MITRE Threat Group Tracker

MITRE Threat Group Tracker

MITRE ATT&CK Framework

• What It Is: A knowledge base of adversarial tactics, techniques, and procedures (TTPs) used by attackers.

• Purpose: Helps organizations move towards a threat-informed defense by understanding and mitigating attacker behaviors.

• Components:

  • Tactics: The "why" of an attack (e.g., initial access, execution).

  • Techniques: The "how" of an attack (e.g., phishing, malware).

  • Common Knowledge: Documented behaviors and methods used by attackers.

Benefits of MITRE ATT&CK

• Standardization: Provides a common language for describing adversary behavior, making it easier to share and compare threat intelligence.

• Visualization: Allows organizations to map their defense systems and identify strengths and weaknesses.

• Prioritization: Helps determine which techniques to focus on for mitigation and detection based on their relevance to specific threats.

MITRE Threat Group Tracker

• What It Is: A framework for tracking related intrusion activities by a common name in the security community.

• Purpose: Helps analysts track clusters of activities and understand the behavior of different threat groups.

• Components:

  • Threat Groups: Sets of related intrusion activities tracked by a common name.

  • Activity Groups: Clusters of activities using various analytic methodologies.

  • Campaigns: Specific intrusion sets or threat actors.

Practical Use Case

• Example: Comparing techniques used by APT3 (China-based) and APT29 (Russia-based).

  • Color Coding: Techniques unique to APT3 are blue, unique to APT29 are yellow, and common techniques are green.

  • Prioritization: Techniques in green (common to both groups) are high priority for mitigation and detection.

How to Use MITRE ATT&CK

• Start Small: Begin with a single threat group and analyze their behaviors using the ATT&CK framework.

• Leverage Tools: Use products and tools that map to ATT&CK to enhance your analysis.

• Collaborate: Work with other analysts and defenders to compare and contrast threat groups and improve your defense strategies.