CyberKit

MITRE ATT&CK

Name the technique behind a real, documented procedure, and put an intrusion back in order.

Name the technique from a real procedure example, and order an intrusion. Intermediate, about 25 minutes.

What you will be able to do

  • Recognize a technique from a description of what an adversary actually did (ATT&CK Coverage Map)
  • Place a technique under the right tactic: the "why they did it", not the "what"
  • Order a set of techniques into the sequence an intrusion realistically follows
  • Use ATT&CK IDs as the shared vocabulary a report and a detection rule both refer to (Cyber Kill Chain)

Read first: ATT&CK Coverage Map.

Notes for teaching it
  • Every prompt is a real MITRE procedure example, so answers can always be checked against the technique page rather than against an instructor's opinion.
  • The ordering question has one graded answer but real intrusions vary. It is worth saying out loud that the drill grades the canonical tactic order, and that a defensible alternative ordering is a good discussion, not a wrong answer.
  • Free-text, not multiple choice, so partial recall shows up honestly. Expect a lower score than a class is used to and frame it before they start.

All questions

  1. Which MITRE ATT&CK technique ID does this real procedure example describe? "DarkGate will retrieved encrypted commands from its command and control server for follow-on actions such as cryptocurrency mining." (Answer with the technique ID, e.g. "T1059" or "T1059.001".)

  2. Masquerading (T1036) maps to which MITRE ATT&CK tactic? (type the tactic name, e.g. "Credential Access")

  3. Which MITRE ATT&CK technique ID does this real procedure example describe? "Clambling has the ability to use Telnet for communication." (Answer with the technique ID, e.g. "T1059" or "T1059.001".)

  4. Modify Registry (T1112) maps to which MITRE ATT&CK tactic? (type the tactic name, e.g. "Credential Access")

  5. Which MITRE ATT&CK technique ID does this real procedure example describe? "APT28 has used a variety of public exploits, including CVE 2020-0688 and CVE 2020-17144, to gain execution on vulnerable Microsoft Exchange; they have also conducted SQL injection attacks against external websites." (Answer with the technique ID, e.g. "T1059" or "T1059.001".)

  6. File and Directory Permissions Modification (T1222) maps to which MITRE ATT&CK tactic? (type the tactic name, e.g. "Credential Access")

  7. Which MITRE ATT&CK technique ID does this real procedure example describe? "APT42 has used custom malware to steal login and cookie data from common browsers." (Answer with the technique ID, e.g. "T1059" or "T1059.001".)

  8. Phishing (T1566) maps to which MITRE ATT&CK tactic? (type the tactic name, e.g. "Credential Access")

  9. Which MITRE ATT&CK technique ID does this real procedure example describe? "In the Triton Safety Instrumented System Attack, TEMP.Veles engaged in network reconnaissance against targets of interest." (Answer with the technique ID, e.g. "T1059" or "T1059.001".)

  10. Acquire Access (T1650) maps to which MITRE ATT&CK tactic? (type the tactic name, e.g. "Credential Access")

  11. These five real MITRE ATT&CK techniques all show up in one intrusion. Click them into the order their tactics actually occur in the Enterprise kill chain (earliest first).

  12. Order these four real MITRE ATT&CK techniques, from pre-attack recon through an established C2 channel, by where their tactics fall in the Enterprise kill chain (earliest first).

  13. Order these five real MITRE ATT&CK techniques, from privilege escalation through to a ransomware-style impact, by where their tactics fall in the Enterprise kill chain (earliest first).

  14. Order these four real MITRE ATT&CK techniques, spanning stealth through exfiltration, by where their tactics fall in the Enterprise kill chain (earliest first).

Answer key

Next: Hash Identification. All drills