Applying ATT&CK to NOC environments
When looking at the ATT&CK framework, you can see that there are Enterprise, Mobile, and Industrial Control System frameworks for different purposes. Under the Enterprise matrices is Network matrix version 12, with the following sub-techniques:
- Initial Access:
- Exploit Public-Facing Application
- Valid Accounts
- Execution:
- Command and Scripting Interpreter:
- Network Device CLI
- Command and Scripting Interpreter:
- Persistence:
- Modify Authentication Process:
- Network Device Authentication
- Pre-OS Boot:
- ROMMONkit
- TFTP Boot
- Server Software Component:
- Web Shell
- Traffic Signaling:
- Port Knocking
- Modify Authentication Process:
- Privilege Escalation:
- Valid Accounts
- Defense Evasion:
- Impair Defenses:
- Impair Command History Logging
- Indicator Removal on Host:
- Clear Command History
- Clear Network Connection History and Configurations
- Modify Authentication Process:
- Network Device Authentication
- Modify System Image:
- Network Boundary Bridging:
- Network Address Translation Traversal
- Pre-OS Boot...
- Impair Defenses:
