🟣 Adversary Emulation

Cyber Kill Chain (Lockheed Martin)

Developed by Lockheed Martin, the Cyber Kill Chain® framework is part of the Intelligence Driven Defense® model for identification and prevention of cyber intrusions activity. The model identifies what the adversaries must complete in order to achieve their objective.

{% embed url="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html" %}

Cyber Kill Chain (Dell Secure Works)

Prior to the first version of the kill chain described by Lockheed Martin, Dell Secure Works has developed a more detailed version of the kill chain :

Unified Kill Chain

The Unified Kill Chains provides insight into the tactics that hackers employ to attain these objectives. This provides a solid basis to develop (or realign) defensive strategies to raise cyber resilience.

{% embed url="https://www.unifiedkillchain.com" %}

The main difference between unified kill chain and cyber kill chain is that the unified kill chain was developed through a hybrid research approach, combining design science with qualitative research methods. this kill chain is a combination of MITRE ATT&CK framework and Lockheed Martin cyber kill chain.

MITRE ATT&CK Framework

MITRE ATT&CK® is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community.

{% embed url="https://attack.mitre.org/matrices/enterprise" %}

{% embed url="https://github.com/mitre-attack/attack-navigator" %}

ATT&CK can help blue team operators detect, mitigate and respond to adversary threats and APT groups. it also aides the incident response team to detect and stop the threat actor by analyzing their behavior based on known tactics, techniques and procedures (ATT&CK ID).

TTPs

MITRE ATT&CK categorizes adversary behavior by TTPs (tactics, techniques and procedures).

Tactics

The 14 tactics can be summarized as follows:

Reconnaissance - Collecting information from the target organization to prepare future adversarial activities.
Resource Development - Acquiring infrastructure and resources to support adversarial activities against the target organization.
Initial Access - Gaining initial access to the target network.
Execution - Techniques for running malicious code on the network, usually to explore or steal data.
Persistence - Maintaining access to the target network over time by circumventing measures like credential changes or restarts that could interrupt access.
Privilege Escalation - Gaining administrator or other high-level permissions on the target network.
Defense Evasion - Avoiding detection by security software and IT security teams.
Credential Access - Stealing account names and passwords, allowing the adversary to circumvent security measures by accessing the network with legitimate credentials.
Discovery - Exploring the network and collecting information, such as which applications and services are running, what accounts exist, what resources are available, etc.
Lateral Movement - Accessing and controlling remote services on the target network.
Collection - Aggregating data from a variety of sources on the target network.
Command and Control - Techniques for communicating with systems under the adversary’s control within the target network.
Exfiltration - Techniques for stealing data from the target network and transferring it to an external server controlled by the adversary.
Impact - Techniques for destroying data or disrupting the availability of applications, services, or the target network itself.

Knowing these tactics will help us in :

Cyber Threat Intelligence
Threat Intelligence & Analytics
Penetration Testing & Adversary Emulation
Threat Coverage Gap Assessment

Techniques

Adversarial techniques answer “how” an adversary attains a tactical objective, and the course of action they take to get what they seek.

ATT&CK Use Cases

Threat Intelligence : Cyber threat intelligence is all about understanding the cyber threat groups that matter to your organization, including their motives, typical targets, behaviors, and preferred software/techniques. IT security teams can use the MITRE ATT&CK framework to access specific information on the behaviors of known threat groups, then identify strategies to detect and mitigate their preferred techniques.

Threat Detection & Analytics : Each technique in the MITRE ATT&CK framework includes a metadata field called “Data Sources”. This field lists specific types of data that organizations should collect to gain the visibility needed to detect that technique.

Penetration Testing & Adversary Emulation : Once your security team writes an analytic or configures security monitoring to detect an adversarial technique, penetration testing or adversary emulation can be used to evaluate the effectiveness of the implemented threat detection measures.

Threat Coverage Gap Assessment : IT security teams can map existing threat detection capabilities onto the MITRE ATT&CK framework to identify gaps in their defenses. They can identify the cyber threat groups which are most likely to target them and compare their threat coverage to the preferred techniques used by those organizations.