Homework: Threat hunting using Mitre Enterprise ATT&CK
Introduction
Enterprise ATT&CK is a framework from Mitre intended to describe and communicate a threat quickly and briefly. ATT&CK describes the following tactics:
• Reconnaissance
• Resource development
• Initial access
• Execution
• Persistence
• Privilege escalation
• Defense evasion
• Credential access
• Discovery
• Lateral movement
• Collection
• Command and control
• Exfiltration
• Impact
As the word tactic might suggest, not every tactic needs to be used by a threat. You will see that several tactics can be used together to achieve a certain goal. At ATT&CK there is a so-called navigator which displays available techniques and sub-techniques for each tactic. As with tactics, an attacker can use multiple techniques to achieve a specific goal. For example, initial access tactic can use both drive-by compromise and phishing.
Each technique is actually an abstraction of a set of possible practices that an attacker can use. For more information about each technique, you can right-click on the technique in the navigator and choose "View technique".
Task
At Canvas you can find a report that provides the technical analysis of attacks that are associated with Carbanak - a remote backdoor.
Based on the information provided in this report, you will map the activities involved to the ATT&CK framework. You will also think about how the use of this technique can be detected and mitigated in the future. In addition to the case provided to you, you may look up additional information about the incident yourself on the Internet if necessary. In that case, also provide the reference to the additional resources you used.
Follow the following guidelines when filling the tables:
1. (sub) Technique: give the ID and the name of the technique or the sub-technique that you identified'
2. How is this (sub-) technique used: describe in your own words about how this technique is used. Do NOT copy the description from Mitre ATT&CK.
3. Where did you find the info?: Provide page/line number in the report, or references to other resources.
4. Your suggestion on mitigations/detection: You may be inspired byMitre ATT&CK for possible mitigation and detection advices. However, describe in your own words about your suggestion in the context of this threat; and motivate your suggestion. Do not copy the description from Mitre ATT&CK.
5. If you cannot find any information about the techniques used in certain tactics (even after search on the Internet), then you may leave it empty and indicate "no information can be found".
Format your homework according to the give formatting requirements:
1. The answer must be double spaced, typed, using Times New Roman font (size 12), with one-inch margins on all sides.
2. The response also includes a cover page containing the title of the homework, the course title, the student's name, and the date. The cover page is not included in the required page length.
3. Also include a reference page. The references and Citations should follow APA format. The reference page is not included in the required page length.