820
These sub-techniques have all the same properties behind them as techniques.

139
00:12:40,820 --> 00:12:44,620
They have all the same mitigations, detections, everything else.

140
00:12:44,640 --> 00:12:48,780
It's just a deeper level of specificity, and they have a parent technique.

141
00:12:50,060 --> 00:12:54,340
Finally, getting all the way down to detail, we've got procedures.

142
00:12:54,460 --> 00:12:59,340
These are specific adversary implementations of techniques and sub-techniques.

143
00:12:59,820 --> 00:13:07,200
So instead of spear phishing attachment, we might have the APT12 that sent emails with malicious office documents and PDFs attached.

144
00:13:08,400 --> 00:13:12,060
Okay, our goal was to find out stuff about groups.

145
00:13:12,360 --> 00:13:19,400
Something else that ATT&CK has is profiles on a number of different threat actors, over 100 of them.

146
00:13:20,240 --> 00:13:22,560
This is what a group page looks like.

147
00:13:22,560 --> 00:13:29,060
We've got a brief text description of the group itself, some metadata associated with it.

148
00:13:29,060 --> 00:13:32,500
We have what we call associated group descriptions.

149
00:13:33,340 --> 00:13:41,760
Different companies, different threat intelligence providers use different names to describe the same or closely related groups.

150
00:13:43,040 --> 00:13:44,220
And this is natural.

151
00:13:44,220 --> 00:13:49,080
These organizations have their own definitions of these groups that may not be quite the same.

152
00:13:49,080 --> 00:13:53,900
That's one of the reasons we call it associated groups instead of what we used to call it, which is aliases.

153
00:13:55,440 --> 00:13:57,620
We keep track of what techniques are used.

154
00:13:57,620 --> 00:14:05,340
So we've taken open source threat intelligence reporting, gone through, and figured out what those reports say that the adversary has been doing.

155
00:14:07,700 --> 00:14:10,980
Similar to our groups pages, we also have software pages.

156
00:14:11,220 --> 00:14:26,840
Those keep track of different pieces of software the adversary is using, everything from utilities to things that they've custom written, as well as all of the techniques that that particular piece of software is able to do.

157
00:14:27,460 --> 00:14:29,600
And finally, there's references for all of it.

158
00:14:29,600 --> 00:14:35,880
You can go back, you can check our work, you can see the original references, and make sure that you believe what we say about it.

159
00:14:35,900 --> 00:14:36,880
People

160
00:14:40,170 --> 00:14:43,130
use ATT&CK for a lot of different things.

161
00:14:43,130 --> 00:14:45,830
I'm only touching on adversary emulation tonight.

162
00:14:46,250 --> 00:14:48,970
It's kind of a good use case for ATT&CK, though.

163
00:14:48,970 --> 00:14:54,970
So it turns out that adversary emulation is what ATT&CK was created for in the first place.

164
00:14:56,970 --> 00:15:16,570
The reason we originally created ATT&CK was that we had a red team who wanted to look like some specific actors, wanted to create playbooks, create plans, operate, and then wanted to be able to compare notes with the blue team and see if they saw the same things that the adversary had done.

165
00:15:18,050 --> 00:15:19,010
Okay.

166
00:15:20,570 --> 00:15:27,070
So if I want to actually start to pick out an actor from all this set, you've got 100 actors.

167
00:15:27,150 --> 00:15:34,950
So we can start by looking at how specific actors align with some of the gaps that we think we might have in our defenses.

168
00:15:36,010 --> 00:15:38,650
So this is coming from APT28.

169
00:15:39,850 --> 00:15:48,890
Everything in blue here is techniques that we've identified from multiple open-source threat intelligence reports.

170
00:15:48,890 --> 00:15:51,330
It's not using any commercial or government reporting.

171
00:15:51,330 --> 00:15:54,010
It's just things that you also have access to.

172
00:15:54,230 --> 00:15:57,430
I'm going to be showing a bunch of diagrams that look like this.

173
00:15:57,430 --> 00:16:02,450
This is basically the same matrix layout I showed in the introduction a second ago.

174
00:16:02,450 --> 00:16:07,510
I do have a number of the sub-techniques expanded out to show a bit more of the detail.

175
00:16:08,310 --> 00:16:13,350
But you're probably not going to be able to read the labels at least over on Twitch or YouTube.

176
00:16:14,010 --> 00:16:19,350
But all these diagrams I'm creating are using ATT&CK Navigator, which is an open-source tool we provided.

177
00:16:19,590 --> 00:16:22,250
That's a URL to actually work with it yourself.

178
00:16:22,250 --> 00:16:28,630
And I'll release the slides for this right after the talk and work on getting the navigator layers out I'm using.

179
00:16:29,430 --> 00:16:39,170
So if we're looking at the techniques that APT28 has used, we can then compare that with our own defenses.

180
00:16:39,170 --> 00:16:48,690
So if we take the same ATT&CK Navigator, we lay out where we think that our defenses can catch or not catch an adversary.

181
00:16:48,690 --> 00:16:53,670
So what's in red here is notional gaps in the defenses for an organization.

182
00:16:53,670 --> 00:16:57,710
So what I think that I can't detect today.

183
00:16:58,450 --> 00:16:59,110
Okay?

184
00:16:59,210 --> 00:17:07,730
So if I take that adversary, I add the gaps to it, I can then create something that looks like this.

185
00:17:08,090 --> 00:17:19,890
So I now have the APT28 in blue, our gaps in red, and the green here is, you know, where we think we might have gaps.

186
00:17:20,010 --> 00:17:25,370
So again, without the slides, probably not going to be able to see which individual techniques are highlighted.

187
00:17:25,390 --> 00:17:29,370
But we can see, you know, maybe APT28 isn't the best match for us.

188
00:17:29,370 --> 00:17:35,010
You know, they've only got maybe 10 techniques that overlap with things that we think are gaps.

189
00:17:35,010 --> 00:17:36,290
So, okay.

190
00:17:36,450 --> 00:17:38,350
What else can we look for?

191
00:17:40,250 --> 00:17:43,490
We can also look at adversaries who are targeting us.

192
00:17:43,490 --> 00:17:56,410
So especially if we've got our own internal threat intelligence team to help us, they may be able to help us prioritize here because hopefully they know who it is who's been coming after us.

193
00:17:56,530 --> 00:18:00,950
And again, there's a couple different ways that we can prioritize based on this.

194
00:18:03,310 --> 00:18:06,570
So we can start with an adversary who targets us regularly.

195
00:18:06,890 --> 00:18:15,390
Now, maybe we've got some actor who the first Monday of every month, like clockwork, sends us a spearfish.

196
00:18:16,630 --> 00:18:18,910
You know, maybe they're not the best.

197
00:18:18,910 --> 00:18:27,650
We don't, you know, maybe that we think that our defenses are pretty good about them, but they may be of a lot of interest to us just because they're trying so regularly.

198
00:18:27,650 --> 00:18:30,470
They're definitely a persistent threat.

199
00:18:31,830 --> 00:18:34,630
We can look at adversaries who have targeted others like us.

200
00:18:34,850 --> 00:18:46,290
If we've got some actor who's tried to break into every other peer in our industry and has succeeded in places, well, we're probably somewhere on their priority list.

201
00:18:46,290 --> 00:18:51,630
We're in their priority intelligence requirements for who they should be breaking into.

202
00:18:51,810 --> 00:18:55,890
So we might want to understand how it is that we might face against them.

203
00:18:56,510 --> 00:19:05,830
Finally, you might want to pick an adversary who doesn't target us very much or we've never actually seen, but they might, but has a high skill level.

204
00:19:05,830 --> 00:19:13,690
You know, the actor who keeps us up at night because we think that if they came after us, they'd probably succeed.

205
00:19:13,690 --> 00:19:15,870
You know, they've got the high skill set.

206
00:19:16,930 --> 00:19:22,650
So the adversary I'm leveraging today for a lot of organizations probably more fits into this last group.

207
00:19:23,190 --> 00:19:25,830
The keep you up at night adversary.

208
00:19:27,310 --> 00:19:31,610
So the adversary I'm going to leverage for the rest of this talk is Turla.

209
00:19:32,730 --> 00:19:37,090
Turla has been attributed to Russian state activity.

210
00:19:37,630 --> 00:19:39,790
They've been around for quite a while.

211
00:19:39,790 --> 00:19:43,010
They've been seen since at least 2004.

212
00:19:43,570 --> 00:19:52,830
I kind of like this group and that they're cross-platform so they don't just stick to Windows systems, but they've been known to go after macOS and Linux.

213
00:19:53,190 --> 00:19:58,050
And they use some interesting techniques that we don't see a lot of actors use.

214
00:19:58,530 --> 00:20:08,810
And so everything in ATT&CK has been seen somewhere by some actor, but there are techniques that there are really only, you know, a certain number of high-end adversaries that are getting into them.

215
00:20:10,750 --> 00:20:12,690
So we've picked our actor.

216
00:20:13,190 --> 00:20:15,650
It's time to start gathering data on them.

217
00:20:15,650 --> 00:20:23,290
So if I'm not using ATT&CK as my data source, I'm going to want to probably go out there and start gathering intel.

218
00:20:23,510 --> 00:20:29,530
And so, you know, I can start looking through open source publicly available threat intelligence reports.

219
00:20:29,530 --> 00:20:32,770
There are quite a lot of them out there these days.

220
00:20:32,770 --> 00:20:40,130
There really weren't that many when ATT&CK started, but we do have quite a wealth out there of reporting now.

221
00:20:41,110 --> 00:20:46,470
Or I can leverage the version of a lot of these techniques that's in ATT&CK.

222
00:20:46,590 --> 00:20:57,450
So we're going through some of these exact same reports, trying to find what behaviors and techniques are in there, and then we're putting out that same information in ATT&CK.

223
00:20:57,450 --> 00:21:02,770
So it's information you already have access to just in a digested form.

224
00:21:05,030 --> 00:21:07,110
So we've got this intel.

225
00:21:07,110 --> 00:21:20,290
If we're going from our own sources, if we're bringing in open source threat intelligence reporting ourselves, we're going to need to go through a process of extracting techniques.

226
00:21:20,670 --> 00:21:23,490
Internally, we tend to call this mapping.

227
00:21:23,630 --> 00:21:32,970
So the quick process that you're going to go through in these reports is something along the lines of first finding the behaviors in the report.

228
00:21:32,970 --> 00:21:41,730
So figuring out what is it that are activities that the adversary did, the things that we're going to want to later be doing ourselves.

229
00:21:42,450 --> 00:21:44,130
Figure out the tactics.

230
00:21:44,130 --> 00:21:49,490
So it takes a little bit of experience in understanding what you're reading with adversary behavior.

231
00:21:49,730 --> 00:21:53,670
But what is the adversary's goal for each of those behaviors?

232
00:21:54,650 --> 00:21:56,150
Move down to more specifics.

233
00:21:56,150 --> 00:21:58,610
Move down those columns of ATT&CK.

234
00:21:58,950 --> 00:22:05,770
Go from the tactic to a technique, or even better, all the way down into a sub-technique.

235
00:22:06,630 --> 00:22:08,530
And I recommend doing this as a team.

236
00:22:08,530 --> 00:22:15,190
You know, everyone has their own biases and preconceptions in how they read intel, something I'll talk about a bit more in a minute.

237
00:22:15,410 --> 00:22:22,030
But comparing notes can be super effective for canceling out different issues you might have.

238
00:22:22,550 --> 00:22:32,970
So I'm only going to be briefly talking about how to do this, but my friend and former ATT&CK teammate Katie Nichols released training earlier this year on how to do this mapping in much more detail.

239
00:22:33,430 --> 00:22:36,010
The URL for it is available in the slides.

240
00:22:36,010 --> 00:22:38,070
Again, I'll release the slides later.

241
00:22:38,290 --> 00:22:39,550
And it's completely free.

242
00:22:39,550 --> 00:22:41,910
The videos for it are up on YouTube.

243
00:22:44,980 --> 00:22:48,700
So this process of mapping ATT&CK techniques.

244
00:22:48,760 --> 00:22:57,640
You know, this little snippet of reporting has quite a few of them in it in the way that we would interpret an open-source threat intelligence report.

245
00:22:57,640 --> 00:23:02,680
So first we're going through, we're identifying each of the behaviors.

246
00:23:02,680 --> 00:23:14,960
There's the highlighted in yellow bits where they're either describing something an adversary did or, you know, they're using a tool where it's relatively clear what the behavior is that they're using it for.

247
00:23:15,840 --> 00:23:20,620
We're going through, we're getting down into tactics and getting down into techniques.

248
00:23:20,620 --> 00:23:28,200
So instead of create batch scripts, we're interpreting that into ATT&CK for our Windows command shell, T10-59-003.

249
00:23:28,560 --> 00:23:33,540
Instead of Windows run key, we now have registry run keys, startup folder.

250
00:23:33,540 --> 00:23:36,340
So T15-74-001.

251
00:23:36,440 --> 00:23:46,200
And we're just going through the entire document, repeating this process over and over again, and pulling out the full set of techniques that we're able to find.

252
00:23:49,300 --> 00:23:54,840
So once you've pulled out all those techniques, you need to structure your intel.

253
00:23:54,840 --> 00:23:58,760
And so I'm, you know, again, using the ATT&CK Navigator.

254
00:23:58,920 --> 00:24:07,580
This is the full set of Turla techniques that I've extracted from ATT&CK, pulled out of their page that's in there.

255
00:24:07,660 --> 00:24:11,560
Again, everything that's here is only based on open source threat intelligence reporting.

256
00:24:11,560 --> 00:24:14,620
So it has the limitations of that.

257
00:24:15,440 --> 00:24:22,980
And so that's, this is the sum total of all of those threat intelligence reports we mapped with Turla.

258
00:24:25,780 --> 00:24:28,860
Okay, so we've got a pile of intel.

259
00:24:29,260 --> 00:24:31,280
What do we actually do with it?

260
00:24:31,280 --> 00:24:32,960
You know, is this any good?

261
00:24:32,960 --> 00:24:35,440
Do we have a picture of the adversary yet?

262
00:24:35,700 --> 00:24:43,320
And so we're going to need to go through some more work to figure out what we've got, you know, what the adversary is trying to do.

263
00:24:43,440 --> 00:24:47,560
And do we even have enough of a picture to be able to make a plan here?

264
00:24:48,260 --> 00:24:53,720
So the first two steps I'm going to work through are establishing the adversary's goal.

265
00:24:53,720 --> 00:24:56,420
So what is it that they're trying to do?

266
00:24:56,420 --> 00:25:04,960
Understand their modus operandi a little bit better in terms of what we're later going to want to operate like.

267
00:25:05,080 --> 00:25:11,440
And an important point to remember is that this goal is probably not technical.

268
00:25:11,720 --> 00:25:18,200
The adversary is probably not focused on getting domain administrator or stealing a particular password.

269
00:25:18,200 --> 00:25:23,480
They're probably interested in fulfilling an intelligence requirement.

270
00:25:23,480 --> 00:25:28,800
You know, they have some piece of information that they want to steal from your environment.

271
00:25:30,400 --> 00:25:41,800
So the goal is likely to be something more like data theft or to stop you from operating than, you know, hack the Gibson or, you know, brick a particular computer.

272
00:25:43,220 --> 00:25:49,900
After you've determined what that goal is, you need to look at what the gaps are between an adversary getting in and reaching that goal.

273
00:25:50,420 --> 00:25:56,140
What is it I don't know about the middle that would let me look like that adversary?

274
00:25:57,720 --> 00:26:02,900
So to go through those first two steps of it, so establishing an adversary goal.

275
00:26:03,420 --> 00:26:07,600
You could take a look at which tactics the adversary is using.

276
00:26:07,600 --> 00:26:12,480
So we can see that TERLA has some stuff in collection and exfiltration.

277
00:26:12,480 --> 00:26:14,300
They've got nothing in impact.

278
00:26:14,300 --> 00:26:17,380
But instead, I'm going to go back to the original reporting.

279
00:26:18,260 --> 00:26:21,920
So this is a Kaspersky report on TERLA.

280
00:26:22,120 --> 00:26:26,540
And so they talk about how TERLA went through, they're searching for emails.

281
00:26:26,540 --> 00:26:30,380
They were specifically looking for emails related to NATO energy dialogue.

282
00:26:30,380 --> 00:26:34,140
And then shortly afterwards, the report talks about them exfiling the information.

283
00:26:34,140 --> 00:26:38,820
So, okay, they're stealing information around particular topics.

284
00:26:39,900 --> 00:26:42,120
Similarly, an ESET report.

285
00:26:42,120 --> 00:26:47,000
They're going through, they're getting into the victim's Microsoft SQL database.

286
00:26:47,000 --> 00:26:52,740
Pulling documents out of it, and again, exfiling, and taking specific information.

287
00:26:53,580 --> 00:27:03,400
So we've got a relatively clear picture, and we can look at other reports and see the same thing, where over and over and over again, TERLA is stealing information.

288
00:27:03,400 --> 00:27:09,200
So it looks like they're focused on theft of information and exfiltration.

289
00:27:12,980 --> 00:27:20,240
So I said that we need to then examine gaps between access and goal.

290
00:27:20,760 --> 00:27:24,740
I'm going to cover for a few minutes first, why are there gaps?

291
00:27:24,880 --> 00:27:29,180
So we've got this intel, it's an attack, it's all out there.

292
00:27:29,260 --> 00:27:33,640
Why isn't that enough for us to be able to work with?

293
00:27:34,500 --> 00:27:40,300
Open source intelligence likely doesn't paint a complete picture of an adversary.

294
00:27:40,640 --> 00:27:44,680
Frankly, commercial and closed intelligence probably doesn't either.

295
00:27:44,680 --> 00:27:54,280
So there are biases in the information, in how it's gathered, and what information is gathered, as well as nobody has perfect visibility.

296
00:27:54,420 --> 00:28:06,260
It's very rare that you have intelligence that tells you everything an adversary does from the point when a victim clicks to the point when they actually are stealing information.

297
00:28:07,840 --> 00:28:11,240
And by putting it into attack, we add our own problems.

298
00:28:11,240 --> 00:28:17,400
So group intelligence in attack is subject to our own biases, and then we're very similar.

299
00:28:18,080 --> 00:28:22,720
And, you know, we're adding on to the biases that are coming from this open source intelligence.

300
00:28:22,720 --> 00:28:28,740
So some of that is from how we map from these intelligence reports and what it is we actually choose to come in.

301
00:28:29,680 --> 00:28:33,960
Now, bias is usually a negative word in the English language.

302
00:28:33,960 --> 00:28:42,560
It sounds bad, you know, sounds like we may not like certain intelligence, but in threat intelligence, we accept that all sources

303
00:28:46,160 --> 00:28:46,720
have certain information.

304
00:28:46,720 --> 00:28:51,660
And so we work to understand those and what they are so that we can account for them.

305
00:28:54,220 --> 00:28:59,000
So some of why we have these biases in our reporting.

306
00:29:02,280 --> 00:29:06,440
Any reporting source is going to have a visibility bias.

307
00:29:07,040 --> 00:29:15,040
There are only certain types of information that a given source is going to have, and they might only have certain types of sensors.

308
00:29:15,040 --> 00:29:22,300
An incident response firm may only have whatever sensors were in the environment at the time.

309
00:29:23,000 --> 00:29:36,660
Whereas things that can only be seen in real time, so maybe decoded command and control traffic or registry monitoring, other things that don't really leave much of a forensic trace, might not be in their visibility.

310
00:29:38,300 --> 00:29:40,640
So there's novelty bias.

311
00:29:40,840 --> 00:29:43,680
So I'm kind of a beer snob.

312
00:29:43,680 --> 00:29:54,640
In normal pre-COVID times, I walk into a good beer bar, I look at the taps that are there, and I see a bunch of stuff I've had before.

313
00:29:54,640 --> 00:30:02,660
It's been on my untapped list for years now, and I see the one tap that was the thing I've wanted to try for a while.

314
00:30:03,160 --> 00:30:05,320
Reporting can be a lot like that.

315
00:30:05,320 --> 00:30:18,100
So I've got my reports, I've got my APT 1-8 report where I've got a new actor, we've never seen him before, they're doing something new, and I've got my APT Elite report.

316
00:30:18,100 --> 00:30:23,860
I'm going to put out the one that's brand new, is more likely to make a headline.

317
00:30:24,200 --> 00:30:29,460
And so our intel is biased by this, where some reports are more likely to come out than others.

318
00:30:31,640 --> 00:30:36,780
As people are creating the intelligence in the first place, they have availability bias.

319
00:30:36,980 --> 00:30:41,080
Availability bias is a classic cognitive bias.

320
00:30:41,220 --> 00:30:48,920
I have some things that I am more familiar with, that I'm more used to seeing, that I'm more likely to recognize.

321
00:30:49,140 --> 00:31:06,220
So somebody who's done a ton of incident response, they've seen PowerShell over and over again, they might be more likely to notice the PowerShell activity and not notice that, say the adversary got into the BIOS over here or something super novel.

322
00:31:07,940 --> 00:31:09,400
Victim bias.

323
00:31:09,400 --> 00:31:15,320
So there are some victims where there is more likely for reporting to come out than others.

324
00:31:15,680 --> 00:31:23,720
So there are only certain firms that can afford some of the companies that are putting out a lot of this threat intelligence reporting.

325
00:31:23,960 --> 00:31:29,660
Some victims are also in industries where they're a lot more likely to allow reports to come out.

326
00:31:29,800 --> 00:31:34,980
There may be issues with regulators if there's any information about them having been hacked.

327
00:31:35,400 --> 00:31:40,200
And so who the victim is, is going to matter a lot for if we ever hear about it.

328
00:31:43,800 --> 00:31:44,400
Victim bias.

329
00:31:44,600 --> 00:31:48,340
So some sources write more reports than others.

330
00:31:48,940 --> 00:32:05,620
If, you know, one company is writing, you know, dozens and dozens of reports that all have active behaviors in them and another company is just putting out a couple, we're going to have more information to work with from another.

331
00:32:06,740 --> 00:32:08,640
And so I said we compound it.

332
00:32:08,680 --> 00:32:12,980
And so we add our own biases to these and the types of sources we select.

333
00:32:13,120 --> 00:32:21,720
And so a lot of the stuff I've been talking about is in terms of information from security vendors and threat intelligence firms.

334
00:32:22,200 --> 00:32:29,980
So 92% of the reports that we have in ATT&CK, as a point when I made this slide, are coming from security vendors.

335
00:32:30,060 --> 00:32:32,260
3% are coming from government reports.

336
00:32:32,260 --> 00:32:37,380
These are things like public indictments and other public available government reports.

337
00:32:37,520 --> 00:32:39,540
And a few are coming from press reports.

338
00:32:39,800 --> 00:32:47,940
Sometimes there's an article in Wired or the Register that describes really good, unique adversary activity.

339
00:32:48,860 --> 00:32:51,500
We have our own availability bias.

340
00:32:51,540 --> 00:33:01,960
So in that mapping process of going through reports, we've reduced the number of techniques in ATT&CK a little bit recently, but there's still over 160 of them.

341
00:33:02,240 --> 00:33:08,140
And so it's hard for us to keep a working set of all of those techniques.

342
00:33:08,140 --> 00:33:12,860
And so we've got the techniques that we remember in there and are at the tip of our tongue.

343
00:33:12,860 --> 00:33:21,080
And then we have the techniques in ATT&CK, like hidden file system that we almost never see in reporting.

344
00:33:22,340 --> 00:33:24,600
We have our own novelty bias.

345
00:33:24,600 --> 00:33:30,560
So we've got, you know, dozens and dozens of reports on FuzzyDeck using PowerShell.

346
00:33:30,560 --> 00:33:37,620
But we've got this one brand new report on APT Elite using transmitted data manipulation, a fairly new technique.

347
00:33:38,140 --> 00:33:41,620
We're probably going to go for the shiny new report.

348
00:33:43,940 --> 00:33:49,280
And so if you're using Intel from ATT&CK, there's a couple of other caveats to realize .

349
00:33:50,520 --> 00:33:58,660
So our reporting that we've got in there on a given group page is from all different time periods combined.

350
00:33:59,220 --> 00:34:02,280
There's some reasons why we do this.

351
00:34:02,440 --> 00:34:05,620
Reporting frequently doesn't say when the activity happened.

352
00:34:05,620 --> 00:34:15,660
So a report, we might have a date on the report itself, not always, and a pox on people that put out threat intelligence reports about dates .

353
00:34:15,940 --> 00:34:19,420
But we don't even know necessarily when the intrusion happened.

354
00:34:19,420 --> 00:34:28,360
And I've seen reporting where I know the intrusion that they were talking about was four or five years old, where it sounded like they were talking about something recent.

355
00:34:29,560 --> 00:34:32,220
Some reports might only talk about a small range of activity.

356
00:34:32,220 --> 00:34:39,800
So some why we end up adding stuff together is so that we can talk enough about a single actor to paint a picture.

357
00:34:39,800 --> 00:34:48,080
So if I only have one report with, you know, ten techniques in it, it's probably not telling me the range of activity that an actor can do.

358
00:34:49,740 --> 00:34:55,460
Our group pages only include behaviors that are directly tied to actor activity.

359
00:34:55,540 --> 00:35:01,720
So our standards for what we're adding into those pages is that the reporting says that the actor did it.

360
00:35:02,140 --> 00:35:05,560
And so that doesn't include behaviors of software that adversaries use.

361
00:35:05,560 --> 00:35:13,620
So if there is a malware analysis report out there that we're putting in attack, that's going on those software pages.

362
00:35:13,820 --> 00:35:17,880
And we're not including that into the activity of the given adversary.

363
00:35:17,960 --> 00:35:21,600
And finally, the reporting we're using doesn't always agree on attribution.

364
00:35:21,940 --> 00:35:27,960
And so we're sometimes left trying to figure out what the heck group we should be even putting this into.

365
00:35:27,960 --> 00:35:30,460
And hopefully in most cases it's accurate.

366
00:35:32,000 --> 00:35:33,860
So that sounds awful.

367
00:35:33,860 --> 00:35:35,600
You know, so what do we what do we do about it?

368
00:35:35,600 --> 00:35:37,840
I've talked about this as our source of intel.

369
00:35:37,840 --> 00:35:40,580
And now I've talked about all these problems with it.

370
00:35:40,800 --> 00:35:50,480
So the important part is to understand that there are these types of limitations and biases in the intel that we're using to do this emulation.

371
00:35:51,280 --> 00:35:59,340
Once we know that there are these limitations and gaps are there, we can start to determine where the gaps are in our specific intelligence.

372
00:35:59,680 --> 00:36:05,080
And so we don't just throw up our hands and say, well, I don't know anything.

373
00:36:05,100 --> 00:36:08,240
I'm just going back to normal red teaming.

374
00:36:08,240 --> 00:36:14,900
We need to account for these gaps and fill them in as we build our adversary emulation plan.

375
00:36:17,320 --> 00:36:20,100
That was a long aside away from Turla.

376
00:36:20,140 --> 00:36:27,380
But let's start to look at how we might spot gaps in our specific adversary picture.

377
00:36:27,740 --> 00:36:35,360
So taking Turla as an example, how might we see some evidence that our information on Turla isn't perfect?

378
00:36:37,060 --> 00:36:39,320
I can first look for missing dependencies.

379
00:36:40,000 --> 00:36:49,040
So my colleague Amy Applebaum wrote a blog post a couple years back on trying to find related attack techniques.

380
00:36:49,200 --> 00:36:59,160
So both dependencies where in order to do one technique, you might need this other technique first, or techniques that are very often seen together .

381
00:37:00,060 --> 00:37:04,240
And so that can be a useful source for doing this.

382
00:37:04,300 --> 00:37:09,680
But I'm going to zoom in on a couple places in our profile of Turla.

383
00:37:09,700 --> 00:37:11,560
So let's look at initial access.

384
00:37:11,560 --> 00:37:18,560
So we've got some pretty simple techniques here that drive by compromise .

385
00:37:18,560 --> 00:37:22,460
We have fishing, spearfishing attachment, fishing, spearfishing link.

386
00:37:22,780 --> 00:37:24,840
Okay, relatively germane .

387
00:37:25,040 --> 00:37:37,640
But if they're doing each of these things, these successful intrusions, there are actions that need to follow that for the intrusion to have been successful as it was.

388
00:37:37,940 --> 00:37:42,060
So I take a look at our execution for Turla.

389
00:37:42,340 --> 00:37:45,860
And I look at, you know, I've got user execution malicious link.

390
00:37:45,860 --> 00:37:48,540
So they sent a malicious spearfishing link .

391
00:37:48,540 --> 00:37:49,720
We clicked on it.

392
00:37:49,720 --> 00:37:50,720
Okay .

393
00:37:51,000 --> 00:37:53,480
They sent us a spearfishing attachment.

394
00:37:54,100 --> 00:37:57,740
I don't actually have an execution technique for that .

395
00:37:57,740 --> 00:38:00,360
So there's clearly a gap here.

396
00:38:00,800 --> 00:38:02,520
It's something we probably need to fix.

397
00:38:02,520 --> 00:38:15,860
But it, there's, I would expect there to be here either user execution malicious file, or, you know, potentially if they're being really ninja exploitation for client execution.

398
00:38:15,860 --> 00:38:22,340
So, you know, maybe they're, maybe it's a user clicking on the attachment, or maybe they're popping the outlook.

399
00:38:22,960 --> 00:38:25,380
But something is missing here.

400
00:38:27,220 --> 00:38:37,460
We can also look for hints of dependencies, you know, and so we're trying to create something in the style of an adversary, not necessarily exactly what they did.

401
00:38:37,680 --> 00:38:40,760
But so I can look at something like lateral movement.

402
00:38:40,760 --> 00:38:47,580
So, okay, we see them doing lateral tool transfer and Samba Windows admin shares.

403
00:38:48,120 --> 00:38:56,880
Windows admin shares, if they're doing this technique, it's usually something where they're being driven by operating system credentials to get around the network.

404
00:38:56,880 --> 00:39:03,860
So, okay, there's something that should be in here as a credential access so that they've got the creds to do that.

405
00:39:04,920 --> 00:39:11,780
Well, what I've got here is brute force, which they could be using to do OS credentials.

406
00:39:11,780 --> 00:39:18,120
Credentials from password stores is usually other types of credentials rather than operating system.

407
00:39:18,460 --> 00:39:26,920
So I'd really expect there to be something more like OS credential dumping or something with Kerberos tickets.

408
00:39:26,920 --> 00:39:29,340
So domain authentication here.

409
00:39:29,380 --> 00:39:33,580
So a sign that I might have another gap that I need to deal with.

410
00:39:36,480 --> 00:39:44,800
Less dependable, but another way that we might be able to see signs of this is looking for things like unusually sparse tactics.

411
00:39:45,980 --> 00:39:53,620
So in the case of Turla, we've got an adversary who's been around since at least 2004, as I said in the beginning of this.

412
00:39:54,300 --> 00:40:02,040
Most adversaries over time are definitely developing multiple techniques to do a given tactic that's important to them.

413
00:40:02,580 --> 00:40:08,080
And in the case of Turla, all we've got here for exfiltration is exfiltration of cloud storage.

414
00:40:08,680 --> 00:40:19,180
And another reason why that's a little bit suspicious for Turla is that Turla is older than cloud storage, at least in the sense that we would generally mean by it.

415
00:40:19,520 --> 00:40:25,340
And so there's some signs that there might be another gap here in our picture of Turla.

416
00:40:27,840 --> 00:40:45,280
Okay, so if there are gaps and we don't have necessarily everything we need to get from the adversary getting in to achieving their goal, let's look at some ways of filling these in in a logical fashion that sticks to the spirit of the adversary as much as possible.

417
00:40:46,160 --> 00:40:49,560
I'm going to go over four techniques for filling in gaps.

418
00:40:49,680 --> 00:40:54,780
First is adding techniques from the software that the adversary is using.

419
00:40:54,860 --> 00:41:00,520
I'm going to fill in some of those dependencies that I just identified and add those in.

420
00:41:00,520 --> 00:41:02,680
I'm going to take a look at peer adversaries.

421
00:41:02,680 --> 00:41:10,720
So maybe we're still not able to get enough intelligence on stuff that's directly related to the one we've chosen.

422
00:41:10,780 --> 00:41:12,020
Let's look at their peers.

423
00:41:12,020 --> 00:41:15,320
Let's look at people who are operating like them.

424
00:41:15,320 --> 00:41:17,960
And we can borrow from as well.

425
00:41:18,200 --> 00:41:23,440
And finally, if all of that fails, let's look at what lots of adversaries are doing.

426
00:41:23,440 --> 00:41:26,200
It might be something that they're doing as well.

427
00:41:28,180 --> 00:41:35,620
So if I go back to the attack group page, this is all the software that we've associated with Terla.

428
00:41:35,760 --> 00:41:38,720
There's a mix of different types of things in here.

429
00:41:39,060 --> 00:41:42,580
For starters, we have what I'm going to call utilities.

430
00:41:43,040 --> 00:41:49,120
So these are tools that are in every case, but PSExec built into Windows.

431
00:41:49,260 --> 00:41:57,060
PSExec obviously being part of Sys internal, so something that they probably downloaded over the course of the intrusion.

432
00:41:57,060 --> 00:42:00,940
But it's a general purpose tools that anyone's going to have access to it.

433
00:42:02,500 --> 00:42:05,140
Next, we've got public tools.

434
00:42:05,140 --> 00:42:07,780
So our public offensive tools.

435
00:42:08,220 --> 00:42:13,900
Terla, like a lot of actors out there, is a user of MimiCats , as well as Empire .

436
00:42:14,380 --> 00:42:18,020
And so this is something that, you know, it's not just specific to Terla .

437
00:42:18,020 --> 00:42:20,900
We see tons of different adversaries using.

438
00:42:22,940 --> 00:42:27,920
But Terla has a lot of possibly unique software.

439
00:42:28,020 --> 00:42:33,020
So these are pieces of software we have listed for no other adversary but Terla.

440
00:42:33,220 --> 00:42:43,300
We think that maybe they were written for them or written by them, but we at least don't have evidence of them being used elsewhere.

441
00:42:43,820 --> 00:42:49,500
And so for filling in software, I'm going to start with just this possibly unique to Terla set.

442
00:42:49,620 --> 00:42:53,440
And I've got a couple of reasons I'm going to do that.

443
00:42:53,440 --> 00:43:08,720
So the first is that some of the other tools like Mimi Cats, Empire, or if they've been using something like Cobalt, those tools have a ton of functionality .

444
00:43:09,340 --> 00:43:14,700
Off the top of my head, I think Cobalt , we've got over 65 techniques mapped to .

445
00:43:15,100 --> 00:43:23,220
And so it starts to just color in the entire matrix , not necessarily the pieces that Terla is actually using.

446
00:43:24,100 --> 00:43:31,620
Something I've seen is that adversaries have a tendency to use more of the functionality of their own tools , too, than general purpose they're using .

447
00:43:31,620 --> 00:43:33,420
And that makes a lot of sense.

448
00:43:34,140 --> 00:43:42,180
If you are commissioning these or buying these tools, you're probably not going to ask for a lot of functionality that you never use.

449
00:43:42,880 --> 00:43:52,560
So if I take all of the techniques that are associated with each of these tools, add them together, I get something that looks like this.

450
00:43:52,860 --> 00:43:57,320
And again, I'll release the slides so you can zoom in a bit better.

451
00:43:57,320 --> 00:44:01,160
Right now, I'm just more showing sort of the shape of the coloring.

452
00:44:01,280 --> 00:44:06,280
You can see that this adds in activity across a lot of different tactics .

453
00:44:06,640 --> 00:44:10,540
So we've got a bunch of material here.

454
00:44:11,040 --> 00:44:18,460
And if I go back and add my Turla profile back into that, I've now got quite a bit more there.

455
00:44:18,540 --> 00:44:21,100
So blue was what we already had with Turla.

456
00:44:21,100 --> 00:44:25,060
Red is what we just added in with the software that they're using.

457
00:44:25,380 --> 00:44:26,460
And green is the overlap.

458
00:44:26,460 --> 00:44:28,900
So green is what we already had.

459
00:44:29,260 --> 00:44:33,800
And so I pointed out exfiltration was kind of thin in the original profile.

460
00:44:34,620 --> 00:44:39,420
Well, so adding in the software they're using has helped fill that in a bit.

461
00:44:39,420 --> 00:44:45,940
So we've now got something like not just cloud storage, but also exfiltration of a command and control channel.

462
00:44:46,240 --> 00:44:49,800
And so some more options for us to be able to work with too.

463
00:44:52,330 --> 00:44:57,550
So I've still got some of those missing dependencies though, even with the software added in.

464
00:44:57,550 --> 00:45:01,370
So the next thing I'm going to go through is filling the missing dependencies.

465
00:45:01,570 --> 00:45:09,890
I didn't actually find a lot of those in Turla specifically, but there are definitely actors where there are more of these that you'll find.

466
00:45:10,210 --> 00:45:17,710
And so I'm going to take the fairly simple step with the missing dependencies I'd found to simply fill them in.

467
00:45:17,710 --> 00:45:20,810
So, you know, we're trying to stick in the sphere of the adversary.

468
00:45:21,150 --> 00:45:27,810
They probably did these things in order to accomplish those other techniques or after those other techniques.

469
00:45:27,930 --> 00:45:30,250
So I'm going to bring those into our profile.

470
00:45:32,330 --> 00:45:39,650
So that now gives me a relatively well -fleshed out adversary profile.

471
00:45:39,910 --> 00:45:45,990
So this also isn't coloring in quite as much of the attack matrix as it might appear here.

472
00:45:46,430 --> 00:45:53,030
I have only expanded out sub techniques where there are techniques selected in them.

473
00:45:53,110 --> 00:45:58,030
So again, I'm trying to keep the matrix actually fitting on the slide.

474
00:45:58,030 --> 00:46:02,910
But there are quite a few sub techniques that are still tucked in here.

475
00:46:02,910 --> 00:46:11,930
So this is still keeping us to a scoping that is in the spirit of Turla.

476
00:46:12,350 --> 00:46:14,090
So I think we're good here.

477
00:46:14,090 --> 00:46:21,690
I think for Turla itself, this is probably sufficient for us to work with in any scenario we want to create.

478
00:46:21,790 --> 00:46:25,590
But what if I was working in an actor where I couldn't do that?

479
00:46:25,810 --> 00:46:29,510
So the next thing I can do is start examining peer adversaries.

480
00:46:30,670 --> 00:46:35,790
Turla is attributed to be a Russian state actor who likes to steal information.

481
00:46:35,790 --> 00:46:38,990
So who else in the tech do we have that looks like them?

482
00:46:39,090 --> 00:46:43,190
The ones that jump out are APT28 and 29.

483
00:46:43,190 --> 00:46:49,570
These are the two groups that were attributed by the US government to be behind the DNC hacks a couple years ago.

484
00:46:49,570 --> 00:46:51,750
They have been very prolific.

485
00:46:52,110 --> 00:46:55,090
They do a wide range of their own activities .

486
00:46:55,790 --> 00:47:09,830
I could use them like this where I'm just taking every technique from both mashing them together or maybe I just want to use it as a way of seeing what's popular for them.

487
00:47:09,830 --> 00:47:15,990
So the green techniques are where there's overlap between these two adversaries.

488
00:47:18,230 --> 00:47:26,370
Lastly, you know, so if the peers aren't enough, maybe I can just look at what techniques are common out there.

489
00:47:26,450 --> 00:47:37,410
So a number of companies over the past couple years have started publishing annual reports on what attack techniques that they've seen over the past year.

490
00:47:38,170 --> 00:47:46,050
And so looking at a couple of companies' reports on what techniques they saw in 2019, we can start to use those to fill in gaps.

491
00:47:46,750 --> 00:47:49,550
So the first one I'm going to use is red canary.

492
00:47:49,550 --> 00:47:51,090
So they put out a report.

493
00:47:51,090 --> 00:47:56,270
It's actually got top 20 in it, but you can actually read the text on this one.

494
00:47:56,870 --> 00:48:03,910
So it is going through, and it's in order, but it's important to understand, again, what this means.

495
00:48:03,930 --> 00:48:14,710
This is the top 10 techniques that they saw in the places that they have sensing in and compared with their actual detectors.

496
00:48:15,030 --> 00:48:20,470
So it's not necessarily the 10 most popular techniques, it's the 10 most popular techniques they saw.

497
00:48:21,090 --> 00:48:36,890
Another company who put out top 20 techniques this year, I'm again cutting them down to 10 for the slide, but you'll note that the only overlap between these two lists is process injection.

498
00:48:36,950 --> 00:48:50,630
So we may want to combine a couple of these together in order to see where the overlaps are, add their data, but these are giving us some ideas of things that we know at least have been out there in the wild a bunch in the past year.

499
00:48:50,630 --> 00:49:00,030
So it doesn't tell us that Turla did these, it doesn't tell us that 28 or 29 did these, but a bunch of people did them somewhere.

500
00:49:00,470 --> 00:49:08,230
So adding them into our profile may be still sticking to a realistic APT profile.

501
00:49:08,610 --> 00:49:15,430
And again, I wouldn't do this unless I wasn't able to get it directly from the threat intelligence on the actor.

502
00:49:18,410 --> 00:49:19,950
So we've filled in some gaps.

503
00:49:19,950 --> 00:49:22,430
We've got a lot of things colored in now.

504
00:49:22,430 --> 00:49:24,550
We've got our pretty picture.

505
00:49:25,230 --> 00:49:26,810
So what do we do with it?

506
00:49:26,810 --> 00:49:31,650
How do we actually turn this into more of a profile ?

507
00:49:32,130 --> 00:49:36,050
So I talked about a couple gap techniques that I didn't use .

508
00:49:36,070 --> 00:49:46,050
So going back to my Turla profile that is Turla plus the software that appears to be unique to them plus filling in those dependencies .

509
00:49:48,960 --> 00:49:51,480
So I'm going to want to do something like this .

510
00:49:51,520 --> 00:50:00,820
So I've got my techniques, I've got my tactics, and I'm going to want to start to carve down to the techniques I want to actually use.

511
00:50:00,920 --> 00:50:04,120
And those techniques have a flow to them.

512
00:50:04,120 --> 00:50:09,220
So I've talked a teeny bit about dependencies like where one technique is going to require another.

513
00:50:09,260 --> 00:50:15,260
There are often spaces where one tactic is generally going to require another one too.

514
00:50:15,820 --> 00:50:17,580
Attack is not ordered.

515
00:50:18,020 --> 00:50:26,860
Obviously, yes, things off to the left in attack often happen before things to the right in attack, but there is no strict ordering to it.

516
00:50:26,860 --> 00:50:28,520
It is not a kill chain.

517
00:50:29,240 --> 00:50:42,660
And so tactics may happen in different orders , they may not appear at all in the intrusion , but we are going to want to force some ordering on them for operation so that we can actually build up a plan.

518
00:50:43,180 --> 00:50:51,460
So here what I've done is I've started with initial access, so I've got the adversary breaking into the environment.

519
00:50:51,640 --> 00:51:00,960
Followed by execution, so the code actually getting run, so that's also got the most file in here that I filled in using dependencies.

520
00:51:01,480 --> 00:51:12,040
From execution, they are going to be doing both discovery and privilege escalation, so I'm going to be able to do a lot of my discovery without needing extra privileges .

521
00:51:12,040 --> 00:51:17,740
At the same time, I'm going to be building up so that I can do my defensivation credential access and persistence .

522
00:51:18,780 --> 00:51:29,680
Some of Turla's defensivation does require privilege escalation, so they do things like hidden file systems, which is a fairly unusual technique.

523
00:51:31,580 --> 00:51:36,080
And then, you know , so from my credential access, I'll then be able to do lateral movement.

524
00:51:36,160 --> 00:51:48,140
I've got my OS credential dumping, which lets me do my Samba, Windows administrative shares, and the arrow is supposed to loop around from one side to the other, back to execution, and start it all over again.

525
00:51:50,400 --> 00:52:02,340
So, in order to bring this even closer to something I can operate with, the final organizational step I'm going to do is organized technique flow into plan phases.

526
00:52:03,140 --> 00:52:06,320
So, everything I've talked about here is started at initial access.

527
00:52:06,320 --> 00:52:10,500
And so, that's using what's in enterprise attack today.

528
00:52:10,740 --> 00:52:19,460
But obviously, there are some steps that an adversary, as well as an adversary emulator, is going to need to do before they get into the environment.

529
00:52:19,500 --> 00:52:21,340
So, that's this phase one.

530
00:52:21,980 --> 00:52:26,880
And so, you might not be familiar with the tactics, reconnaissance, and resource development.

531
00:52:27,020 --> 00:52:29,900
And that's because they won't be in attack for another few months.

532
00:52:29,900 --> 00:52:31,220
But stay tuned.

533
00:52:31,420 --> 00:52:40,780
We actually are extending attack to match the scope of the cyber kill chain and activities that come before you break into an environment.

534
00:52:41,680 --> 00:52:59,520
Phase two, I've got the adversary operating, setting down their footprint, while I've got this particular adversary doing their collection and exfiltration at the end.

535
00:52:59,520 --> 00:53:02,780
So, they've got the footprint and then they steal the information.

536
00:53:03,440 --> 00:53:07,140
And so, I'm putting these in order so that we can use them for operations.

537
00:53:07,140 --> 00:53:13,180
This isn't going to be perfect, but a lot of these techniques and tactics have required ordering to them.

538
00:53:15,710 --> 00:53:24,710
So, the pieces I'm not really going to cover today, but just a few thoughts on making sure that we're applying Intel as we go through the entire process.

539
00:53:24,750 --> 00:53:28,250
So, we're going to want to develop tools to be able to do this.

540
00:53:28,810 --> 00:53:33,330
You know, want to be able to think, can we do this with COTS free open source?

541
00:53:33,330 --> 00:53:35,970
Are those reasonable for the given actor?

542
00:53:36,290 --> 00:53:40,050
So, in some cases, we may have an actor who's using Empire or Cobalt.

543
00:53:40,050 --> 00:53:43,470
So , the answer to that is fairly obvious.

544
00:53:43,530 --> 00:53:54,950
If we have an actor that's doing nothing but bespoke tool development and using techniques that aren't really supported by much that's out there in public, we may need to do some custom work.

545
00:53:55,010 --> 00:54:00,630
But, regardless, trying to keep those payloads inspired by the APT.

546
00:54:00,990 --> 00:54:06,630
So, you're looking at how they're packing and everything else, trying to stick to that intelligence.

547
00:54:07,030 --> 00:54:13,730
And finally, as you actually operate, obviously, you're going to have to set up all the infrastructure, test it out and get it going.

548
00:54:13,770 --> 00:54:19,990
But once you're emulating the adversary, try to think about the modus operandi that we thought about earlier.

549
00:54:20,110 --> 00:54:23,350
Adversary is trying to steal targeted information.

550
00:54:23,510 --> 00:54:29,130
The goal is not to get into the domain controller.

551
00:54:29,210 --> 00:54:32,950
I saw somebody on Discord that I said hacked the Gibson.

552
00:54:34,210 --> 00:54:38,350
Think about your goal throughout this and where is it you're actually trying to get to.

553
00:54:38,510 --> 00:54:39,990
And then think about pacing.

554
00:54:39,990 --> 00:54:43,630
How is it that the adversary actually operates?

555
00:54:43,630 --> 00:54:48,390
Are they somebody that is slow and methodical in how they're spreading out?

556
00:54:48,390 --> 00:54:50,510
Are they doing a smash and grab?

557
00:54:52,510 --> 00:54:55,010
Think about that as much as possible .

558
00:54:56,190 --> 00:55:02,010
In closing, some of the things I hope to take away from this is pick your adversary wisely.

559
00:55:02,010 --> 00:55:08,550
There are a lot of things you can think about to leverage Intel in the selection of an adversary in the first place.

560
00:55:08,630 --> 00:55:11,150
The Intel in your adversary isn't going to be perfect.

561
00:55:11,150 --> 00:55:15,170
It doesn't matter if you're getting it from attack, original sources, or wherever.

562
00:55:15,470 --> 00:55:18,570
But it is not going to be perfect.

563
00:55:18,710 --> 00:55:23,110
But you can still emulate an adversary with imperfect Intel.

564
00:55:23,110 --> 00:55:29,730
So this is something you can pull off even though you're not going to know absolutely everything about an adversary.

565
00:55:31,730 --> 00:55:40,490
I'll post my slides, but some of the links to resources I used in here between ATT&CK Navigator and ATT&CK itself.

566
00:55:40,490 --> 00:55:47,370
We've put out a couple of emulation plans where we've used a lot of this process and how we've actually done it.

567
00:55:47,610 --> 00:55:58,170
And we've got our own Red Team automated tool, Caldera, that we've actually ported the APT29 emulation plan over to.

568
00:55:59,950 --> 00:56:05,770
And I'm reachable in a couple different venues via ATT&CK, via Twitter, whatever.

569
00:56:06,950 --> 00:56:08,490
And that's it for me.

570
00:56:08,690 --> 00:56:17,610
And so I'm going to be answering questions in Discord after this, but a couple I did catch scroll by that I'll take on now.

571
00:56:17,610 --> 00:56:22,710
So I saw somebody saying, am I talking about the pre-ATT&CK stuff?

572
00:56:22,830 --> 00:56:23,830
Yes.

573
00:56:23,830 --> 00:56:28,670
So we're undergoing a merger right now of the information that's in pre-ATT&CK.

574
00:56:28,670 --> 00:56:38,430
We are refactoring it down to just information that is technical, things that some defenders somewhere can see.

575
00:56:38,430 --> 00:56:42,670
So some of the intelligence planning steps are going to be going away.

576
00:56:42,670 --> 00:56:48,130
And we're refactoring that into two new tactics, reconnaissance and resource development.

577
00:56:48,130 --> 00:56:52,230
So that's something you can expect to see in the next release of pre-ATT&CK.

578
00:56:52,930 --> 00:56:57,010
And with that, I will be answering questions in Discord.

579
00:56:57,010 --> 00:56:58,890
And thank you for attending my talk.

580
00:56:59,250 --> 00:57:00,790
Thank you so much, Adam.

581
00:57:00,810 --> 00:57:06,610
And thank you for supporting not only the community and the DEF CON, but the Red Team Village as well.

582
00:57:06,610 --> 00:57:07,730
Amazing talk.

583
00:57:08,030 --> 00:57:19,610
And for those of you that are watching in Twitch, YouTube, that's where you can get access to the Discord server that Adam was mentioning.

584
00:57:20,210 --> 00:57:24,010
We're going to go on a brief break and the next presentation will start in just a moment