You're reading from Aligning Security Operations with the MITRE ATT&CK Framework

Product type Book

Published in May 2023

Publisher Packt

ISBN-13 9781804614266

Pages 192 pages

Edition 1st Edition

Languages

Concepts

Cybersecurity

Author (1):

Rebecca Blair

Table of Contents (18) Chapters

Preface

1. Part 1 – The Basics: SOC and ATT&CK, Two Worlds in a Delicate Balance

2. Chapter 1: SOC Basics – Structure, Personnel, Coverage, and Tools

3. Chapter 2: Analyzing Your Environment for Potential Pitfalls

4. Chapter 3: Reviewing Different Threat Models

5. Chapter 4: What Is the ATT&CK Framework?

6. Part 2 – Detection Improvements and Alignment with ATT&CK

7. Chapter 5: A Deep Dive into the ATT&CK Framework

8. Chapter 6: Strategies to Map to ATT&CK

9. Chapter 7: Common Mistakes with Implementation

10. Chapter 8: Return on Investment Detections

11. Part 3 – Continuous Improvement and Innovation

12. Chapter 9: What Happens After an Alert is Triggered?

13. Chapter 10: Validating Any Mappings and Detections

14. Chapter 11: Implementing ATT&CK in All Parts of Your SOC

15. Chapter 12: What’s Next? Areas for Innovation in Your SOC

16. Index

Why subscribe?

17. Other Books You May Enjoy

Examples of poor executions with detection creation

Creating alerts is part of any security operations center (SOC) team’s responsibilities. That allows them to use Yara, Splunk Processing Language (SPL), Suricata, and so on, whatever language makes sense for the tools that your organization uses. I can also guarantee that anyone who has ever worked in a SOC can relate to having alerts that were created that just generate a large number of false positives and can quickly become tiresome to triage, or that, due to ineffective filtering on alerts, become quite complicated due to having more information than is needed. A few alerts come to mind, but the first one is an alert for periodic beaconing, which can be indicative of an infected system sending a ping out to a C2 server. This alert would/could map to the following techniques in MITRE:

T1071: Application Layer Protocol
- Web Protocols
- File Transfer Protocols
- Mail Protocols
- DNS
T1132: Data Encoding
- Standard Encoding
- Non...