Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2458 Thanks!
[Music]
uh welcome everybody uh the next speaker
is going to be uh
Mika
Soo uh he's going to be uh talking about
uh uh the Mitre uh like a introduction
to Mitre uh attack uh
framework um this talk of his is um it
was initially planned to be a like a 45
minutes hour long talk but it's like now
you get the really kind of condensed
version of it in 20 minutes uh so so uh
please give a big hand and uh welcome uh
M uh other on the
stage hello
hello
and let's open this up yes so um hello
mikako from Finland uh just to explain
the other thing it's my last name in
English so for that so this is an
interaction to mitary attack framework
for Risk Managers and threat analysis so
it's like a selection of stuff mostly
managerial maybe not so overly technical
um they say that every time you first
mention attack you have to have the c in
there so you now now you can see it then
you don't so this is the short agenda so
there's few things over you something
about me and a brief introduction to
attack itself and then have some demo
like
things so me I'm a leag security
consultant in finish uh Consulting small
finish consulting company called H um
I'm mostly doing standards and and
auditing stuff and risk management and
all that um been working for other
things
previously uh professionally and not so
professionally um I think uh tarab the
hacker space I founded was is still the
one of the world's Northern most hacker
spaces so please no way do more um so
being to few camps this is my fifth
chaos camp and four camps in
Netherlands and I I am not a
professional speaker so I might be bad
so be please bear with me um you can
find me from
madone and Matrix if you if you
need or from Village salaki in cold
North so what is an attack framework
it's a free free to use free to do
whatever framework from
MRE um it's launched initially from in
2015 it's uh updated twice a year uh
it's now version
13.1 it's always 0.1 the kind of years
second version it's updated now it's
summer to the kind of second time for
this year it has three main categories
so one is the attack Enterprise so
basically the normal stuff and then it
has an i and mobile kind of sub things
or like this U other Frameworks you can
see the on the end if you can see the
white thing it has it's a kind of a menu
of the of the attack framework so it has
cloud and Enterprise stuff and mobile
and I and all that the Enterprise made
Enterprise framework is the kind of main
one um but they are all kind of red uh
used in the same
way um it has um it kind of um collects
this public threat intelligence or or uh
research uh it uh includes information
about 22 these kind of attack campaigns
so to say and they have analyzed 740
pieces of different software for it um
the framework consists 14 tactics 196
techniques and 4 11 sub
techniques I say this because the one of
the reasons for this talk is that people
always say that I open the frame uh
attack framework page and it's huge it's
it's a intimidating thing so that's why
uh it looks like this or something like
this so there's millions of things and
but it's not meant to be like read from
first sentence to last one it's it's
it's a tool it's not a book to read so
it has lot of stuff but you don't have
to read it all basically you don't need
to also see
that
um so this is the first thing I saw when
I some okay we using attack framework
something and I was like what I'm not I
don't want to do this at all so it's
little bit daunting the first s when you
get further down the path it's more
daunting there's even more stuff in it
um but I'll explain few main things so
the tactic I said so there's 14 tactics
uh it's the attacker goal or out outcome
or the why someone's doing something
they want to achieve a thing then
there's techniques under each tactic
that's how can I get this thing done so
how to do something and then there's see
sub techniques that are like for example
um brute forcing you can do it in
different ways or like you you can guess
passwords in different ways and brute
forcing is one of them so brute forcing
is a detailed sub technique for for a
one technique then because this is for
Risk Managers there's a risk uh kind of
set that okay we have this attacker
who's using default valid account to
gain initial access to company server
that's that's like a risk sentence kind
of and then you can basically see
there's colors you cannot see now but
basically the default valid account is a
technique the default one is a sub
technique of it and initial access is
the thing they want they want to
achieve um The Matrix is read left right
so so basically you take a column
there's something in the column the the
tactic you have to do the stuff on the
left side of it first to get to this
column and then next thing you can do or
will do or might want to do is the one
on the right is this right yes
um and this is
a kind of um what is called demo of it
bad demo so basically for example
there's a tactical Discovery uh it has a
technique called Cloud infrastructure
Discovery when you get you discover what
cloud in uh things the company has then
you can
start exploiting or or start making
lateral movement in it so it has this
remote Services thing in the next column
and then you might move to collection
part that's that has this data from
local system that you are doing but it
has lots of this but basically you can
read it many ways if you want to ask me
other ways to read it I can tell you
later on but
basically um it gives you options how to
get to a point it has kind of like you
can draw a draw a path to get
somewhere so you need to find out
options you need to wait to move
laterally and then you need to actually
do some bad stuff or get whatever
information you are
after um I also kind of talk about this
it has some other things in the end I'm
not talking about but main parts for
this talk are risk identification so for
usual thing Risk Managers ask me okay
how do I know what risk I put to our
risk map what how do I know them what
are the sources for it and then for
threat analysis or thread hunting kind
of part is it okay what should we
prepare for what should we look at what
what is the thing we should
investigate you can also use it for
defense planning and red teaming and
forensics and all that but I'm not
covering that
now so for risk managements how do I get
how do I know what risks to manage and
how do I fill my risk risk
registry yes that's the word so for Exel
you can use your own experience or past
incidents but then you can use these
Frameworks Frameworks to kind of see it
and get stuff into it and I think I have
a yay a demo about it
so let me check if I have a demo about
it I'm also losing my mic
um
ah what did I
do
ah now I yes this was something I was
not yes I'm in the right place so
basically for example
um what do you do for initial access um
there's these things there's uh drive by
compromise exploit public facing
application external remote
services and then for example these are
these are the things you can you can um
put into your risk thing you can like
start from this so these are basically
risks someone somewhere has already been
using for a doing bad stuff somewhere of
course you need to it's not you can't
just pick up stuff from here you you
have to do some manual like
thinking
um then
I had some
uh I'm going to use it
sorry
yes so um then the second usually
questions from Risk Managers is
that I have a I have a mitigation we
have a firewall we are we are doing
something um does it cover something
what does it cover what can we do with
this mitigation part and if this
mitigation part thing firewall something
cost a lot of money uh can we get rid of
it if we get rid of it what happens what
are the kind of risks what happens if we
get rid of this one thing um kind of
easy way to show find it is
to go from um test
this plad there's this menu called
mitigations and then you can select
Enterprise from the mitigations menu it
has all these different ways of
mitigating risks for example and
then for example if you select Network
segmentation from the mitigation there's
long list of things um you can see what
techniques are addressed by the
mitigation it says for
example uh Network in segmentation can
be used to isolate infrastructure
components da da da da da and it's for
adverse in the middle or some people
know it as badka in the middle um
technique so basically it has some if
you need to explain yourself why you are
using this amount of money to your board
or manager or whoever you can say okay
we need Network segmentation because
these things and there's quite many
things well I'm pretty sure people know
what network segmentation is if you
don't come ask me
later so basically you can use it for
kind
of uh find out what what kind of things
that
mitigation can be against let's say
yeah
um then
um about the threat analyst part um what
are the threads we should prepare for uh
what are the things uh we should do in
this company uh for for what what should
i as a thread hunter or thread analyst
do um there's is another tool attack
Navigator I'm going to show you it's
also from MRE but it's um
different
um I have link it it's in in GitHub uh
IO so it's this interactive thing so you
can use this
um create new layer it has this same da
thing thing but then there's a search
you can
use searching for example
password and it will show you every
everything that has password in them so
basically it has 67 techniques that
matches password somehow and it has some
other like it has some mitigations
there's one campaign identified that
that's a solar wind compromise it uses
passwords for doing something something
and then there's 14 pieces of marware
that that uh uh steal or or do something
with your password and then we can for
example from technique select all and
then
uh it will um it will highlight those uh
things in the map you cannot see
properly uh and if you take for example
this Brute Force BR forcing is a one one
uh technique for credential access and
then there's uh three sub things for Pro
for so there's credential stuffing
password cracking password guessing and
and uh password spraying those are the
main password kind
of things you can you can do bad things
about and then if you go go to for
example password guessing can right
click hopefully and then go
to it will go to this um main attack
framework and you can again see uh kind
of some examples there's some apt groups
who are doing something something
something with password guessing and
then there's mitigation all of list of
mitigations you should do use you should
use multiactor authentication password
policies you some software and all that
so that's the that's the thing for that
and then last thing or next thing uh I
have uh uh okay we have we are using
something what are the threads we should
take into account and let's see it from
the Navigator again no what not there
let's go there I did it before because I
knew it it will be short in time so
there's a containers we are using
containers in company so let's let let's
show for containers there's this one
technique that says build image on host
okay let's view of that and it says Okay
um um what are the mitigations that that
you can use against it um uh so so uh
bad guys can can do that um how can you
detect it and then there's are
references to to
places um and that was my thing about
attack framework sorry it was quite fast
but it was quite short time so um like I
said you can find me in those two good
places and then it's a duck but it
should be some kind of cross thing
nowadays I have no idea what it's called
uh we have a will is called salaki in uh
in the cold North uh Place whatever it's
called habitat and I will be on that end
of the tent after this if you have
anything to do ask about attack
framework or anything
else thank
[Applause]
you so yeah uh thank you honor for this
so uh please um uh we are limited with
time so uh please reach out to to uh to
him through these uh Chanel CH
channels uh so those who cannot read the
the uh the slides the channels were uh
you can find him uh as uh as other uh
Nick on on the uh The Matrix and other
at chaos social was it uh in in masteron
in in Chase and chos social both okay
you have both like info exchange and
Chaos social yes perfect so uh big kind
of Applause for uh
M thank
[Music]
you