Scribd
Upload
3 views1 page

Soc Analyst Room Four

FireEye's document outlines the structure of adversary behavior, differentiating between tactics (goals), techniques (methods), and procedures (execution). It references the MITRE ATT&CK® framework, which was developed from real-world observations and aims to enhance understanding of adversarial tactics and techniques. Additionally, it discusses a phishing mitigation technique focused on restricting access to potentially harmful web-based content.

Uploaded by

farahfarhouna1234
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
3 views1 page

Soc Analyst Room Four

FireEye's document outlines the structure of adversary behavior, differentiating between tactics (goals), techniques (methods), and procedures (execution). It references the MITRE ATT&CK® framework, which was developed from real-world observations and aims to enhance understanding of adversarial tactics and techniques. Additionally, it discusses a phishing mitigation technique focused on restricting access to potentially harmful web-based content.

Uploaded by

farahfarhouna1234
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
You are on page 1/ 1

FireEye's current list of APT groups

The Tactic is the adversary's goal or objective.


The Technique is how the adversary achieves the goal or objective.
The Procedure is how the technique is executed.
The behavior of an actor. A tactic is the highest-level description of the
behavior; techniques provide a more detailed description of the behavior in the
context of a tactic; and procedures provide a lower-level, highly detailed
description of the behavior in the context of a technique.
Sources:
NIST SP 800-172 from NIST SP 800-150
the tactics are the "why"
the techniques are the "how"
"MITRE ATT&CK® is a globally-accessible knowledge base of adversary tactics and
techniques based on real-world observations."
This started with an internal project known as FMX (Fort Meade Experiment). Within
this project, selected security professionals were tasked to emulated adversarial
TTPs against a network, and data was collected from the attacks on this network.
The gathered data helped construct the beginning pieces of what we know today as
the ATT&CK® framework.
MITRE ATT&CK® Navigator: "The ATT&CK® Navigator is designed to provide basic
navigation and annotation of ATT&CK® matrices, something that people are already
doing today in tools like Excel. We've designed it to be simple and generic - you
can use the Navigator to visualize your defensive coverage, your red/blue team
planning, the frequency of detected techniques, or anything else you want to do."
phishing mitigation technique : "M1021 Restrict Web-Based Content
Determine if certain websites or attachment types (ex: .scr, .exe, .pif, .cpl,
etc.) that can be used for phishing are necessary for business operations and
consider blocking access if activity cannot be monitored well or if it poses a
significant risk."

You might also like