You're reading from Aligning Security Operations with the MITRE ATT&CK Framework

Product type Book

Published in May 2023

Publisher Packt

ISBN-13 9781804614266

Pages 192 pages

Edition 1st Edition

Languages

Concepts

Cybersecurity

Author (1):

Rebecca Blair

Table of Contents (18) Chapters

Preface

1. Part 1 – The Basics: SOC and ATT&CK, Two Worlds in a Delicate Balance

2. Chapter 1: SOC Basics – Structure, Personnel, Coverage, and Tools

3. Chapter 2: Analyzing Your Environment for Potential Pitfalls

4. Chapter 3: Reviewing Different Threat Models

5. Chapter 4: What Is the ATT&CK Framework?

6. Part 2 – Detection Improvements and Alignment with ATT&CK

7. Chapter 5: A Deep Dive into the ATT&CK Framework

8. Chapter 6: Strategies to Map to ATT&CK

9. Chapter 7: Common Mistakes with Implementation

10. Chapter 8: Return on Investment Detections

11. Part 3 – Continuous Improvement and Innovation

12. Chapter 9: What Happens After an Alert is Triggered?

13. Chapter 10: Validating Any Mappings and Detections

14. Chapter 11: Implementing ATT&CK in All Parts of Your SOC

15. Chapter 12: What’s Next? Areas for Innovation in Your SOC

16. Index

Why subscribe?

17. Other Books You May Enjoy

A deep dive into the techniques in the cloud framework

As mentioned in Chapter 4, What Is the ATT&CK Framework?, the MITRE ATT&CK framework has different matrices for the different enterprises, one of those enterprises being the cloud. While this is great, you have to remember that you might have to customize any techniques so that they fit your specific cloud environment, but there are currently matrices for Office 365, Azure AD, Google Workspace, Software as a Service (SaaS), and Infrastructure as a Service (IaaS). In this section, we will start by looking at the tactics that are covered and the unique techniques before discussing the sub-techniques and supplemental information.

We’ll start at the top by discussing the generic cloud enterprise matrix, which has the following tactics and techniques:

Initial Access
- Drive-by Compromise, Exploit Public Facing Application, Phishing, Trusted Relationship, and Valid Accounts
Execution
- User Execution and Serverless...