MITRE Attack Design & Philosophy Essay

ATT&CK Framework Abstract:

By reading the popular white paper called “MITRE Attack Design & Philosophy” one can be armed with the knowledge that this framework was created out of sheer necessity to be able to classify how threat actors can be better categorized as part of a larger project called Fort Meade Experiment. Many may be aware of the different well recognized project the MITRE Corporation leads but others just know it as the company who put together the ATT&CK matrix and is commonly discussed day-to-day through the security industry and at most conferences. The ATT&CK framework stands for Attackers Tactics, Techniques, and Common Knowledge and its used in the various sectors that deal with information technology to determine what potential methods adversaries may use along their attack lifecycle. MITRE is known for their rigorous research and white papers that they produce that aid companies as they are normally involved with the latest trends in technology such as adversary emulation, machine learning, and common risk assessment methods. Through research it can be discovered that this body of knowledge was meant for the world to further understand what adversaries were being carried out from real world analysis that led to the “assume breach” mindset. It was first put together in 2013 and had the scope of only focusing on windows systems. Once it was released to the world two years later, there was a great response from the community which led to its expansion of techniques and addition of 3 more tactics. There are a few other popular resources that help defenders understand attack methods although the matrix has taken off due to the fact that many threat hunting teams and red teams are using the techniques in ATT&CK as a reference point. It differs from other frameworks as it’s not theoretical and it’s heavily derived from available information and reports that were gathered at the time of creation. The goal of defenders is to be able to mitigate attacks regardless of where their adversary is in their lifecycle, by having a breakdown such as the matrix it allows for a defined scope of research and for juniors to catch up to speed in an organized manner. ATT&CK can help out when creating metrics and reports to be able to apply countermeasures for non-technical folks. 

ATT&CK is post-exploit focused. I’ll help you explain the concept of “post-exploit” as if you were describing it to a group of high-level, non-technical managers. 

Post-exploitation boils down to the attack commands or methods used by a cyber-criminal once they gain access to their target system. Prior to jumping deeper into the post-exploitation concept that ATT&CK aims to share with the world, the audience must be familiar with the Lockheed Martin Cyber Kill Chain phases. The Cyber Kill Chain which is derived from the military in its terminology, includes the seven phases of a cyber attack’s lifecycle. The first four are focused on how an attacker is able to collect information, use it to his advantage, get it to its victim and gain access to their network or infrastructure; there are a few more steps but the ATT&CK Framework picks up at the phase where the adversary gains initial access.

Statistics for 2018 show that the average time it takes for a company to figure out it’s had a data breach is roughly around 190 days plus. Previously it was loosely stated that many networks could have been compromised for years although having the data helps clear any confusion as to why the concept of “post-exploitation” has become a hot topic.  “It’s not a matter of if, but when we’re breached” is a common mentality that has been overstated in the industry so it helps defenders know that the bad guy will get on the system regardless, the battleground consists of the steps taken to go from there.

The post-exploitation mindset allows defenders to focus on tactics and techniques across their networks and endpoint systems to look for behaviors that may be related to those included in the MITRE ATT&CK Matrix. This allows a company to improve their cyber skills and understand what’s going on across their collective devices that their business operates on to create profit. There are many things that a bad guy can do once they’re on the system just as keep their access for a long period of time by simply sitting on systems that are not being monitored as they are considered trusted by its owners and users.

From there the attacker can slowly gather information on the network to be able to improve their abilities and actions that are allowed on the systems they’re taking advantage of, this is known as privilege escalation. Once that action is performed or prior to performing an attack dealing with increasing their permissions they might have also tried doing it in a method to not set off any alarms categorized under defense evasion. This is the key item that differentiates the skill set of said threat actors; if they’re new or sloppy they typically don’t mind leaving evidence behind. If it’s a highly trained individual, they will slowly crawl their way around the company systems in attempts to evade every protection solution.

After all, once they’re on the network they will see what protection if any has been installed to understand what they’re up against. To further expand on the defense evasion, it’s common for the malware which is being delivered to the target to be encoded in such a way that it’s undetectable by common AV and security solutions as its signature has been altered and does not yet have a record in common databases.

In order for a defender to be able to respond and limit the area of possible attack they must understand how their opponent thinks and will attack. A framework like ATT&CK provides the springboard for many professionals to quickly reference and learn about all of the specific methods that may be used against them. 

We will explore 2 tactics under “Defense Evasion” 

What is defense evasion? The concept of defense evasion is a tactic that must be performed by an adversary, red team, or penetration test in order to not set off any potential alarms or traps left behind by the blue teams who defend and monitor all systems of a network. There are many security tools in the market which check for similar signatures and attacks that have been previously identified, what the adversary does is that they have to modify their code in order to alter it to a way that it performs the original goal but does not appear as malicious to security solutions. As it was previously mentioned, encoding the shellcode used for exploits is a common way to get to the original objective without getting noticed.

Tactic #1

Process hollowing occurs when a process is in a suspended state which means that it’s been transferred to the disk, the process then has no memory assigned (unmapped) to it then it injects a malicious code to the process instead and runs as the original one without looking suspicious initially.

A popular observed process of hollowing malware is Hancitor, a Windows-based downloader.  In one example found online, the delivery of Hancitor came from malicious links in the body of an email message which sent users to compromised websites hosting the Hancitor Word document.  If the email recipient decides to visit the malicious website, download the document, and open it, the user will be confronted with an embedded image that provides instructions for how to enable and supposedly view the content.

The document instructs the user to select the “Enable Content” button which will allow the malicious macro code to run.  

The macro itself consists of three components:

1. Form that contains the encoded shellcode as text values embedded into various form control properties.
2. Macro containing the main logic of the malicious code
3. Additional module that includes functionality for decoding the embedded shellcode.

These individual components have randomly generated names that vary depending on the sample under analysis. The main logic of the macro code is set off with a call to the “Document_Open()” function which is initiated when MS Word opens the document, or the user enables macros. The code includes randomly named variables and contains a large amount of unnecessary code designed to frustrate the analysis process.  As the code executes, it will extract, de-obfuscate, and run shellcode from text values contained within the form. To do so, it makes use of several Windows API functions to allocate space in memory, write the decoded binary to that memory, and transfer control to the shellcode.

Tactic #2

Another common defense evasion technique is called DCShadow or DCSync Attack which has been heavily documented by Red Team Operators. “DCShadow takes advantage of Active Directory data by registering a rogue Domain Controller by emulating an authorized server.

The only requirement to perform this technique in a successful way requires getting access to an account that has permissions to replicate directory changes. A tool such as the Active Directory Access Control List scanner can be used to find accounts with this configuration.

Once access to that account has been compromised the attack can be carried out using Mimikatz and extracting the Kerberos hash then proceeding to generate a golden ticket which allows an adversary to evade defenses by getting approved credentials through the Windows architecture designed by Microsoft. The “rundll32.exe” native program can be used to run malicious code as it’s normally a whitelisted item and runs with high privileges. A common theme is that if a process, program, or account is compromised to perform any action it will run with those privileges allowing defenses to be bypassed.

We will explore 2 tactics under “Lateral Movement” 

What is Lateral movement? This is when an adversary or authorized security professional is able to gain initial access from one system to the next remotely without having to further exploit systems. Successful lateral movement enables the bad guy to easily roam the network and its system by performing additional internal reconnaissance to discover high value targets. The easiest analogy that comes to mind is someone finding an open window going inside the house then, finding car keys on the table which then they use to drive the car to their original destination. If a person doesn’t pay a toll, it will be traced back to the person who owns the plates of the car. 

Best practices recommend that critical systems be designed in a way where only authorized resources have access or have the ability to log onto them remotely. Which would limit it being abused as a jump host by an unauthorized individual.

Tactic #1

Passing-The-Hash has been the most common technique for the last decade by ethical hackers, threat actors, and professionals but it is slowly fading out is. Modern systems have enhanced monitoring and logging which is making it harder to pass the hash. When the attack is successful the next step is pillaging through its directories, cron jobs, locations where configuration files live. 

Command and Control Primer