start	end	text
17620	22820	Good evening, Red Team Village. My name is Adam Pennington, and tonight I'm going to
22820	26900	be talking about emulating an adversary with imperfect intelligence.
28720	34380	So before I get into content, I wanted to start off with a little bit about who am I.
35160	41440	So I'm the lead of a project called MITRE ATT&CK. I'm guessing some of you are probably familiar with it.
41440	45000	Several of the other talks in the Red Team Village have been leveraging it.
45280	51400	I've been with MITRE for about 12 years now. If you're not familiar with MITRE, we're a not-for-profit
51400	56680	who primarily runs federally funded research and development centers for the federal government,
56680	63300	and does work in the public interest in things similar to ATT&CK that we're putting out there for people to use.
63300	68780	My principal focus is around threat intelligence and deception, but I've been working with
68780	75000	adversary emulation teams for years on looking at what sorts of intelligence they're pulling together,
75000	79380	and how well the profiles they're building up look like real adversaries.
79740	86160	Most of my time today is spent on MITRE ATT&CK, but I've been an operational defender,
86160	91820	as well as a cyber threat intelligence analyst. I've spent time in multiple security operations centers.
92620	98500	I've been a part of ATT&CK for quite a while, so I've been around since it was a spreadsheet with no ampersand.
98960	105500	ATT&CK originally was an Excel spreadsheet, and I helped gather a lot of the intelligence that we use
105500	110760	to create ATT&CK in the first place. I was at MITRE, I was at Carnegie Mellon for 11 years
110760	117140	trying to collect all the degrees. I'm also a scuba diver. I'm certified for technical diving,
117140	122640	so decompression, rebreather diving. And I've spent time as a professional live sound engineer,
122640	128740	which might explain some of my taste in home audio equipment. I've been around DEF CON for quite a while.
128740	132260	Obviously, first one through home, like all the rest of you.
134240	140740	Some of the key points I wanted to get to today. So I'm going to be looking at a very intelligence-focused
140740	147640	approach to adversary emulation. I want to start off by setting the stage in adversary emulation,
147640	154900	getting into the definition I'm using. Now, I'm not expecting that people here haven't heard of adversary emulation.
154940	159540	I really just want to make sure that we're on the same page using the same definition,
159540	164780	because adversary emulation is something that I've seen mean different things to different people.
164780	171080	I'm going to talk about gathering and extracting the intelligence necessary to do adversary emulation.
171080	176760	Where do we find it? How do we pull it together? And I'm going to talk about some of the flaws in that intel.
176760	182520	So what's wrong with it? How do we recognize some of those imperfections? And then how do we deal with it?
182520	188860	How do we find the gaps in our intel, fill them in, and leverage those to create a complete plan
188860	196300	that we can use to actually emulate an adversary? So I said I was going to start with the definition.
196500	201460	This is the definition of adversary emulation that I'm using for the rest of this talk.
202080	207100	Adversary emulation is a type of red team engagement that mimics a known threat to an organization
207100	213060	by leveraging threat intelligence to influence what actions and behaviors the red team does.
213060	220460	Pretty straightforward. Leveraging threat intel, trying to use that to influence what we're going to do.
221640	226920	So what's different? The big one is that it's driven by threat intelligence.
226920	230360	So it's driven by how the adversary actually looks.
231100	236980	There's a good chance we're going to use that threat intelligence to scope things more than we might in a normal engagement.
236980	239880	So we want things to look like an actual threat.
239880	246520	And so there are things we might not do and take out of our playbooks in order to stick to that.
247500	253820	There's a good chance it follows a constructed scenario in order to stick to what a real adversary looks like.
253820	261780	We might ahead of time create the set of activities, the set of behaviors that we plan to do so that we can keep to that.
262640	270460	And the hope with all of this is that we're getting some idea of how our defenses might fare against a given adversary.
270600	274240	It's still not the real threat. It's still not going to be the same.
274240	278960	But we're hoping to get close enough to start to get some ideas.
280300	284600	So there's a bunch of new challenges that emulation brings in around intelligence.
284800	288660	And I'm going to be covering several of these in my talk tonight.
289480	293300	The first and most basic one, the need for intelligence in the first place.
293320	296860	So needing to know what an adversary looks like.
297660	303340	We might not have enough intelligence out there on an adversary that's in a form we can use.
303340	311360	It might not describe the sorts of activities that we need as an adversary emulation team to go out and look like the adversary.
312360	316960	The adversary we want to emulate, there may just not be enough intel on.
316960	318680	We may not know about them.
318800	323460	And so we might need to fill in the picture a little bit more to be able to really emulate them.
324260	327280	And finally, you know, we're pulling all this intel.
327300	330780	We need to be able to turn it into a workable scenario.
332320	341300	So my team has an adversary emulation process that we've used in several other places in presentations, as well as documents.
341300	348000	But it originally comes from a presentation a few years ago by then ATT&CK team members, Katie Nichols and Cody Thomas.
348740	353620	And the process we work from is to first gather threat intelligence.
353620	362240	So figure out who your adversaries are and start to pull in all the information you can find on the adversary you picked to emulate.
363840	366120	Extract techniques from that intelligence.
366120	374960	So start to look at what the behaviors are in that intelligence, so that we can pull them together into a plan to be able to look like those behaviors.
377240	379560	Analyze and organize that intelligence.
379900	390540	So taking those behaviors, looking at what's there, what isn't there, filling in any gaps, and then pulling that together into a plan we can actually use.
391320	392920	Develop tools.
393280	398640	So we need malware utilities and other things to be able to operate with.
398980	401940	And then finally, do the emulation.
404590	412750	So I'm a threat intel guy. I'm going to cover the most threat intel focused pieces of this process.
412750	417530	And so what I'm going to focus on today is the first three steps in this process.
419770	423270	So start with the first step, gather threat intelligence.
423870	430250	So we're going to need to choose an adversary and then pull in information that we can find about them.
430590	434870	So before we can start gathering data, we need to identify the adversary.
435350	446950	I'll cover two ways to do this in looking at gaps that we're hoping to assess in our environment and considering who is targeting us in the first place.
446950	452110	I'll then go through a couple of processes for gathering data on that adversary.
452330	460330	So pulling in information on things that they do after they break into environments, that's likely to be most of the space of our engagement.
460830	466590	And beyond behaviors, there are some things to think about beyond just what techniques they do.
466610	472010	So what tools are adversaries using? What other groups are associated with them?
472010	476690	So what other names might we have that are describing some of the same activity?
476950	480030	As well as an adversary's campaigns.
480250	487830	So a series of intrusions that are happening in a time period that are attributed to the same actor.
488350	491630	And on top of all this, we probably want to think about the timeframe.
491870	497790	Some of the actors we might want to emulate might have been in this business a very long time.
497790	504710	So I'll be using an actor later, who is thought to have been around since at least 2004.
504710	510010	What they looked like in 2004 is probably a little bit different than what they look like today.
513220	523820	So there are a lot of ways that you can find lists of adversaries, you know, information on starting points for who it is you want to emulate.
524320	529520	I've got my biases, I'm going to leverage attack, but you don't have to.
529520	535260	But a decent number of red teams we have seen using it for adversary emulation.
535260	538500	So some other options instead of attack.
538560	547500	If you have an internal threat intelligence team that is tracking on groups that are, you know, hitting your own organization,
547500	550920	that might be your best source of threat intelligence.
550920	555340	So they know about the threats that matter most to your organization.
555460	561420	They may have the best picture of the techniques that are really relevant to you.
561420	564260	So that could be a really good place to start.
564260	570580	There are people that might be able to sell this information to you.
570580	575020	So there are commercial threat intelligence providers where, you know, for a fee,
575020	579240	you can get information on different adversaries you might be interested in.
579960	582480	Or you can go to the same well that we do.
582480	587500	So everything that we're pulling into attack is coming from open source threat intelligence reporting.
587880	591560	And so you can go out and look at some of the same sorts of reports we do ourselves.
592940	595700	Because I'm going to be using ATT&CK for the rest of this talk,
595700	602260	I'm just going to quickly get into a few of the specific aspects of it that I'm going to be leveraging here.
602340	607220	So I'm not going to get into, you know, the defensive use cases, things like that.
607360	613080	Just sort of the basics of the framework structure and then the groups information that we're going to be pulling from it.
614640	617980	So I think probably a lot of you have already heard of ATT&CK.
617980	622230	But at its core, ATT&CK is a knowledge base of adversary behaviors.
622580	628640	It's like an encyclopedia of things that real actors have been seen to do in the wild.
628740	636080	So not just things a red team has done, not just theoretical, but it's actual adversary behaviors.
636300	640440	It's freely available. Everything I'm going to be talking about today,
640440	644500	every resource I'm using is out there for free.
644500	647280	And if it's code is open source.
648140	650440	So let's talk about structural here.
650440	654980	This is the view most people use of ATT&CK. It's what we call the matrix.
656260	661260	It's a layout of different activities that adversaries do.
661300	666020	The way it's organized is across the top here, we have what we call tactics.
666120	668760	These are the adversary's broad technical goals.
668760	671260	So it's something like initial access.
671640	677140	The adversary is trying to get into my network or exfiltration.
677140	680680	The adversary is sending stuff that they've stolen out of my environment.
680680	685620	Or something a little different like impact, where an adversary is trying to cause destruction
685620	689200	or disruption to systems or my environment.
690020	694180	Under each of these tactics, we have what we call techniques.
694280	697860	And those are how the technical goals are achieved.
698400	701260	And these are sort of the basic unit of ATT&CK.
701260	703500	I've seen a bunch of techniques.
703500	708020	So Cirio was just using several technique IDs in her talk.
708280	712320	And so these are getting down to more specific ways.
712320	715200	So instead of initial access, we now have something like phishing.
715200	717960	The adversary is sending a malicious email.
718500	721120	That's kind of an exciting talk for me,
721120	725000	because this is the first time I've given a talk in years
725000	728480	that I've been able to fit the matrix on a single slide.
728540	732420	So we recently did a fairly big refactoring of ATT&CK
732420	735180	and going from just tactics and techniques
735180	739080	to tactics, techniques, and sub-techniques.
739080	743720	So there's now another layer of abstraction under a lot of the techniques.
744640	747660	Sub-techniques are just more specific techniques.
747660	751020	So instead of phishing, we have something like spear phishing attachment
751020	753000	or spear phishing link.
753000	755600	So it's, again, getting more specific.
755780	760820	These sub-techniques have all the same properties behind them as techniques.
760820	764620	They have all the same mitigations, detections, everything else.
764640	768780	It's just a deeper level of specificity, and they have a parent technique.
770060	774340	Finally, getting all the way down to detail, we've got procedures.
774460	779340	These are specific adversary implementations of techniques and sub-techniques.
779820	781460	So instead of spear phishing attachment,
781460	783700	we might have the APT12 that sent emails
783700	787200	with malicious office documents and PDFs attached.
788400	792060	Okay, our goal was to find out stuff about groups.
792360	795440	Something else that ATT&CK has is profiles
795860	799400	on a number of different threat actors, over 100 of them.
800240	802560	This is what a group page looks like.
802560	806480	We've got a brief text description of the group itself,
806480	809060	some metadata associated with it.
809060	812500	We have what we call associated group descriptions.
813340	815900	Different companies, different threat intelligence providers
816440	821760	use different names to describe the same or closely related groups.
823040	824220	And this is natural.
824220	827160	These organizations have their own definitions of these groups
827160	829080	that may not be quite the same.
829080	830960	That's one of the reasons we call it associated groups
830960	833900	instead of what we used to call it, which is aliases.
835440	837620	We keep track of what techniques are used.
837620	841180	So we've taken open source threat intelligence reporting,
841180	843800	gone through, and figured out what those reports say
843800	845340	that the adversary has been doing.
847700	850980	Similar to our groups pages, we also have software pages.
851220	855780	Those keep track of different pieces of software
855780	857860	the adversary is using, everything from utilities
857860	860020	to things that they've custom written,
860680	862640	as well as all of the techniques
862640	866840	that that particular piece of software is able to do.
867460	869600	And finally, there's references for all of it.
869600	871240	You can go back, you can check our work,
871240	873040	you can see the original references,
873520	875880	and make sure that you believe what we say about it.
875900	883130	People use ATT&CK for a lot of different things.
883130	885830	I'm only touching on adversary emulation tonight.
886250	888970	It's kind of a good use case for ATT&CK, though.
888970	892210	So it turns out that adversary emulation
892210	894970	is what ATT&CK was created for in the first place.
896970	899150	The reason we originally created ATT&CK
899150	901750	was that we had a red team
902270	906030	who wanted to look like some specific actors,
906030	908750	wanted to create playbooks, create plans,
909550	911490	operate, and then wanted to be able
911490	912810	to compare notes with the blue team
912810	914850	and see if they saw the same things
914850	916570	that the adversary had done.
918050	919010	Okay.
920570	922770	So if I want to actually start
922770	925470	to pick out an actor from all this set,
925470	927070	you've got 100 actors.
927150	931070	So we can start by looking at how specific actors
931070	932510	align with some of the gaps
932510	934950	that we think we might have in our defenses.
936010	938650	So this is coming from APT28.
939850	941510	Everything in blue here
942690	945370	is techniques that we've identified
945370	948890	from multiple open-source threat intelligence reports.
948890	951330	It's not using any commercial or government reporting.
951330	954010	It's just things that you also have access to.
954230	955990	I'm going to be showing a bunch of diagrams
955990	957430	that look like this.
957430	959850	This is basically the same matrix layout
959850	962450	I showed in the introduction a second ago.
962450	964210	I do have a number of the sub-techniques
964210	967510	expanded out to show a bit more of the detail.
968310	970730	But you're probably not going to be able to read the labels
970730	973350	at least over on Twitch or YouTube.
974010	975870	But all these diagrams I'm creating
975870	977290	are using ATT&CK Navigator,
977290	979350	which is an open-source tool we provided.
979590	982250	That's a URL to actually work with it yourself.
982250	984030	And I'll release the slides for this
984030	985190	right after the talk
985190	988630	and work on getting the navigator layers out I'm using.
989430	990890	So if we're looking at the techniques
990890	993970	that APT28 has used,
994330	996170	we can then compare that with
997510	999170	our own defenses.
999170	1003330	So if we take the same ATT&CK Navigator,
1003330	1005390	we lay out where we think
1005390	1006930	that our defenses can catch
1006930	1008690	or not catch an adversary.
1008690	1011210	So what's in red here is notional gaps
1011210	1013670	in the defenses for an organization.
1013670	1017710	So what I think that I can't detect today.
1018450	1019110	Okay?
1019210	1022130	So if I take that adversary,
1022130	1024170	I add the gaps to it,
1024170	1025710	I can then create something
1025710	1027730	that looks like this.
1028090	1033310	So I now have the APT28 in blue,
1033310	1035010	our gaps in red,
1035010	1037630	and the green here is, you know,
1037630	1039890	where we think we might have gaps.
1040010	1042050	So again, without the slides,
1042050	1043210	probably not going to be able to see
1043210	1045370	which individual techniques are highlighted.
1045390	1046810	But we can see, you know,
1046810	1049370	maybe APT28 isn't the best match for us.
1049370	1052570	You know, they've only got maybe 10 techniques
1052570	1055010	that overlap with things that we think are gaps.
1055010	1056290	So, okay.
1056450	1058350	What else can we look for?
1060250	1061990	We can also look at adversaries
1061990	1063490	who are targeting us.
1063490	1065550	So especially if we've got our own internal
1065550	1068130	threat intelligence team to help us,
1068610	1071510	they may be able to help us prioritize here
1071510	1073470	because hopefully they know
1073930	1076410	who it is who's been coming after us.
1076530	1078330	And again, there's a couple different ways
1078330	1080950	that we can prioritize based on this.
1083310	1084850	So we can start with an adversary
1084850	1086570	who targets us regularly.
1086890	1089250	Now, maybe we've got some actor
1089850	1092650	who the first Monday of every month,
1092650	1095390	like clockwork, sends us a spearfish.
1096630	1098910	You know, maybe they're not the best.
1098910	1100430	We don't, you know, maybe that we think
1100430	1102650	that our defenses are pretty good about them,
1102650	1104830	but they may be of a lot of interest to us
1104830	1107650	just because they're trying so regularly.
1107650	1110470	They're definitely a persistent threat.
1111830	1112890	We can look at adversaries
1112890	1114630	who have targeted others like us.
1114850	1115890	If we've got some actor
1115890	1117750	who's tried to break into
1117750	1119790	every other peer in our industry
1120790	1123470	and has succeeded in places,
1123470	1125050	well, we're probably somewhere
1125050	1126290	on their priority list.
1126290	1128690	We're in their priority intelligence requirements
1128690	1131630	for who they should be breaking into.
1131810	1132810	So we might want to understand
1132810	1135890	how it is that we might face against them.
1136510	1137850	Finally, you might want to pick
1137850	1140850	an adversary who doesn't target us very much
1140850	1143310	or we've never actually seen,
1143310	1145830	but they might, but has a high skill level.
1145830	1148210	You know, the actor who keeps us up at night
1148210	1152110	because we think that if they came after us,
1152110	1153690	they'd probably succeed.
1153690	1155870	You know, they've got the high skill set.
1156930	1158690	So the adversary I'm leveraging today
1158690	1159930	for a lot of organizations
1159930	1162650	probably more fits into this last group.
1163190	1165830	The keep you up at night adversary.
1167310	1169010	So the adversary I'm going to leverage
1169010	1171610	for the rest of this talk is Turla.
1172730	1177090	Turla has been attributed to Russian state activity.
1177630	1179790	They've been around for quite a while.
1179790	1183010	They've been seen since at least 2004.
1183570	1185010	I kind of like this group
1185010	1186270	and that they're cross-platform
1186270	1189590	so they don't just stick to Windows systems,
1189590	1192830	but they've been known to go after macOS and Linux.
1193190	1195010	And they use some interesting techniques
1195010	1198050	that we don't see a lot of actors use.
1198530	1200690	And so everything in ATT&CK has been seen somewhere
1200690	1203150	by some actor, but there are techniques
1203150	1205610	that there are really only, you know,
1205750	1207290	a certain number of high-end adversaries
1207290	1208810	that are getting into them.
1210750	1212690	So we've picked our actor.
1213190	1215650	It's time to start gathering data on them.
1215650	1220110	So if I'm not using ATT&CK as my data source,
1220110	1221670	I'm going to want to probably go out there
1221670	1223290	and start gathering intel.
1223510	1225550	And so, you know, I can start looking
1225550	1227870	through open source publicly available
1227870	1229530	threat intelligence reports.
1229530	1232770	There are quite a lot of them out there these days.
1232770	1234870	There really weren't that many when ATT&CK started,
1234870	1237870	but we do have quite a wealth out there
1237870	1240130	of reporting now.
1241110	1243650	Or I can leverage the version
1243650	1246470	of a lot of these techniques that's in ATT&CK.
1246590	1250270	So we're going through some of these exact same reports,
1250270	1252730	trying to find what behaviors and techniques
1252730	1255230	are in there, and then we're putting out
1255230	1257450	that same information in ATT&CK.
1257450	1259510	So it's information you already have access to
1259530	1262770	just in a digested form.
1265030	1267110	So we've got this intel.
1267110	1271150	If we're going from our own sources,
1271150	1274090	if we're bringing in open source threat intelligence
1274090	1276810	reporting ourselves, we're going to need to go
1276810	1280290	through a process of extracting techniques.
1280670	1283490	Internally, we tend to call this mapping.
1283630	1286130	So the quick process that you're going to go through
1286130	1288950	in these reports is something along the lines
1288950	1292970	of first finding the behaviors in the report.
1292970	1296150	So figuring out what is it that are activities
1296150	1298650	that the adversary did, the things that we're going
1298650	1301730	to want to later be doing ourselves.
1302450	1304130	Figure out the tactics.
1304130	1306070	So it takes a little bit of experience
1306070	1307890	in understanding what you're reading
1307890	1309490	with adversary behavior.
1309730	1311290	But what is the adversary's goal
1311290	1313670	for each of those behaviors?
1314650	1316150	Move down to more specifics.
1316150	1318610	Move down those columns of ATT&CK.
1318950	1321910	Go from the tactic to a technique,
1321910	1325770	or even better, all the way down into a sub-technique.
1326630	1328530	And I recommend doing this as a team.
1328530	1330170	You know, everyone has their own biases
1330170	1332830	and preconceptions in how they read intel,
1332830	1335190	something I'll talk about a bit more in a minute.
1335410	1337870	But comparing notes can be super effective
1337870	1342030	for canceling out different issues you might have.
1342550	1344270	So I'm only going to be briefly talking
1344270	1345950	about how to do this, but my friend
1345950	1347850	and former ATT&CK teammate Katie Nichols
1348950	1350210	released training earlier this year
1350210	1352970	on how to do this mapping in much more detail.
1353430	1356010	The URL for it is available in the slides.
1356010	1358070	Again, I'll release the slides later.
1358290	1359550	And it's completely free.
1359550	1361910	The videos for it are up on YouTube.
1364980	1368700	So this process of mapping ATT&CK techniques.
1368760	1370340	You know, this little snippet of reporting
1370340	1372600	has quite a few of them in it
1372600	1374800	in the way that we would interpret
1374800	1377640	an open-source threat intelligence report.
1377640	1380020	So first we're going through,
1380020	1382680	we're identifying each of the behaviors.
1382680	1384720	There's the highlighted in yellow bits
1384720	1387080	where they're either describing something
1387080	1388840	an adversary did or, you know,
1388840	1390910	they're using a tool where it's relatively clear
1391360	1394960	what the behavior is that they're using it for.
1395840	1397760	We're going through, we're getting down
1397760	1400620	into tactics and getting down into techniques.
1400620	1402120	So instead of create batch scripts,
1402120	1403700	we're interpreting that into ATT&CK
1403700	1408200	for our Windows command shell, T10-59-003.
1408560	1410600	Instead of Windows run key,
1410600	1413540	we now have registry run keys, startup folder.
1413540	1416340	So T15-74-001.
1416440	1418660	And we're just going through the entire document,
1418660	1421200	repeating this process over and over again,
1421200	1424460	and pulling out the full set of techniques
1424460	1426200	that we're able to find.
1429300	1432680	So once you've pulled out all those techniques,
1432680	1434840	you need to structure your intel.
1434840	1438760	And so I'm, you know, again, using the ATT&CK Navigator.
1438920	1442000	This is the full set of Turla techniques
1442580	1444920	that I've extracted from ATT&CK,
1444920	1447580	pulled out of their page that's in there.
1447660	1449520	Again, everything that's here is only based
1449520	1451560	on open source threat intelligence reporting.
1451560	1454620	So it has the limitations of that.
1455440	1458800	And so that's, this is the sum total
1458800	1461520	of all of those threat intelligence reports
1461520	1462980	we mapped with Turla.
1465780	1468860	Okay, so we've got a pile of intel.
1469260	1471280	What do we actually do with it?
1471280	1472960	You know, is this any good?
1472960	1475440	Do we have a picture of the adversary yet?
1475700	1477840	And so we're going to need to go through some more work
1478780	1481080	to figure out what we've got,
1481080	1483320	you know, what the adversary is trying to do.
1483440	1485540	And do we even have enough of a picture
1485540	1487560	to be able to make a plan here?
1488260	1490240	So the first two steps I'm going to work through
1490240	1493720	are establishing the adversary's goal.
1493720	1496420	So what is it that they're trying to do?
1496420	1499180	Understand their modus operandi a little bit better
1499680	1504960	in terms of what we're later going to want to operate like.
1505080	1506600	And an important point to remember
1506600	1511440	is that this goal is probably not technical.
1511720	1514160	The adversary is probably not focused
1514160	1515860	on getting domain administrator
1515860	1518200	or stealing a particular password.
1518200	1520420	They're probably interested in fulfilling
1520420	1523480	an intelligence requirement.
1523480	1525720	You know, they have some piece of information
1526300	1528800	that they want to steal from your environment.
1530400	1533480	So the goal is likely to be something more like data theft
1533980	1535600	or to stop you from operating
1536540	1538680	than, you know, hack the Gibson
1539300	1541800	or, you know, brick a particular computer.
1543220	1544940	After you've determined what that goal is,
1544940	1546540	you need to look at what the gaps are
1546540	1549900	between an adversary getting in and reaching that goal.
1550420	1552060	What is it I don't know about the middle
1552060	1556140	that would let me look like that adversary?
1557720	1560620	So to go through those first two steps of it,
1560620	1562900	so establishing an adversary goal.
1563420	1565560	You could take a look at which tactics
1566100	1567600	the adversary is using.
1567600	1570800	So we can see that TERLA has some stuff
1570800	1572480	in collection and exfiltration.
1572480	1574300	They've got nothing in impact.
1574300	1577380	But instead, I'm going to go back to the original reporting.
1578260	1581920	So this is a Kaspersky report on TERLA.
1582120	1584600	And so they talk about how TERLA went through,
1584600	1586540	they're searching for emails.
1586540	1588180	They were specifically looking for emails
1588180	1590380	related to NATO energy dialogue.
1590380	1592660	And then shortly afterwards, the report talks about them
1592660	1594140	exfiling the information.
1594140	1596420	So, okay, they're stealing information
1596420	1598820	around particular topics.
1599900	1602120	Similarly, an ESET report.
1602120	1603420	They're going through,
1603420	1607000	they're getting into the victim's Microsoft SQL database.
1607000	1608800	Pulling documents out of it,
1608800	1610040	and again, exfiling,
1610040	1612740	and taking specific information.
1613580	1615720	So we've got a relatively clear picture,
1615720	1617060	and we can look at other reports
1617060	1618660	and see the same thing,
1618660	1620840	where over and over and over again,
1620840	1623400	TERLA is stealing information.
1623400	1625240	So it looks like they're focused on
1625780	1629200	theft of information and exfiltration.
1632980	1636480	So I said that we need to then
1636480	1640240	examine gaps between access and goal.
1640760	1643080	I'm going to cover for a few minutes first,
1643080	1644740	why are there gaps?
1644880	1646940	So we've got this intel,
1646940	1649180	it's an attack, it's all out there.
1649260	1651520	Why isn't that enough for us
1651520	1653640	to be able to work with?
1654500	1655780	Open source intelligence
1655780	1658820	likely doesn't paint a complete picture
1658820	1660300	of an adversary.
1660640	1662940	Frankly, commercial and closed intelligence
1662940	1664680	probably doesn't either.
1664680	1666460	So there are biases
1666480	1668720	in the information, in how it's gathered,
1668720	1670340	and what information is gathered,
1670340	1674280	as well as nobody has perfect visibility.
1674420	1677440	It's very rare that you have intelligence
1677440	1680820	that tells you everything an adversary does
1680820	1682440	from the point when a victim clicks
1682440	1684340	to the point when they actually
1684340	1686260	are stealing information.
1687840	1689920	And by putting it into attack,
1689920	1691240	we add our own problems.
1691240	1692900	So group intelligence in attack
1693480	1695940	is subject to our own biases,
1695940	1697400	and then we're very similar.
1698080	1699500	And, you know, we're adding on
1699500	1700780	to the biases that are coming
1700780	1702720	from this open source intelligence.
1702720	1704580	So some of that is from how we map
1704580	1706020	from these intelligence reports
1706020	1708740	and what it is we actually choose to come in.
1709680	1712980	Now, bias is usually a negative word
1712980	1713960	in the English language.
1713960	1715280	It sounds bad, you know,
1715280	1718240	sounds like we may not like
1718240	1719240	certain intelligence,
1719240	1720760	but in threat intelligence,
1720760	1722560	we accept that all sources
1726160	1726720	have certain information.
1726720	1728520	And so we work to understand those
1728520	1729460	and what they are
1729460	1731660	so that we can account for them.
1734220	1736640	So some of why we have
1736640	1739000	these biases in our reporting.
1742280	1743820	Any reporting source
1743820	1746440	is going to have a visibility bias.
1747040	1748700	There are only certain types
1748700	1750400	of information that a given
1751160	1752700	source is going to have,
1752700	1753740	and they might only have
1753740	1755040	certain types of sensors.
1755040	1756680	An incident response firm may only
1759340	1760440	have whatever sensors were in the
1760440	1762300	environment at the time.
1763000	1764780	Whereas things that can only be
1765240	1766880	seen in real time,
1766880	1768420	so maybe decoded command and control
1768420	1770860	traffic or registry monitoring,
1770860	1772060	other things that don't really leave
1772060	1773680	much of a forensic trace,
1773680	1776660	might not be in their visibility.
1778300	1780640	So there's novelty bias.
1780840	1783680	So I'm kind of a beer snob.
1783680	1786420	In normal pre-COVID times,
1786420	1789180	I walk into a good beer bar,
1789340	1790660	I look at the taps that are there,
1791260	1792400	and I see
1793240	1794640	a bunch of stuff I've had before.
1794640	1796520	It's been on my untapped list for
1797240	1799720	years now, and I see the one tap
1799720	1801520	that was the thing I've wanted to try
1801520	1802660	for a while.
1803160	1805320	Reporting can be a lot like that.
1805320	1807740	So I've got my reports,
1807740	1808700	I've got my
1809440	1811640	APT 1-8 report where
1811640	1813400	I've got a new actor,
1813400	1814500	we've never seen him before,
1814500	1816280	they're doing something new,
1816280	1818100	and I've got my APT Elite report.
1818100	1819620	I'm going to put out the one
1820040	1821740	that's brand new,
1821740	1823860	is more likely to make a headline.
1824200	1826300	And so our intel is biased by this,
1826300	1827860	where some reports are more likely
1827860	1829460	to come out than others.
1831640	1833240	As people are creating
1833240	1834880	the intelligence in the first place,
1834880	1836780	they have availability bias.
1836980	1839500	Availability bias is a
1839500	1841460	classic cognitive bias.
1841460	1843640	I have some things that I am
1843640	1844960	more familiar with,
1844960	1846940	that I'm more used to seeing,
1846940	1848920	that I'm more likely to recognize.
1849140	1850980	So somebody who's done a ton
1850980	1852520	of incident response,
1852520	1854660	they've seen PowerShell over
1854660	1856440	and over again, they might be more
1856440	1858300	likely to notice the PowerShell activity
1858740	1860440	and not notice that,
1860440	1862560	say the adversary got into the
1862560	1864260	BIOS over here or something
1864720	1866220	super novel.
1867940	1869400	Victim bias.
1869400	1871700	So there are some victims where
1871700	1873800	there is more likely for reporting
1873800	1875320	to come out than others.
1875680	1877780	So there are only
1877780	1879040	certain firms that can afford
1879500	1880960	some of the companies that are
1880960	1882120	putting out a lot of this threat
1882120	1883720	intelligence reporting.
1883960	1885620	Some victims are also in industries
1885620	1886840	where they're a lot more likely
1886840	1889660	to allow reports to come out.
1889800	1891660	There may be issues with regulators
1891660	1893460	if there's any information about
1893460	1894980	them having been hacked.
1895400	1896800	And so who the victim is,
1896800	1898560	is going to matter a lot for if
1898560	1900200	we ever hear about it.
1903800	1904400	Victim bias.
1904600	1907000	So some sources write more
1907000	1908340	reports than others.
1908940	1910500	If, you know, one company
1911120	1912680	is writing, you know,
1912680	1914700	dozens and dozens of reports that
1914700	1915440	all have
1916620	1918100	active behaviors in them and
1918100	1919560	another company is just putting
1919560	1921540	out a couple,
1922820	1923780	we're going to have more
1923780	1924860	information to work with from
1924860	1925620	another.
1926740	1928640	And so I said we compound it.
1928680	1930720	And so we add our own biases to
1930720	1931820	these and the types of sources
1931820	1932980	we select.
1933120	1933940	And so a lot of the stuff I've
1933940	1935460	been talking about is in terms
1935460	1937620	of information from security
1937620	1940140	vendors and threat
1940140	1941720	intelligence firms.
1942200	1944100	So 92% of the reports that
1944100	1945720	we have in ATT&CK,
1945720	1947060	as a point when I made this
1947060	1949020	slide, are coming from security
1949020	1949980	vendors.
1950060	1951560	3% are coming from government
1951560	1952260	reports.
1952260	1953520	These are things like public
1953520	1955500	indictments and other public
1955500	1957380	available government reports.
1957520	1958840	And a few are coming from press
1958840	1959540	reports.
1959800	1962460	Sometimes there's an article
1962460	1964060	in Wired or the Register that
1964060	1966080	describes really good, unique
1966080	1967940	adversary activity.
1968860	1970320	We have our own availability
1970320	1971500	bias.
1971540	1973200	So in that mapping process of
1973200	1975200	going through reports, we've
1975200	1976980	reduced the number of techniques
1976980	1978940	in ATT&CK a little bit recently,
1978940	1981100	but there's still over 160 of
1981100	1981960	them.
1982240	1983920	And so it's hard
1983920	1985440	for us to keep a working set
1985440	1988140	of all of those techniques.
1988140	1989340	And so we've got the techniques
1989340	1990920	that we remember in there and
1990920	1992860	are at the tip of our tongue.
1992860	1994220	And then we have the techniques
1994800	1997080	in ATT&CK, like hidden file
1997080	1999240	system that we almost never
1999240	2001080	see in reporting.
2002340	2004600	We have our own novelty bias.
2004600	2006360	So we've got, you know,
2006360	2007860	dozens and dozens of reports
2007860	2010560	on FuzzyDeck using PowerShell.
2010560	2012300	But we've got this one brand
2012300	2014340	new report on APT Elite using
2014340	2016240	transmitted data manipulation,
2016400	2017620	a fairly new technique.
2018140	2019580	We're probably going to go
2019580	2021620	for the shiny new report.
2023940	2024880	And so if you're using
2024880	2026520	Intel from ATT&CK, there's a
2026520	2028190	couple of other caveats to
2028660	2031100	realize.
2031100	2033020	So our reporting that we've
2033020	2034640	got in there on a given group
2034640	2037140	page is from all different
2037140	2039780	time periods combined.
2039780	2041240	There's some reasons why
2041240	2043180	we do this.
2043180	2043920	Reporting frequently doesn't
2043920	2045620	say when the activity happened.
2045620	2047600	So a report, we might
2047600	2048720	have a date on the report
2048720	2052040	itself, not always, and a
2052040	2054000	pox on people that put out
2054000	2055140	threat intelligence reports
2055140	2056380	about dates.
2056380	2058400	But we don't even know
2058400	2059420	necessarily when the intrusion
2059420	2061360	happened. And I've seen
2061360	2062460	reporting where I know the
2062460	2063580	intrusion that they were
2063580	2064640	talking about was four or
2064640	2066220	five years old, where it
2066220	2067080	sounded like they were
2067080	2068360	talking about something
2069560	2070140	recent.
2070140	2071200	Some reports might only talk
2071200	2071520	about a small range of
2071520	2072900	activity. So some why we
2072900	2074260	end up adding stuff together
2074260	2076400	is so that we can talk
2076400	2078100	enough about a single
2078100	2079800	actor to paint a picture.
2079800	2080860	So if I only have one
2080860	2082440	report with, you know, ten
2082440	2084100	techniques in it, it's
2084100	2085500	probably not telling me the
2085500	2086740	range of activity that an
2086740	2088080	actor can do.
2089740	2091520	Our group pages only
2091520	2092700	include behaviors that are
2092700	2094360	directly tied to actor
2094360	2095460	activity.
2095540	2096880	So our standards for what
2096880	2097800	we're adding into those
2097800	2099720	pages is that the reporting
2099720	2101120	says that the actor did
2101120	2101720	it.
2102140	2103160	And so that doesn't include
2103160	2104440	behaviors of software that
2104440	2105560	adversaries use.
2105560	2108680	So if there is a malware
2108680	2110180	analysis report out there
2110180	2111400	that we're putting in attack,
2111400	2112460	that's going on those
2112460	2113620	software pages.
2113820	2115540	And we're not including that
2115540	2116580	into the activity of the
2116580	2117880	given adversary.
2117960	2119120	And finally, the reporting
2119120	2120020	we're using doesn't always
2120020	2121600	agree on attribution.
2121940	2123240	And so we're sometimes
2123240	2125020	left trying to figure out
2125020	2126360	what the heck group we
2126360	2127360	should be even putting this
2127360	2127960	into.
2127960	2129480	And hopefully in most cases
2129480	2130460	it's accurate.
2132000	2133860	So that sounds awful.
2133860	2134720	You know, so what do we
2134720	2135600	what do we do about it?
2135600	2136500	I've talked about this as
2136500	2137840	our source of intel.
2137840	2138660	And now I've talked about
2138660	2140580	all these problems with it.
2140800	2142320	So the important part
2142320	2143680	is to understand that
2143680	2145200	there are these types
2145200	2146540	of limitations and biases
2146540	2147900	in the intel that we're
2147900	2149000	using to do this
2149520	2150480	emulation.
2151280	2152600	Once we know that there
2152600	2153700	are these limitations and
2153700	2154740	gaps are there,
2154740	2156400	we can start to determine
2156400	2157740	where the gaps are in our
2157740	2159340	specific intelligence.
2159680	2161100	And so we don't
2161100	2162140	just throw up our hands
2162140	2163780	and say, well, I don't
2163780	2165080	know anything.
2165100	2166440	I'm just going back to
2166440	2168240	normal red teaming.
2168240	2169240	We need to account for
2169240	2170520	these gaps and
2171320	2172780	fill them in as we build
2172780	2173740	our adversary emulation
2173740	2174900	plan.
2177320	2178380	That was a long aside
2178760	2180100	away from Turla.
2180140	2181960	But let's start to look
2181960	2183660	at how we might spot
2183660	2185400	gaps in our
2185400	2186260	specific adversary
2186260	2187380	picture.
2187740	2189380	So taking Turla as
2189380	2190960	an example, how
2190960	2192280	might we see some evidence
2192280	2193700	that our information on
2193700	2195360	Turla isn't perfect?
2197060	2197900	I can first look for
2197900	2199320	missing dependencies.
2200000	2201220	So my colleague
2201220	2202680	Amy Applebaum wrote a
2202680	2204000	blog post a couple
2204000	2206140	years back on
2206140	2207840	trying to find related
2207840	2209220	attack techniques.
2209220	2210960	So both dependencies
2210960	2212280	where in order to
2212280	2213440	do one technique, you
2213440	2214600	might need this other
2214600	2216400	technique first, or
2216400	2217520	techniques that are
2217520	2218840	very often seen
2218840	2219160	together.
2220060	2221620	And so that can be a
2221620	2223120	useful source for
2223120	2224480	doing this.
2224480	2225300	But I'm going to zoom
2225300	2226740	in on a couple
2226740	2228660	places in our
2228660	2230340	profile of Turla.
2230340	2230980	So let's look at
2230980	2231680	initial access.
2231680	2233140	So we've got some
2233140	2234400	pretty simple
2234400	2235280	techniques here
2237140	2238120	that drive by
2238120	2238960	compromise.
2238960	2239980	We have fishing,
2239980	2241400	spearfishing attachment,
2241400	2243880	fishing, spearfishing
2243880	2244420	link.
2244420	2246620	Okay, relatively
2246620	2247240	germane.
2247240	2249140	But if they're doing
2247160	2248160	each of these things,
2249140	2249720	these successful
2249720	2251540	intrusions, there
2251540	2252600	are actions that
2252600	2253820	need to follow that
2253820	2255460	for the intrusion
2255460	2255780	to have been
2255780	2256660	successful as it
2256660	2257640	was.
2257940	2259140	So I take a look
2259140	2260780	at our execution
2260780	2262060	for Turla.
2262340	2263780	And I look at,
2263780	2264100	you know, I've got
2264100	2264860	user execution
2264860	2265860	malicious link.
2265860	2267160	So they sent a
2267160	2268360	malicious spearfishing
2268360	2268540	link.
2268540	2270080	We clicked on it.
2270080	2271240	Okay.
2271240	2272260	They sent us a
2272260	2274500	spearfishing
2274500	2275000	attachment.
2275000	2276180	I don't actually
2276180	2277160	have an execution
2277160	2279120	technique for that.
2277140	2278140	So there's
2279120	2280360	clearly a gap here.
2280800	2281420	It's something we
2281420	2282520	probably need to fix.
2282520	2283980	But it,
2285080	2286340	there's, I would expect
2286340	2287300	there to be here
2287300	2288600	either user
2288600	2289540	execution malicious
2289540	2291480	file, or, you
2291480	2291940	know, potentially
2291940	2292520	if they're being
2292520	2293240	really ninja
2293240	2294480	exploitation for
2294480	2295860	client execution.
2295860	2296320	So, you know,
2296320	2297380	maybe they're,
2297380	2298200	maybe it's a user
2298200	2298840	clicking on the
2298840	2300140	attachment, or
2300140	2301000	maybe they're popping
2301000	2302340	the outlook.
2302960	2304360	But something is
2304360	2305380	missing here.
2307220	2308400	We can also look
2308400	2309020	for hints of
2309020	2309880	dependencies, you
2309880	2310480	know, and so we're
2310480	2311260	trying to create
2311260	2312720	something in the
2312720	2314200	style of an adversary,
2314200	2315000	not necessarily
2315000	2316360	exactly what they
2316360	2317460	did.
2317680	2318520	But so I can look
2318520	2319340	at something like
2319340	2320760	lateral movement.
2320760	2321480	So, okay, we
2321480	2322240	see them doing
2322240	2322980	lateral tool
2322980	2324520	transfer and
2325220	2325680	Samba
2325680	2326100	Windows
2326100	2326440	admin
2326440	2327580	shares.
2328120	2328740	Windows admin
2328740	2329600	shares, if
2329600	2330280	they're doing
2330280	2330880	this technique,
2330880	2331300	it's usually
2331300	2331880	something where
2331880	2332240	they're being
2332240	2332920	driven by
2332920	2333820	operating system
2333820	2335060	credentials to
2335060	2336000	get around the
2336000	2336880	network.
2336880	2337680	So, okay, there's
2337680	2338280	something that
2338280	2339440	should be in here
2339440	2340980	as a credential
2340980	2341760	access so that
2341760	2342340	they've got the
2342340	2342980	creds to do
2342980	2343860	that.
2344920	2345600	Well, what I've
2345600	2346600	got here is
2346600	2347880	brute force,
2347880	2348720	which they could
2348720	2349520	be using to
2349520	2350740	do OS
2350740	2351780	credentials.
2351780	2352280	Credentials
2352280	2352880	from password
2352880	2353460	stores is
2353460	2354920	usually other
2354920	2355460	types of
2355460	2356260	credentials rather
2356260	2356920	than operating
2356920	2358120	system.
2358460	2359040	So I'd really
2359040	2359760	expect there to
2359760	2360300	be something
2360300	2361470	more like OS
2361960	2362600	credential
2362600	2363530	dumping or
2364640	2365540	something with
2365540	2366020	Kerberos
2366020	2366920	tickets.
2366920	2367440	So domain
2367440	2368060	authentication
2368060	2369340	here.
2369380	2370200	So a sign that
2370200	2370760	I might have
2370760	2371540	another gap that
2371540	2372480	I need to deal
2372480	2373580	with.
2376480	2378060	Less dependable,
2378060	2378740	but another way
2378740	2379280	that we might be
2379280	2379700	able to see
2379700	2380640	signs of this
2380640	2381860	is looking for
2381860	2382740	things like
2382740	2383240	unusually
2383240	2383600	sparse
2383600	2384800	tactics.
2385980	2386720	So in the
2386720	2387100	case of
2387100	2387960	Turla,
2387960	2388740	we've got an
2388740	2389540	adversary who's
2389540	2390040	been around
2390040	2390880	since at least
2390880	2392080	2004, as I said
2392080	2392560	in the beginning
2392560	2393620	of this.
2394300	2395380	Most adversaries
2395380	2396500	over time are
2396500	2397500	definitely developing
2397500	2398640	multiple techniques
2398640	2399420	to do a given
2399420	2400340	tactic that's
2400340	2402040	important to them.
2402580	2403040	And in the case
2403040	2403760	of Turla, all
2403760	2404520	we've got here
2404520	2405440	for exfiltration
2405440	2406700	is exfiltration
2406700	2407100	of cloud
2407100	2408080	storage.
2408680	2409540	And another
2409540	2410220	reason why
2410220	2410820	that's a little
2410820	2411520	bit suspicious
2411520	2412220	for Turla
2412940	2414200	is that Turla
2414200	2414960	is older than
2414960	2415920	cloud storage,
2415920	2416700	at least in the
2416700	2417220	sense that we
2417220	2417660	would generally
2417660	2419180	mean by it.
2419520	2420140	And so there's
2420140	2421600	some signs that
2421600	2422640	there might be
2422640	2423620	another gap
2423620	2424060	here in our
2424060	2424520	picture of
2424520	2425340	Turla.
2427840	2428820	Okay, so if
2428820	2429420	there are gaps
2429420	2430780	and we don't
2430780	2431620	have necessarily
2431620	2432400	everything we
2432400	2433120	need to get
2433120	2434500	from the
2434500	2435120	adversary getting
2435120	2436480	in to achieving
2436480	2437680	their goal,
2437680	2438080	let's look at
2438080	2438580	some ways of
2438580	2439360	filling these in
2439360	2440060	in a logical
2440060	2441480	fashion that
2441480	2442620	sticks to the
2442620	2443100	spirit of the
2443100	2443760	adversary as
2443760	2444200	much as
2444200	2445280	possible.
2446160	2446920	I'm going to go
2446920	2447820	over four techniques
2447820	2448620	for filling in
2448620	2449560	gaps.
2449680	2450740	First is
2450740	2451540	adding techniques
2451860	2452760	from the software
2452760	2453240	that the
2453240	2454780	adversary is using.
2454860	2455720	I'm going to fill
2455720	2456300	in some of those
2456300	2457200	dependencies that I
2457200	2458080	just identified
2458080	2459640	and add those
2459640	2460520	in.
2460520	2461060	I'm going to take
2461160	2461680	a look at peer
2462040	2462680	adversaries.
2462680	2463780	So maybe we're
2463780	2464620	still not able to
2464620	2465000	get enough
2465000	2466100	intelligence on
2466100	2466680	stuff that's
2466680	2467660	directly related
2467660	2469520	to the one
2469520	2470720	we've chosen.
2470780	2471420	Let's look at
2471420	2472020	their peers.
2472020	2472520	Let's look at
2472520	2473480	people who are
2473480	2474420	operating like
2474420	2475320	them.
2475320	2476660	And we can borrow
2476660	2477960	from as well.
2478200	2478980	And finally, if
2478980	2479560	all of that
2479560	2481020	fails, let's
2481020	2481420	look at what
2481420	2482000	lots of
2482270	2482700	adversaries are
2482700	2483440	doing.
2483440	2484240	It might be
2484240	2484760	something that
2484760	2485420	they're doing as
2485420	2486200	well.
2488180	2489320	So if I go back
2489320	2489860	to the attack
2489860	2490540	group page,
2490540	2491260	this is all
2491260	2491800	the software
2491800	2493420	that we've
2493420	2494720	associated with
2494720	2495620	Terla.
2495760	2496660	There's a mix of
2496660	2497440	different types of
2497440	2498720	things in here.
2499060	2499980	For starters, we
2499980	2501060	have what I'm
2501060	2501380	going to call
2501380	2502580	utilities.
2503040	2503880	So these are
2503880	2505260	tools that are
2505260	2506680	in every case,
2506680	2507380	but PSExec
2507380	2507960	built into
2507960	2509120	Windows.
2509260	2509860	PSExec
2509860	2510580	obviously being
2510580	2511340	part of Sys
2511340	2512000	internal, so
2512000	2512500	something that
2512500	2514100	they probably
2514100	2515080	downloaded over
2515080	2515900	the course of
2515900	2517060	the intrusion.
2517060	2517580	But it's a
2517580	2518240	general purpose
2518240	2519000	tools that
2519000	2519500	anyone's going
2519500	2520140	to have
2520140	2520940	access to
2522500	2523220	it.
2523220	2524320	Next, we've
2524320	2525140	got public
2525140	2525740	tools.
2525740	2526300	So our
2529060	2530060	public
2526300	2526520	offensive
2526520	2527780	tools.
2528220	2528920	Terla, like a
2528920	2529640	lot of actors
2529640	2530820	out there, is
2530820	2531700	a user of
2531700	2533380	MimiCats, as
2533380	2534640	well as
2534640	2535060	Empire.
2535060	2536000	And so this is
2536000	2536200	something that,
2536200	2537420	you know, it's
2537420	2537920	not just
2537920	2538120	specific to
2538120	2539120	Terla.
2539120	2539960	We see tons
2539960	2540900	of different
2542940	2543360	adversaries
2543360	2544760	using.
2545060	2546880	But Terla
2546880	2548220	has a lot
2548220	2548580	of possibly
2548580	2549520	unique software.
2549520	2550300	So these are
2550300	2551080	pieces of
2551080	2551820	software we
2552300	2553300	have listed
2553300	2554300	for no
2554300	2555300	other adversary
2551820	2553020	but Terla.
2553220	2554280	We think
2554280	2554980	that maybe
2555760	2556280	they were
2556280	2556920	written for
2556920	2557380	them or
2557380	2557960	written by
2557960	2559300	them, but we
2559300	2559980	at least don't
2559980	2560740	have evidence of
2560740	2561860	them being
2561860	2563300	used elsewhere.
2563820	2564280	And so for
2564280	2564880	filling in
2564880	2565860	software, I'm
2565860	2566280	going to start
2566280	2566980	with just
2566980	2567700	this possibly
2567700	2568120	unique
2568120	2568580	to Terla
2568580	2569500	set.
2569620	2570280	And I've
2570280	2571460	got a
2571460	2571940	couple of
2571940	2572280	reasons I'm
2572280	2572540	going to
2572540	2573940	do that.
2573940	2574740	So the
2574740	2575200	first is
2575200	2576400	that some
2576400	2576680	of the
2576680	2577300	other tools
2577300	2577880	like
2579420	2580020	Mimi
2580020	2580800	Cats,
2580800	2581980	Empire, or
2581980	2582480	if they've
2582480	2583000	been using
2583000	2583600	something like
2583600	2585180	Cobalt, those
2585180	2587120	tools have a
2587120	2588120	ton of
2588120	2589920	functionality.
2589920	2590120	Off the top
2590120	2590440	of my head,
2590440	2590840	I think
2590840	2591040	Cobalt,
2591040	2592420	we've got
2592420	2593800	over 65
2593800	2594100	techniques
2594100	2595280	mapped to.
2595280	2595800	And so it
2595800	2596300	starts to
2596300	2597100	just color
2597100	2598180	in the
2598180	2598340	entire
2598340	2599180	matrix, not
2603200	2604200	necessarily
2599180	2600360	the pieces
2600360	2601660	that Terla
2601660	2602200	is actually
2602200	2603220	using.
2604100	2604980	Something I've
2604980	2605540	seen is that
2605540	2606800	adversaries have a
2606800	2607620	tendency to use
2607620	2608260	more of the
2608260	2608540	functionality of
2608540	2609220	their own
2609220	2610400	tools, too,
2610400	2611080	than general
2611080	2611480	purpose they're
2611480	2611660	using.
2611660	2612440	And that makes
2612440	2615180	a lot of sense.
2615180	2616000	If you are
2616000	2616560	commissioning
2616560	2617380	these or
2617380	2618340	buying these
2618340	2619260	tools, you're
2619260	2619420	probably not
2619420	2619900	going to ask
2619900	2620880	for a lot of
2620880	2621160	functionality
2621160	2622180	that you
2622880	2623400	never use.
2627180	2628180	So if I
2623400	2624440	take all of the
2624440	2625780	techniques that
2625780	2626520	are associated
2626960	2627700	with each of
2627700	2628660	these tools,
2628660	2629160	add them
2629160	2630600	together, I
2630600	2631160	get something that
2631160	2632560	looks like this.
2632860	2634080	And again, I'll
2634080	2634600	release the
2634600	2635320	slides so you
2635320	2636440	can zoom in a
2636440	2637600	bit better.
2637600	2638700	Right now, I'm
2638700	2639320	just more
2639320	2639800	showing sort of
2639800	2640280	the shape of
2640280	2641440	the coloring.
2641440	2642120	You can see
2642120	2643000	that this
2643000	2643540	adds in
2643540	2643940	activity
2644240	2644480	across a
2644480	2644980	lot of
2644980	2645720	different
2645720	2646820	tactics.
2646820	2647580	So we've
2647580	2648260	got a
2648260	2649140	bunch of
2649140	2649460	material
2649460	2650540	here.
2651040	2651860	And if I go
2651860	2652740	back and add
2652740	2653300	my Turla
2653300	2654200	profile back
2654200	2655340	into that,
2655340	2656740	I've now got
2656740	2657420	quite a bit
2657420	2658460	more there.
2658540	2659280	So blue was
2659280	2659860	what we already
2659860	2661100	had with Turla.
2661100	2661880	Red is what we
2661880	2662880	just added in
2662880	2663480	with the
2663480	2664040	software that
2664040	2665060	they're using.
2665380	2665820	And green is
2665820	2666460	the overlap.
2666460	2667060	So green is
2667060	2667900	what we already
2667900	2668900	had.
2669260	2669640	And so I
2669640	2670100	pointed out
2670100	2670700	exfiltration
2670700	2671340	was kind of
2671340	2672320	thin in
2672320	2672660	the original
2672660	2673800	profile.
2674620	2675900	Well, so adding
2675900	2676700	in the software
2676700	2677180	they're using
2677180	2678140	has helped
2678140	2678800	fill that in
2678940	2679420	a bit.
2679420	2680000	So we've now
2680000	2680480	got something
2680480	2682440	like not just
2682440	2683140	cloud storage,
2683140	2683460	but also
2683460	2684100	exfiltration
2684100	2684580	of a command
2684580	2684960	and control
2684960	2685940	channel.
2686240	2686660	And so some
2686660	2687340	more options
2687340	2688100	for us to
2688100	2688540	be able to
2688540	2689060	work with
2689060	2689800	too.
2692330	2693050	So I've
2693050	2693470	still got
2693470	2693810	some of
2693810	2694190	those missing
2694190	2694770	dependencies
2694770	2695710	though, even
2695710	2696430	with the
2696430	2697030	software added
2697030	2697550	in.
2697550	2698150	So the next
2698150	2698530	thing I'm going
2698530	2699050	to go through
2699050	2699810	is filling
2699810	2700250	the missing
2700250	2701370	dependencies.
2701570	2702050	I didn't
2702050	2702770	actually find
2702950	2703150	a lot of
2703150	2703950	those in
2703950	2704230	Turla
2704230	2705250	specifically,
2705250	2705830	but there
2705830	2706330	are definitely
2706330	2707350	actors where
2707350	2707950	there are
2707950	2708410	more of
2708410	2708750	these that
2708750	2709890	you'll find.
2710210	2710750	And so I'm
2710750	2710950	going to
2710950	2711590	take the
2711590	2712270	fairly simple
2712270	2712990	step with
2712990	2713650	the missing
2713650	2714170	dependencies
2714170	2715130	I'd found
2715950	2716690	to simply
2716690	2717110	fill them
2717110	2717710	in.
2717710	2718290	So, you know,
2718290	2718830	we're trying to
2718830	2719370	stick in the
2719370	2719830	sphere of the
2719830	2720810	adversary.
2721150	2722250	They probably
2722250	2722870	did these
2722870	2723450	things in
2723450	2724210	order to
2724210	2724890	accomplish
2724890	2725390	those other
2725390	2726010	techniques or
2726010	2726590	after those
2726590	2726830	other
2726830	2727810	techniques.
2727930	2728310	So I'm
2728310	2728470	going to
2728470	2728890	bring those
2728890	2729230	into our
2729230	2730250	profile.
2732330	2732950	So that
2732950	2733390	now gives
2733390	2735870	me a
2735870	2736710	relatively
2737190	2737670	well-fleshed
2737670	2738370	out adversary
2738370	2739650	profile.
2739910	2740370	So this also
2740370	2740770	isn't
2740770	2741410	coloring in
2741410	2742070	quite as
2742070	2742790	much of
2742790	2743130	the
2743130	2743550	attack
2743550	2743930	matrix
2743930	2744550	as it
2744550	2744770	might
2744770	2745070	appear
2745070	2745990	here.
2746430	2747330	I have
2747330	2747610	only
2747610	2748090	expanded
2748090	2748310	out
2748310	2748590	sub
2748590	2749030	techniques
2749030	2749870	where
2749870	2750930	there are
2750930	2751430	techniques
2751430	2751930	selected
2751930	2753030	in them.
2753110	2753550	So again,
2753550	2753890	I'm trying
2753890	2754150	to keep
2754150	2754330	the
2755650	2756350	matrix
2756350	2756730	actually
2756730	2757150	fitting on
2757150	2758030	the slide.
2758030	2759770	But there are
2759770	2760310	quite a few
2760310	2760570	sub
2760570	2761370	techniques that
2761370	2761870	are still
2761870	2762450	tucked in
2762450	2762910	here.
2762910	2765090	So this is
2765090	2765670	still keeping
2765670	2766410	us to
2767250	2767730	a scoping
2767730	2769150	that is
2769150	2769930	in the
2769930	2770910	spirit of
2770910	2771930	Turla.
2772350	2772710	So I
2772710	2773230	think we're
2773230	2774090	good here.
2774090	2774590	I think
2774590	2775070	for Turla
2775070	2776210	itself,
2776210	2776830	this is
2776830	2777250	probably
2777250	2777830	sufficient
2777830	2778310	for us
2778310	2778710	to work
2778710	2779430	with in
2779430	2780270	any scenario
2780270	2780790	we want to
2780790	2781690	create.
2781790	2782750	But what if I
2782750	2783130	was working
2783130	2783670	in an actor
2783670	2784310	where I
2784310	2784750	couldn't do
2784750	2785590	that?
2785810	2786190	So the
2786190	2786570	next thing I
2786570	2786950	can do
2786950	2787450	is start
2787450	2787890	examining
2787890	2788250	peer
2788250	2789510	adversaries.
2790670	2791050	Turla
2791050	2791690	is
2791690	2792030	attributed
2792030	2792410	to be
2792630	2792910	a Russian
2792910	2793230	state
2793230	2793570	actor
2793570	2793730	who
2793730	2794370	likes to
2794370	2794590	steal
2794590	2795790	information.
2795790	2796450	So who
2796450	2796790	else in
2796790	2797090	the tech
2797090	2797350	do we
2797350	2797750	have that
2797750	2798190	looks like
2798190	2798990	them?
2799090	2799990	The ones
2799990	2800770	that jump
2800770	2801470	out are
2801470	2802570	APT28 and
2802570	2803190	29.
2803190	2803450	These are
2803450	2803710	the two
2803710	2804050	groups
2804050	2804550	that were
2804550	2805430	attributed
2805430	2805790	by the
2805790	2805970	US
2805970	2806250	government
2806250	2806610	to be
2806610	2806950	behind
2806950	2807290	the
2807290	2807850	DNC
2807850	2808210	hacks
2808390	2808550	a couple
2808550	2808810	years
2808810	2809570	ago.
2809570	2810070	They
2810070	2810270	have been
2810270	2810590	very
2810590	2811750	prolific.
2812110	2813370	They do a
2813370	2813710	wide range
2813710	2814010	of their
2814010	2814570	own
2814570	2816170	activities.
2816170	2819070	I could
2820250	2820590	use them
2820590	2821350	like this
2821350	2821830	where I'm
2821830	2822530	just taking
2822530	2823030	every
2823030	2823250	technique
2823250	2823670	from
2823670	2824650	both
2824650	2825190	mashing
2825190	2825450	them
2826470	2826990	together
2826990	2827330	or maybe
2827330	2827590	I just
2827590	2827910	want to
2827910	2828430	use it
2828430	2828770	as a
2828770	2829010	way of
2829010	2829430	seeing
2837070	2838070	what's
2838070	2839070	popular
2829430	2829830	for them.
2829830	2830330	So the
2831070	2832310	green techniques
2832310	2832970	are where
2832970	2833610	there's overlap
2833610	2834370	between these
2834370	2834570	two
2834570	2835990	adversaries.
2838230	2839290	Lastly,
2839290	2839490	you know,
2839490	2840550	so if the
2840550	2841310	peers aren't
2841310	2842430	enough,
2842950	2843470	maybe I can
2843470	2844010	just look at
2844010	2844650	what techniques
2844650	2845210	are common
2845210	2846370	out there.
2846450	2847470	So a
2847470	2848270	number of
2848270	2849010	companies over
2849010	2849490	the past
2849490	2849790	couple
2849790	2850330	years have
2850330	2850790	started
2850790	2851250	publishing
2851250	2853090	annual reports
2853090	2854270	on what
2857430	2858430	attack
2854270	2854390	techniques
2855150	2855870	that they've
2855870	2856270	seen over
2856270	2856690	the past
2856690	2857410	year.
2858170	2858470	And so
2858470	2859150	looking at
2859290	2859450	a couple
2859450	2859550	of
2859550	2860030	companies'
2860030	2861090	reports on
2861090	2861350	what
2861350	2861750	techniques
2861750	2862090	they saw
2862090	2863470	in 2019,
2863470	2863930	we can
2863930	2864270	start to
2864270	2864670	use those
2864670	2865070	to fill
2865070	2866050	in gaps.
2866750	2867210	So the
2867210	2867530	first one
2867530	2867770	I'm going
2867770	2868150	to use
2868150	2868890	is red
2868890	2869550	canary.
2869550	2869990	So they
2869990	2870350	put out
2870430	2871090	a report.
2871090	2871490	It's actually
2871490	2871990	got top
2871990	2872790	20 in it,
2872790	2874230	but you can
2874230	2874730	actually read
2874730	2875310	the text on
2875310	2876270	this one.
2876870	2877430	So it
2877430	2878110	is going
2878110	2878550	through,
2878550	2878830	and it's
2878830	2879550	in order,
2879550	2880490	but it's
2880490	2881090	important to
2881090	2881790	understand,
2881790	2882450	again,
2882450	2882950	what this
2882950	2883910	means.
2883930	2884490	This is
2884490	2885190	the top
2885190	2886870	10 techniques
2886870	2888310	that they
2888310	2888850	saw in
2888850	2889290	the places
2889290	2889750	that they
2889750	2890210	have
2890210	2890790	sensing
2890790	2891870	in and
2891870	2892250	compared
2892250	2893230	with their
2893230	2893570	actual
2893570	2894710	detectors.
2895030	2895370	So it's not
2895370	2896150	necessarily the
2896150	2896590	10 most
2896590	2896990	popular
2896990	2897770	techniques,
2897770	2898170	it's the
2898170	2898570	10 most
2898570	2898890	popular
2898890	2899370	techniques
2899370	2900470	they saw.
2901090	2901370	Another
2901370	2905750	company who
2905750	2906270	put out
2906270	2907030	top 20
2907030	2907770	techniques this
2907770	2908410	year,
2908410	2908790	I'm again
2908790	2909230	cutting them
2909230	2909530	down to
2909530	2909930	10 for
2909930	2911970	the slide,
2911970	2912390	but you'll
2912390	2912970	note that
2912970	2913430	the only
2913430	2913890	overlap
2913890	2914530	between these
2914530	2915450	two lists is
2915450	2916890	process injection.
2916950	2917450	So we may want
2917450	2918230	to combine a couple
2918230	2918950	of these together
2919450	2919950	in order to
2919950	2920350	see where the
2920350	2922230	overlaps are,
2922230	2923390	add their data,
2923390	2924330	but these are
2924330	2924850	giving us some
2924850	2925990	ideas of things
2925990	2926610	that we know at
2926610	2927490	least have been
2927490	2928190	out there in the
2928190	2929130	wild a bunch
2929130	2929910	in the past
2929910	2930630	year.
2930630	2931410	So it doesn't
2931410	2931930	tell us that
2931930	2932510	Turla did
2932510	2933050	these, it
2933050	2933550	doesn't tell
2933550	2934130	us that
2934130	2934950	28 or
2934950	2935790	29 did
2935790	2937350	these, but
2937830	2938210	a bunch of
2938210	2938710	people did
2938710	2940030	them somewhere.
2940470	2941230	So adding them
2941230	2941850	into our
2941850	2942770	profile may
2943530	2944510	be still
2944510	2945270	sticking to
2945950	2946510	a realistic
2946510	2948230	APT profile.
2948610	2949570	And again,
2949570	2950170	I wouldn't do
2950170	2950890	this unless
2950890	2951950	I wasn't able
2951950	2952450	to get it
2952450	2953350	directly from
2953350	2953750	the threat
2953750	2954390	intelligence on
2954390	2955430	the actor.
2958410	2958950	So we've
2958950	2959470	filled in some
2959470	2959950	gaps.
2959950	2960870	We've got a lot
2960870	2961550	of things colored
2961550	2962430	in now.
2962430	2963210	We've got our
2963210	2964550	pretty picture.
2965230	2965850	So what do
2965850	2966810	we do with it?
2966810	2967430	How do we
2967430	2968290	actually turn
2968290	2969150	this into
2969730	2971090	more of a
2971090	2972210	profile?
2972210	2972910	So I talked
2973030	2973650	about a couple
2973650	2974590	gap techniques
2974590	2975490	that I didn't
2975490	2976250	use.
2976250	2977170	So going back
2977170	2978470	to my Turla
2978470	2979790	profile that
2979790	2981370	is Turla
2981370	2981930	plus the
2981930	2982370	software that
2982370	2982930	appears to be
2982930	2983450	unique to
2983450	2984410	them plus
2984410	2984910	filling in
2984910	2985490	those
2985490	2989520	dependencies.
2989520	2989780	So I'm going
2989780	2990320	to want to do
2990320	2990920	something like
2990920	2992040	this.
2992040	2993260	So I've got
2993260	2994300	my techniques,
2994300	2995800	I've got my
2995800	2996400	tactics, and
2996400	2996600	I'm going to
2996600	2997100	want to start
2997100	2998020	to carve down
2998020	2999120	to the techniques
2999120	2999520	I want to
2999520	3000820	actually use.
3000920	3001460	And those
3001460	3002580	techniques have
3002820	3003300	a flow to
3003300	3004120	them.
3004120	3004800	So I've talked
3005000	3005340	a teeny bit
3005340	3006140	about dependencies
3006140	3007080	like where one
3007080	3007620	technique is
3007620	3007840	going to
3007840	3009220	require another.
3009260	3009980	There are
3009980	3011200	often spaces
3011200	3011900	where one
3011900	3012640	tactic is
3012640	3013160	generally going
3013160	3013600	to require
3013600	3014440	another one
3014440	3015260	too.
3015820	3016360	Attack is
3016360	3017580	not ordered.
3018020	3019100	Obviously,
3019100	3020480	yes, things
3020480	3021160	off to the
3021160	3021560	left in
3021560	3022280	attack often
3022280	3023160	happen before
3023160	3023840	things to the
3023840	3024140	right in
3024140	3025200	attack, but
3025200	3025780	there is no
3025780	3026480	strict ordering
3026480	3026860	to it.
3026860	3027740	It is not a
3027740	3029320	kill chain.
3029320	3030920	And so
3030920	3031420	tactics may
3031420	3031760	happen in
3031760	3032100	different
3032100	3032620	orders, they
3032620	3033080	may not
3033080	3033600	appear at
3033600	3033920	all in
3033920	3034420	the
3034420	3035500	intrusion,
3035500	3035820	but we
3035820	3036540	are going to
3036540	3037120	want to
3037120	3037880	force some
3037880	3039600	ordering on
3039600	3040640	them for
3040640	3040860	operation so
3040860	3041000	that we can
3041000	3041480	actually build
3041480	3042660	up a plan.
3043180	3043580	So here what
3043580	3045240	I've done is
3045240	3045840	I've started
3045840	3047360	with initial
3047360	3048340	access, so
3048340	3048740	I've got the
3048740	3049720	adversary breaking
3049720	3050320	into the
3050320	3051460	environment.
3051640	3052020	Followed by
3052020	3053200	execution, so
3053200	3054040	the code
3054040	3054760	actually getting
3054760	3055840	run, so
3055840	3056780	that's also
3056780	3057440	got the most
3057440	3058240	file in here
3058240	3059060	that I filled
3059060	3059760	in using
3059760	3060960	dependencies.
3061480	3062680	From execution,
3062680	3062980	they are going
3062980	3063440	to be doing
3063440	3064700	both discovery
3064700	3065420	and privilege
3065420	3067340	escalation, so
3067340	3067880	I'm going to
3067880	3068760	be able to do a
3068760	3069360	lot of my
3069360	3070180	discovery without
3070750	3071520	needing extra
3071520	3072280	privileges.
3072280	3072960	At the same time,
3072960	3073860	I'm going to be
3073860	3074220	building up so
3074220	3075640	that I can do
3075640	3076040	my
3076040	3077200	defensivation
3077200	3078980	credential access
3078980	3080180	and persistence.
3080690	3080960	Some of
3080960	3082920	Turla's
3082920	3084200	defensivation
3084200	3084420	does require
3084420	3084560	privilege
3084560	3085840	escalation, so
3085840	3086860	they do things
3086860	3087760	like hidden
3087760	3089680	file systems,
3091580	3092100	which is a
3092100	3092300	fairly unusual
3092300	3092420	technique.
3092420	3093280	And then,
3093280	3093940	you know, so
3094880	3095880	from my
3095880	3096880	credential access,
3093940	3094600	I'll then be able
3094600	3095100	to do lateral
3095100	3096080	movement.
3096160	3096680	I've got my
3096680	3097320	OS credential
3097320	3097900	dumping, which
3097900	3098760	lets me do my
3098760	3099520	Samba, Windows
3099520	3100160	administrative
3100160	3101860	shares, and
3101860	3102440	the arrow is
3102440	3103200	supposed to
3103200	3103760	loop around
3103760	3104440	from one side
3104440	3104940	to the other,
3104940	3105300	back to
3105300	3106480	execution, and
3106480	3107060	start it all
3107060	3108140	over again.
3110400	3111500	So, in
3111500	3112080	order to
3112080	3112820	bring this
3112820	3113700	even closer
3113700	3114860	to something
3114860	3115560	I can operate
3115560	3116600	with, the
3116600	3118120	final organizational
3118120	3118740	step I'm going
3118740	3119200	to do is
3119200	3119980	organized technique
3119980	3120900	flow into
3120900	3122340	plan phases.
3123140	3123900	So, everything I've
3123900	3124600	talked about here
3124600	3125200	is started at
3125200	3126320	initial access.
3126320	3126760	And so, that's
3126760	3128580	using what's in
3128580	3129600	enterprise attack
3129600	3130500	today.
3130740	3131460	But obviously,
3131460	3131940	there are some
3131940	3132640	steps that an
3132640	3133500	adversary, as
3133500	3134640	well as an
3134640	3136240	adversary emulator,
3136240	3136700	is going to need
3136700	3137420	to do before
3137420	3138160	they get into
3138160	3139460	the environment.
3139500	3139980	So, that's
3139980	3140480	this phase
3140480	3141340	one.
3141980	3142500	And so, you
3142500	3143200	might not be
3143200	3143760	familiar with
3143760	3144660	the tactics,
3144660	3145360	reconnaissance,
3145360	3145820	and resource
3145820	3146880	development.
3147020	3147720	And that's because
3147720	3148320	they won't be
3148320	3148840	in attack for
3148840	3149360	another few
3149360	3149900	months.
3149900	3150360	But stay
3150360	3151220	tuned.
3151420	3152200	We actually
3152200	3153140	are extending
3153140	3154260	attack to
3154260	3154800	match the
3154800	3155540	scope of
3155540	3157080	the cyber kill
3157080	3157420	chain and
3157420	3158060	activities that
3158060	3158780	come before
3158780	3159300	you break
3159300	3159740	into an
3159740	3160780	environment.
3161680	3162940	Phase two,
3162940	3163540	I've got the
3163540	3163820	adversary
3163820	3164760	operating,
3164760	3165200	setting down
3165200	3165420	their
3165420	3173660	footprint,
3173660	3174380	while I've got
3174380	3175060	this particular
3175620	3176900	adversary doing
3176900	3177520	their collection
3177520	3178320	and exfiltration
3178320	3179520	at the end.
3179520	3180300	So, they've got
3180300	3181040	the footprint and
3181040	3181580	then they steal
3181580	3182780	the information.
3183440	3184060	And so, I'm
3184060	3184680	putting these in
3184680	3185520	order so that we
3185520	3186180	can use them for
3186180	3187140	operations.
3187140	3187960	This isn't going
3187960	3188680	to be perfect,
3188680	3189120	but a lot of
3189120	3189680	these techniques
3189680	3190260	and tactics
3190260	3191500	have required
3191500	3192460	ordering to
3192460	3193180	them.
3195710	3196190	So, the
3196190	3197170	pieces I'm not
3197170	3197670	really going to
3197670	3198510	cover today,
3198510	3199710	but just a
3199710	3200210	few thoughts
3200210	3201350	on making sure
3201350	3202030	that we're applying
3202030	3202950	Intel as we go
3202950	3203630	through the entire
3204110	3204710	process.
3204750	3205490	So, we're going to
3205490	3205990	want to develop
3205990	3207010	tools to be able
3207010	3208250	to do this.
3208810	3209390	You know, want to
3209390	3210370	be able to think,
3210370	3211370	can we do this
3211370	3212250	with COTS free
3212250	3213330	open source?
3213330	3214470	Are those reasonable
3214470	3215050	for the given
3215050	3215970	actor?
3216290	3216770	So, in some
3216770	3217410	cases, we may
3217410	3217830	have an actor
3217830	3218650	who's using
3218650	3219370	Empire or
3219370	3220050	Cobalt.
3220050	3221050	So, the
3221050	3222070	answer to
3222070	3222650	that is fairly
3222650	3223470	obvious.
3223530	3224330	If we have an
3224330	3224890	actor that's
3224890	3225550	doing nothing
3225550	3226450	but bespoke
3226450	3227410	tool development
3227410	3228770	and using techniques
3228770	3229350	that aren't really
3229350	3231290	supported by much
3231290	3231930	that's out there in
3231930	3232890	public, we may need
3232890	3233690	to do some custom
3233690	3234950	work.
3235010	3236530	But, regardless,
3236530	3237190	trying to keep
3237190	3238290	those payloads
3238290	3239610	inspired by the
3239610	3240630	APT.
3240990	3241350	So, you're
3241350	3242030	looking at how
3242030	3243030	they're packing
3243030	3243670	and everything
3243670	3245030	else, trying to
3245030	3245610	stick to that
3245610	3246630	intelligence.
3247030	3247870	And finally, as
3247870	3248250	you actually
3248250	3249770	operate,
3249770	3250450	obviously, you're
3250450	3250750	going to have to
3250750	3251270	set up all the
3251270	3252190	infrastructure, test
3252190	3252850	it out and get it
3252850	3253730	going.
3253770	3254430	But once you're
3254430	3255410	emulating the
3255410	3257030	adversary, try to
3257030	3257510	think about the
3257510	3258410	modus operandi
3258410	3258990	that we thought
3258990	3259990	about earlier.
3260110	3261050	Adversary is trying
3261050	3261970	to steal targeted
3261970	3263350	information.
3263510	3264770	The goal is not
3264770	3266630	to get into
3267310	3268130	the domain
3268130	3269130	controller.
3269210	3270190	I saw somebody
3270190	3270990	on Discord
3270990	3271710	that I said
3271710	3272150	hacked the
3272150	3272950	Gibson.
3274210	3274930	Think about your
3274930	3275510	goal throughout
3275510	3276310	this and where
3276310	3276770	is it you're
3276770	3277230	actually trying
3277230	3278350	to get to.
3278510	3278890	And then think
3278890	3279990	about pacing.
3279990	3281690	How is it that
3281690	3282590	the adversary
3282590	3283630	actually operates?
3283630	3284210	Are they somebody
3284210	3285710	that is slow
3285710	3287390	and methodical
3287390	3287790	in how they're
3287790	3288390	spreading out?
3288390	3289390	Are they doing a
3289390	3293030	smash and grab?
3293030	3293570	Think about that
3293570	3294490	as much as
3294490	3296570	possible.
3296570	3297750	In closing,
3297750	3298350	some of the
3298350	3298910	things I hope
3298910	3299470	to take away
3299470	3300790	from this is
3300790	3301210	pick your
3301210	3302190	adversary wisely.
3302190	3302890	There are a lot of
3302890	3303550	things you can
3303550	3304430	think about to
3304750	3305890	leverage Intel
3305890	3306550	in the selection
3306550	3307270	of an adversary
3307270	3307630	in the first
3307630	3308550	place.
3308630	3309330	The Intel
3309330	3309910	in your adversary
3309910	3310570	isn't going to be
3310570	3311150	perfect.
3311150	3311790	It doesn't matter
3311790	3312210	if you're getting
3312210	3313130	it from attack,
3313130	3314270	original sources,
3314270	3315170	or wherever.
3315470	3317170	But it is not
3317170	3317610	going to be
3317610	3318570	perfect.
3318710	3319230	But you can
3319230	3320150	still emulate
3320150	3320790	an adversary
3320790	3322230	with imperfect
3322230	3323110	Intel.
3323110	3323630	So this is
3323630	3324310	something you
3324310	3325050	can pull off
3325050	3326410	even though
3326410	3327290	you're not
3327290	3327650	going to know
3327650	3327990	absolutely
3327990	3328370	everything
3328370	3328810	about an
3328810	3329730	adversary.
3331730	3332470	I'll post
3332470	3333590	my slides, but
3333590	3334570	some of the links
3334570	3335730	to resources I
3335730	3336410	used in here
3336410	3336990	between
3336990	3338030	ATT&CK
3338030	3338990	Navigator and
3338990	3339390	ATT&CK
3339390	3340490	itself.
3340490	3341410	We've put out
3341690	3342070	a couple of
3342070	3343090	emulation plans
3343090	3344030	where we've used
3344150	3344430	a lot of this
3344430	3345510	process and how
3345510	3346050	we've actually
3346050	3347370	done it.
3347610	3348790	And we've got
3348790	3349630	our own
3349630	3350690	Red Team
3350690	3351930	automated
3351930	3352970	tool, Caldera,
3352970	3353270	that we've
3353270	3354670	actually ported
3354670	3355950	the APT29
3355950	3356970	emulation plan
3356970	3358170	over to.
3359950	3361270	And I'm
3361270	3361870	reachable
3361870	3362270	in a couple
3362270	3363030	different venues
3363030	3364090	via ATT&CK,
3364090	3364850	via Twitter,
3364850	3365770	whatever.
3366950	3367490	And that's it
3367490	3368490	for me.
3368690	3369610	And so I'm
3369610	3370090	going to be
3370090	3370890	answering questions
3370890	3371490	in Discord
3371490	3373190	after this,
3373190	3374150	but a couple I
3374150	3374670	did catch
3374670	3375830	scroll by that
3375830	3376730	I'll take on
3376730	3377610	now.
3377610	3378390	So I saw
3378390	3380090	somebody saying,
3380090	3380830	am I talking
3380830	3381270	about the
3381270	3381730	pre-ATT&CK
3381730	3382710	stuff?
3382830	3383830	Yes.
3383830	3384770	So we're
3384770	3385630	undergoing a
3385630	3386330	merger right
3386330	3387410	now of the
3387410	3387690	information that's
3387690	3388670	in pre-ATT&CK.
3388670	3389990	We are refactoring
3389990	3391170	it down to
3391790	3392390	just
3393230	3393830	information
3393830	3394290	that is
3394290	3395490	technical,
3395490	3396190	things that
3396190	3396970	some defenders
3396970	3397690	somewhere can
3397690	3398430	see.
3398430	3399570	So some of the
3399570	3400810	intelligence planning
3400810	3401450	steps are going
3401450	3401830	to be going
3401830	3402670	away.
3402670	3403410	And we're
3403410	3404170	refactoring that
3404170	3404930	into two new
3404930	3405970	tactics,
3405970	3406470	reconnaissance
3406470	3407030	and resource
3407030	3408130	development.
3408130	3408410	So that's
3408410	3408850	something you
3408850	3409250	can expect
3409250	3410190	to see in
3410190	3410790	the next
3410790	3411350	release of
3411350	3412230	pre-ATT&CK.
3412930	3413670	And with
3413670	3414490	that, I
3415210	3415710	will be
3415710	3415930	answering
3415930	3416510	questions in
3416510	3417010	Discord.
3417010	3417670	And thank you
3417670	3418210	for attending
3418210	3418890	my talk.
3419250	3420070	Thank you so
3420070	3420790	much, Adam.
3420810	3421630	And thank you
3421630	3422270	for supporting
3422270	3423150	not only
3423150	3424170	the community
3424170	3424750	and the
3424750	3425490	DEF CON,
3425490	3425730	but the
3425730	3425990	Red Team
3425990	3426390	Village as
3426390	3426610	well.
3426610	3427730	Amazing talk.
3428030	3428610	And for
3428610	3429090	those of you
3429090	3429530	that are
3429530	3430010	watching
3430010	3431190	in Twitch,
3431190	3434430	YouTube,
3434430	3435430	that's where
3435430	3436150	you can get
3436150	3436610	access to
3436610	3437010	the Discord
3437010	3438310	server that
3438310	3438730	Adam was
3438730	3439610	mentioning.
3440210	3440810	We're going to
3440810	3441410	go on a
3441410	3442250	brief break
3442250	3442650	and the
3442650	3443510	next presentation
3443510	3443870	will start
3443870	3444010	in just a