Chapter 4: Mapping the Adversary

As we've explained previously, there is no threat hunting without good threat intelligence. Depending on the structure and the resources of your organization, you may have some threat intelligence reports that have already been processed for you. But either because you don't have a specialized intelligence team, or because you want to carry out some investigations by yourself, you need to know how to work with the MITRE ATT&CK Framework so that you can map your own intelligence reports.

In this chapter, we're going to cover the following topics:

• The ATT&CK Framework
• Mapping with ATT&CK
• Testing yourself

Let's get started!

Technical requirements

For this chapter, you will need access to the MITRE ATT&CK Matrix: https://attack.mitre.org/.

The ATT&CK Framework

The ATT&CK Framework is a descriptive model used to label and study the activities that a threat actor is capable of carrying out in order to get a foothold and operate inside an enterprise environment, a cloud environment, smartphones, or even industrial control systems.

The magic behind the ATT&CK Framework is that it provides a common taxonomy for the cybersecurity community to describe adversary behaviors. It works as a common language that both offensive and defensive researchers can use to better understand each other and to better communicate with people not specialized in the field.

And on top of that, you can not only use it as you see fit, but you can also build on top of it, creating your own set of tactics, techniques, and procedures (TTPs). Later on, you can share them with the ATT&CK team by following their guidelines: https://attack.mitre.org/resources/contribute/.

Now, let's take a closer look at the framework by understanding...

Mapping with ATT&CK

In the following exercise, we are going to use a paper that was presented at Virus Bulletin 2018: Inside Formbook Infostealer by the malware researcher Gabriela Nicolao: https://www.virusbulletin.com/uploads/pdf/magazine/2018/VB2018-Nicolao.pdf.

Formbook is an infostealer that has been around since at least 2016 and has been advertised in hacking forums by the user ng-Coder. Its code is written in assembler inline instruction within C code (ASM C). It has been used in several campaigns that have impacted both the US and South Korea, and is also related to some threat actors, such as SWEED and Cobalt.

In this section, we are going to learn how to map Formbook's infostealer behavior with ATT&CK.

Important Note

Gabriela Nicolao is a systems engineer from Argentina's Universidad Tecnológica Nacional (UTN), where she also teaches. In addition, she has a postgraduate degree in cryptography and teleinformatics security from Escuela Superior...

Testing yourself

In this section, you are going to repeat the exercise we did previously, but you are going to complete it all by yourself. First, you are going to use a paragraph with the behavior you should identify highlighted by me. Then, you are going to repeat the exercise without any guided help.

To complete this exercise, you will need to have access to the ATT&CK website: https://attack.mitre.org/.

Tip

Look for keywords in the text such as persistence, execute, gather, and send that could help you identify the type of behavior the author is talking about. You can also use the ATT&CK web search box to find other keywords, such as DLL, Windows API, Registry Key, and so on.

Take a look at the ATT&CK Matrix to identify the corresponding tactics, techniques, and sub-techniques.

A formgrabber injects a DLL (Dynamic Link Library) into a browser and monitors for calls to the HttpSendRequest API within WININET.DLL in order to intercept the data before encryption...

Summary

Now that you've completed this chapter, you should be able to carry out your own analysis using the MITRE ATT&CK Framework. Being comfortable with the framework will prove really useful for the following chapters, where we are going to plan and execute our hunts. In the next chapter, we are going to learn how to map our data sources using ATT&CK, as well as the importance of creating data dictionaries.