MITRE ATT&CK Techniques & Protection Strategies by Layer Logix

Comprehensive Guide to MITRE ATT&CK Techniques and Layer Logix Protection Strategies The MITRE ATT&CK framework is an essential resource for understanding the tactics and techniques adversaries use to compromise systems. By mapping out the entire lifecycle of cyberattacks, it enables organizations to anticipate threats and implement effective defenses.

Layer Logix leverages the MITRE ATT&CK framework to deliver advanced cybersecurity solutions. By understanding each attack vector in depth, Layer Logix provides tailored defenses that mitigate risks at every stage of an attack.

Table of Contents 1. Reconnaissance 2. Resource Development 3. Initial Access 4. Execution 5. Persistence 6. Privilege Escalation 7. Defense Evasion 8. Credential Access 9. Discovery 10. Lateral Movement 11. Collection 12. Command and Control 13. Exfiltration

14. Impact 15. Conclusion

Reconnaissance Attack Vector Summary: Reconnaissance involves adversaries gathering information about a target to identify potential vulnerabilities. This phase is critical as it lays the groundwork for subsequent attack stages.

Techniques and Sub-Techniques

Technique ID

Technique

Sub-Techniques

T1595

Active Scanning

- T1595.001: Scanning IP Blocks - T1595.002: Vulnerability Scanning - T1595.003: Wordlist Scanning

T1592

Gather Victim Host Information

- T1592.001: Hardware - T1592.002: Software - T1592.003: Firmware

T1591

Gather Victim Identity Information

- T1591.001: Employee Names - T1591.002: Email Addresses - T1591.003: Credentials

T1590

Gather Victim Network Information

- T1590.001: Domain Properties - T1590.002: DNS - T1590.003: Network Trust Dependencies

T1589

Gather Victim Organization Information

- T1589.001: Business Relationships - T1589.002: Organizational Structure - T1589.003: Geographic Locations

T1598

Phishing for Information

- T1598.001: Spearphishing Service - T1598.002: Spearphishing Attachment - T1598.003: Spearphishing Link

Expanded Information: Active Scanning (T1595): Adversaries perform network scans to identify live hosts, open ports, and services running on target systems. This helps them find exploitable vulnerabilities.

Gather Victim Host Information (T1592): Collecting data about hardware, software, and firmware provides insights into potential weaknesses.

Phishing for Information (T1598): Attackers use phishing techniques to trick individuals into revealing sensitive information.

Layer Logix Protection: Network Monitoring: Implements intrusion detection systems (IDS) and intrusion prevention systems (IPS) to detect and block unauthorized scanning activities.

Threat Intelligence Integration: Utilizes global threat intelligence to identify and respond to reconnaissance activities targeting the organization.

Employee Training: Conducts regular security awareness programs to educate staff about phishing tactics.

Resource Development Attack Vector Summary: Resource Development involves adversaries establishing the resources needed to support their operations, such as infrastructure, capabilities, or accounts.

Techniques and Sub-Techniques

Technique ID

Technique

Sub-Techniques

T1583

Acquire Infrastructure

- T1583.001: Domains - T1583.002: DNS Server - T1583.003: Virtual Private Servers - T1583.004: Serverless Infrastructure - T1583.005: Botnets

T1587

Develop Capabilities

- T1587.001: Malware - T1587.002: Code Signing Certificates - T1587.003: Digital Certificates

T1584

Compromise Infrastructure

- T1584.001: Domains - T1584.002: DNS Server - T1584.003: Virtual Private Servers

Expanded Information: Acquire Infrastructure (T1583): Attackers purchase or lease infrastructure to host malicious operations, making it harder to trace activities back to them.

Develop Capabilities (T1587): Creation of malware or tools that can exploit vulnerabilities in target systems.

Layer Logix Protection: Domain Monitoring: Tracks domain registrations similar to the organization's name to detect potential spoofing.

Certificate Management: Validates code signing certificates to prevent the execution of unauthorized code.

Malware Analysis: Uses sandbox environments to analyze and detect custom-developed malware.

Initial Access Attack Vector Summary: Initial Access techniques are used by adversaries to penetrate a target network and establish a foothold.

Techniques and Sub-Techniques Technique ID

Technique

Sub-Techniques

T1566

Phishing

- T1566.001: Spearphishing Attachment - T1566.002: Spearphishing Link - T1566.003: Spearphishing via Service

T1190

Exploit Public-Facing

- N/A

Application T1195

Supply Chain Compromise

- T1195.001: Compromise Software Dependencies and Development Tools - T1195.002: Compromise Software Supply Chain - T1195.003: Compromise Hardware Supply Chain

T1133

External Remote Services

- N/A

T1091

Replication Through

- N/A

Removable Media

Expanded Information: Phishing (T1566): Adversaries craft deceptive emails or messages to trick users into divulging credentials or downloading malware.

Exploit Public-Facing Application (T1190): Attackers target vulnerabilities in internetfacing applications to gain unauthorized access.

Layer Logix Protection: Email Security: Implements advanced email filtering and anti-phishing technologies to detect and block malicious emails.

Web Application Firewalls (WAF): Protects public-facing applications from exploitation by filtering and monitoring HTTP traffic.

Supply Chain Security: Evaluates and monitors third-party vendors to mitigate supply chain risks.

Execution Attack Vector Summary: Execution techniques involve adversaries running malicious code on victim systems, which is crucial for carrying out further actions.

Techniques and Sub-Techniques Technique ID

Technique

Sub-Techniques

T1059

Command and Scripting Interpreter

- T1059.001: PowerShell - T1059.003: Windows Command Shell - T1059.004: Unix Shell - T1059.005: Visual Basic - T1059.006: Python

T1204

User Execution

- T1204.001: Malicious Link - T1204.002: Malicious File

T1047

Windows Management Instrumentation

- N/A

T1569

System Services

- T1569.002: Service Execution

T1106

Native API

- N/A

Expanded Information: Command and Scripting Interpreter (T1059): Adversaries use built-in scripting environments to execute code, making detection harder.

User Execution (T1204): Relies on social engineering to persuade users to run malicious code.

Layer Logix Protection: Application Control: Enforces policies that restrict the execution of unauthorized scripts and applications.

Behavioral Analytics: Detects anomalous usage of scripting tools and command-line interfaces.

User Education: Provides training to help users identify and avoid executing malicious content.

Persistence Attack Vector Summary: Persistence techniques allow adversaries to maintain access to systems across reboots and credential changes, ensuring long-term control.

Techniques and Sub-Techniques

Technique ID

Technique

Sub-Techniques

T1547

Boot or Logon Autostart Execution

- T1547.001: Registry Run Keys / Startup Folder - T1547.004: Winlogon Helper DLL - T1547.005: Security Support Provider - T1547.006: Kernel Modules and Extensions

T1053

Scheduled Task/Job

- T1053.002: At (Linux) - T1053.003: Cron - T1053.005: Scheduled Task

T1574

Hijack Execution Flow

- T1574.001: DLL Search Order Hijacking - T1574.002: DLL SideLoading - T1574.004: Path Interception

T1505

Server Software Component

- T1505.001: SQL Stored Procedures - T1505.003: Web Shell

T1098

Account Manipulation

- T1098.001: Additional Cloud Credentials - T1098.002: SSH Authorized Keys

Expanded Information: Boot or Logon Autostart Execution (T1547): Modifying system settings so malicious code runs automatically at startup.

Scheduled Task/Job (T1053): Creating tasks that execute code at predetermined times.

Layer Logix Protection: Startup Monitoring: Watches for changes in registry keys and startup folders.

Task Scheduler Monitoring: Detects unauthorized scheduled tasks and jobs.

Endpoint Protection: Employs endpoint detection and response (EDR) tools to identify persistence mechanisms.

Privilege Escalation Attack Vector Summary: Privilege Escalation techniques are used to gain higher-level permissions, enabling adversaries to perform actions that require elevated privileges.

Techniques and Sub-Techniques Technique ID

Technique

Sub-Techniques

T1068

Exploitation for Privilege Escalation

- N/A

T1055

Process Injection

- T1055.001: Dynamic-link Library Injection - T1055.002: Portable Executable Injection - T1055.003: Thread Execution Hijacking

T1078

Valid Accounts

- T1078.001: Default Accounts - T1078.002: Domain Accounts - T1078.003: Local Accounts

T1548

Abuse Elevation Control Mechanism

- T1548.002: Bypass User Account Control - T1548.003: Sudo and Sudo Caching

T1134

Access Token Manipulation

- T1134.001: Token Impersonation/Theft - T1134.002: Create Process with Token

Expanded Information:

Exploitation for Privilege Escalation (T1068): Exploiting vulnerabilities to gain elevated permissions.

Process Injection (T1055): Injecting malicious code into legitimate processes.

Layer Logix Protection: Vulnerability Management: Regularly scans and patches systems to eliminate known vulnerabilities.

Memory Protection: Uses anti-exploitation tools to prevent process injection and other in-memory attacks.

Access Control Policies: Enforces the principle of least privilege to limit user permissions.

Defense Evasion Attack Vector Summary: Defense Evasion techniques help adversaries avoid detection by security solutions, ensuring their activities remain undetected.

Techniques and Sub-Techniques

Technique ID

Technique

Sub-Techniques

T1027

Obfuscated Files or Information

- T1027.001: Binary Padding - T1027.002: Software Packing - T1027.003: Steganography

T1562

Impair Defenses

- T1562.001: Disable or Modify Tools - T1562.004: Disable Windows Event Logging

T1070

Indicator Removal on Host

- T1070.001: Clear Windows Event Logs - T1070.004: File Deletion - T1070.006: Timestomp

T1036

Masquerading

- T1036.003: Rename System Utilities - T1036.005: Match Legitimate Name or Location

T1497

Virtualization/Sandbox Evasion

- T1497.001: System Checks - T1497.002: User Activity Based Checks

Expanded Information: Obfuscated Files or Information (T1027): Hiding malicious code using techniques like encryption or encoding.

Impair Defenses (T1562): Disabling security tools to prevent detection.

Layer Logix Protection: Advanced Threat Detection: Employs machine learning to detect obfuscated malware.

Security Tool Monitoring: Alerts administrators if security tools are disabled or modified.

Integrity Checks: Uses file integrity monitoring to detect unauthorized changes.

Credential Access

Attack Vector Summary: Credential Access techniques involve stealing usernames and passwords, allowing adversaries to gain unauthorized access to systems and data.

Techniques and Sub-Techniques Technique ID

Technique

Sub-Techniques

T1003

OS Credential Dumping

- T1003.001: LSASS Memory - T1003.002: Security Account Manager - T1003.003: NTDS - T1003.004: LSA Secrets

T1110

Brute Force

- T1110.001: Password Guessing - T1110.002: Password Cracking - T1110.003: Password Spraying

T1056

Input Capture

- T1056.001: Keylogging - T1056.002: GUI Input Capture

T1555

T1528

Credentials from Password

- T1555.001: Keychain

Stores

- T1555.003: Credentials from Web Browsers

Steal Application Access

- N/A

Token

Expanded Information: OS Credential Dumping (T1003): Extracting credentials from operating system components.

Brute Force (T1110): Systematically attempting all possible passwords.

Layer Logix Protection:

Credential Management: Implements strong password policies and regular password changes.

Multi-Factor Authentication (MFA): Adds an extra layer of security beyond passwords.

Anomaly Detection: Monitors for unusual login patterns indicative of credential theft.

Discovery Attack Vector Summary: Discovery techniques enable adversaries to gain knowledge about the system and network, facilitating further exploitation.

Techniques and Sub-Techniques Technique ID

Technique

Sub-Techniques

T1083

File and Directory

- N/A

Discovery T1016

System Network

- N/A

Configuration Discovery T1049

System Network

- N/A

Connections Discovery T1007

System Service Discovery

- N/A

T1033

System Owner/User

- N/A

Discovery T1518

Software Discovery

- T1518.001: Security Software Discovery

T1057

Process Discovery

- N/A

Expanded Information: File and Directory Discovery (T1083): Searching for files that may contain valuable data.

System Network Configuration Discovery (T1016): Gathering information about network interfaces and settings.

Layer Logix Protection: Access Controls: Restricts user permissions to limit access to system information.

Monitoring Tools: Detects and alerts on the use of system commands commonly used for discovery.

Lateral Movement Attack Vector Summary: Lateral Movement techniques allow adversaries to move through a network to access additional resources and systems.

Techniques and Sub-Techniques Technique ID

Technique

Sub-Techniques

T1021

Remote Services

- T1021.001: Remote Desktop Protocol - T1021.002: SMB/Windows Admin Shares - T1021.003: Distributed Component Object Model (DCOM)

T1072

Software Deployment Tools

- N/A

T1210

Exploitation of Remote Services

- N/A

T1563

Remote Service Session Hijacking

- T1563.001: SSH Hijacking - T1563.002: RDP Hijacking

Expanded Information: Remote Services (T1021): Using legitimate remote services to access other systems.

Remote Service Session Hijacking (T1563): Taking over existing remote sessions.

Layer Logix Protection: Network Segmentation: Divides the network into segments to limit lateral movement.

Access Monitoring: Logs and reviews remote access attempts.

Zero Trust Architecture: Verifies every access request, regardless of origin.

Collection

Attack Vector Summary: Collection techniques involve gathering data of interest from target systems for exfiltration.

Techniques and Sub-Techniques Technique ID

Technique

Sub-Techniques

T1005

Data from Local System

- N/A

T1039

Data from Network Shared

- N/A

Drive T1119

Automated Collection

- N/A

T1125

Video Capture

- N/A

T1056

Input Capture

- T1056.001: Keylogging - T1056.002: GUI Input Capture

Expanded Information: Data from Local System (T1005): Collecting files from the local system that may contain sensitive information.

Automated Collection (T1119): Using scripts or tools to automatically collect data over time.

Layer Logix Protection: Data Access Controls: Implements strict permissions on sensitive files.

DLP Solutions: Monitors and controls the movement of sensitive data.

Encryption: Protects data at rest and in transit.

Command and Control Attack Vector Summary: Command and Control (C2) techniques are used by adversaries to communicate with compromised systems and control them remotely.

Techniques and Sub-Techniques

Technique ID

Technique

Sub-Techniques

T1071

Application Layer Protocol

- T1071.001: Web Protocols - T1071.002: File Transfer Protocols - T1071.003: Mail Protocols

T1095

Non-Application Layer Protocol

- N/A

T1573

Encrypted Channel

- T1573.001: Symmetric Cryptography - T1573.002: Asymmetric Cryptography

T1001

Data Obfuscation

- T1001.001: Junk Data - T1001.002: Steganography

T1105

Ingress Tool Transfer

- N/A

Expanded Information: Application Layer Protocol (T1071): Using standard protocols to blend malicious traffic with legitimate network traffic.

Encrypted Channel (T1573): Encrypting C2 communications to evade detection.

Layer Logix Protection: Network Traffic Analysis: Uses deep packet inspection to detect anomalies in network traffic.

SSL/TLS Inspection: Decrypts and inspects encrypted traffic for malicious content.

C2 Blacklisting: Maintains updated lists of known malicious C2 servers.

Exfiltration Attack Vector Summary: Exfiltration techniques are methods used to transfer data out of the target network, often covertly.

Techniques and Sub-Techniques

Technique ID

Technique

Sub-Techniques

T1041

Exfiltration Over C2 Channel

- N/A

T1011

Exfiltration Over Other Network Medium

- N/A

T1567

Exfiltration Over Web Service

- T1567.001: Exfiltration to Cloud Storage - T1567.002: Exfiltration to Code Repository

T1052

Exfiltration Over Physical Medium

- N/A

T1020

Automated Exfiltration

- N/A

Expanded Information: Exfiltration Over C2 Channel (T1041): Using the established C2 channel to exfiltrate data.

Exfiltration Over Web Service (T1567): Uploading data to web services like cloud storage or code repositories.

Layer Logix Protection: Outbound Traffic Monitoring: Analyzes outgoing traffic for signs of data exfiltration.

Data Loss Prevention (DLP): Blocks unauthorized data transfers.

User Activity Monitoring: Detects abnormal user behaviors that may indicate exfiltration.

Impact Attack Vector Summary: Impact techniques are used to disrupt or destroy systems and data, affecting the availability, integrity, and confidentiality of resources.

Techniques and Sub-Techniques

Technique ID

Technique

Sub-Techniques

T1485

Data Destruction

- N/A

T1486

Data Encrypted for Impact

- N/A

T1499

Endpoint Denial of Service

- T1499.001: OS Exhaustion Flood - T1499.002: Service Exhaustion Flood

T1529

System Shutdown/Reboot

- N/A

T1491

Defacement

- T1491.001: Internal Defacement - T1491.002: External Defacement

Expanded Information: Data Destruction (T1485): Deleting or overwriting files to disrupt operations.

Data Encrypted for Impact (T1486): Encrypting files and demanding ransom for decryption keys.

Layer Logix Protection: Backup Solutions: Maintains regular backups to restore data after destruction or encryption.

Ransomware Protection: Uses specialized tools to detect and block ransomware activities.

Incident Response Planning: Prepares for quick recovery from impact events.

Conclusion Understanding the MITRE ATT&CK framework enables organizations to anticipate and defend against sophisticated cyber threats. Layer Logix integrates this framework into its cybersecurity solutions, providing comprehensive protection across all stages of the attack lifecycle.

Key Advantages of Layer Logix: Proactive Threat Hunting: Continuously searches for threats within the network.

Advanced Analytics: Utilizes AI and machine learning to detect anomalies.

Customizable Security Policies: Tailors defenses to the organization's unique environment.

Comprehensive Reporting: Offers detailed insights into security posture and incidents.

Secure your organization with Layer Logix and fortify your defenses against advanced cyber threats.

Note: This guide is based on the MITRE ATT&CK framework as of October 2023. For the latest updates, please visit the official MITRE ATT&CK website.