ADVERSARY DETECTION PIPELINES: FINALLY MAKING YOUR THREAT INTEL USEFUL🎚️

🎙️NIRVANA MTV Unplugged New York Spotify Playlist🎙️

"It's better to burn out than to fade away" - Kurt Cobain

Security teams often feel like they’re in a losing battle with threat intel. They don’t know how to make threat intel useful or operationalize it within their organizations, especially if there isn’t a dedicated full-time team. In this talk, we’ll help you extract more value out of your threat intel program, giving you an easy win to level up not just your team, but the other teams in your security department. First, we’ll explore why true attribution is so hard, from false flag operations and proxy attackers to obtaining all the forensic data you would need and even possible coordination with law enforcement or government agencies to perform true attribution. We’ll discuss TTPs and how they’re a lower-cost way of tracking threat activity groups for most organizations. Then we’ll introduce Adversary Detection Pipelines, how they can add value through prioritizing defensive and offensive activities as well as a discussion on the practical implementation of them in any organization. Finally, we’ll conclude by looking at case studies of how purple teams can leverage Adversary Detection Pipelines to enhance their operations and encourage an intelligence driven security program.

🚬"I'M SO HAPPY 'CAUSE TODAY I FOUND MY FRIENDS, THEY'RE IN MY HEAD" - Kurt Cobain

😎Ch33r10's CTI Capability Model Self-Assessment Spreadsheet - Link

Citation: Shin, B., & Lowry, P. B. (2020). A review and theoretical explanation of the ‘Cyberthreat-Intelligence (CTI) capability’ that needs to be fostered in information security practitioners and how this can be accomplished. Computers & Security 92(101761), pages 1-16. https://doi.org/10.1016/j.cose.2020.101761

🕯️ADVERSARY DETECTION PIPELINES

INTERNAL ATTACK DATA	MANAGEMENT	INTELLIGENCE	EMERGING THREATS
Email, Incident Tickets, Red/Purple Ops	Their concerns/agenda etc.	Industry vertical, previous/current targeting, open source, paid, etc.	Org Relevant trending/new threats

🔗ADVERSARY DETECTION PIPELINE CYCLE

1. CTI - Prioritized Collection and Research for Relevant Threats
2. CTI ANALYSIS - Analysis and Preparation of Deliverable
3. OTHER TEAMS - Red, Hunt, Purple, SOC, Detection Engineering ACT on CTI provided context
4. FEEDBACK/INPUT - Communication and Collaboration
5. RINSE & REPEAT

⚡🎸"HERE WE ARE NOW, ENTERTAIN US" - Kurt Cobain

The resources below are pointers...all you gotta do is pull that string and keep pulling.

📻ATTRIBUTION

• Brian Bartholomew & Juan Andres Guerrero-Saade. Wave Your False Flags! Deception Tactics Muddying Attribution in Targeted Attacks - Link
• Jake Williams. Conducting a Successful False Flag Operation. BlackHat Europe 2019 - Link
• Jason D. Jolley. Attribution, State Responsibility, and the Duty to Prevent Malicious Cyber-Attacks in International Law - Link
• Katie Nickels. The Attribution Game: When Knowing Your Adversary Matters - Link
• Robert M. Lee. The Problems with Seeking and Avoiding True Attribution to Cyber Attacks - Link
• Thomas Rid & Ben Buchanan. Attributing Cyber Attacks - Link
• Tim Maurer. Cyber Mercenaries: The State, Hackers, and Power - Link

🦾TTPs

• Adam Pennington. Emulating an Adversary with Imperfect Intelligence. DEF CON 28 Red Team Village - Link
• MITRE ATT&CK TTP Training - Link
• MITRE ENGENUITY - ATT&CK Evaluations - Link

🔥CYBER THREAT INTELLIGENCE

• Amy Bejtlich. Analytic Tradecraft in the Real World - Link
• Bongsik Shin and Paul Benjamin Lowry. A review and theoretical explanation of the ‘Cyberthreat-Intelligence (CTI) capability’ that needs to be fostered in information security practitioners and how this can be accomplished - Link
• Brian P. Kime. Threat Intelligence: Planning and Direction - Link
• MITRE ATT&CK - Link
• Rebekah Brown & Robert M. Lee. The Evolution of CTI: 2019 SANS CTI Survey - Link
• Scott J. Roberts. CTI Squad Goals-Setting Requirements - Link
• Sergio Caltagirone. Building Threat Hunting Strategies with the Diamond Model - Link
• Sergio Caltagirone, Andrew Pendergast, & Christopher Betz. The Diamond Model of Intrusion Analysis - Link

👑DETECTION ENGINEERING

• Detection Ideas Repo by Vadim Khrykov @BlackMatter23 - Link
• Sigma Rules Repository - Link
• YARA Rules Resource - Link

🕶DFIR

• Ali Hadi's DFIR Resources - Link
• The DFIR Report - Link

🌎HUNT

• Ch33r10's Twitter Threat Hunting List - Link
• David J. Bianco and Cat Self. SANS Threat Hunting & IR Europe Summit 2020 - Link
• David J. Bianco. The ThreatHunting Project - Link
• Joshua Stevens. Hunting for the Undefined Threat: Advanced Analytics & Visualization. RSA Conference 2015 - Link
• Matt Bromiley. Thinking like a Hunter: Implementing a Threat Hunting Program. SANS Analyst Paper - Link
• Robert M. Lee and David J. Bianco. Generating Hypotheses for Successful Threat Hunting. SANS Analyst White Paper - Link
• Roberto Rodriguez. How Hot is your Hunt Team? - Link
• Roberto Rodriquez. ThreatHunter Playbook - Link
• Valentina Costa-Gazcon. Practical Threat Intelligence and Data-Driven Threat Hunting - Link

👾MALWARE ANALYSIS

• Coleman Kane. Malware Analysis - Link
• Monnappa K A. Learning Malware Analysis - Link

🌠PURPLE

• Ch33r10's Purple Team Exercise Idea Queue - Link
• Ch33r10's Purple Team Resources - Link
• Jorge Orchilles. Purple Team Exercise Framework Workshop - Link
• SCYTHE’s Purple Team Exercise Framework - Link
• SCYTHE's Community Threats - Link

👹RED

• Atomic Red Team by Red Canary - Link
• C2 Matrix - Link
• Joe Vest & James Tubberville's Red Team Development and Operations - Link
• Red Teaming Techniques & Experiments - Link
• SpecterOps Blog - Link
• Vincent Yiu's Red Team Tips - Link

🎵RESOURCES

• Attack2Jira by Mauricio Velazco and Olindo Verrillo - Link
• Ch33r10's Field Classifications Contribution for Attack2Jira by Mauricio Velazco and Olindo Verrillo - Link
• MITRE CAR - Cyber Analytics Repository - Link
• MITRE D3FEND - Link
• MITRE SHIELD - Link
• MITRE ATT&CK Navigator - Link
• NIST Cybersecurity Framework, MITRE ATT&CK v8.2, & CIS Controls v8 CSV (Mappings Compliments of CIS - Center for Internet Security) - Link

---

FOR THE LAWYERS

_{"The opinions expressed in this Github repo are those of the individual account, in their individual capacity, and not necessarily those of the employers. Mention of any vendors, services, products, or otherwise does not endorse them as a vendor. This content and any related discussions are solely the views, opinions, and experiences of the participants and should not be presumed to reflect the opinion or the official position of any employers of the participants. Examples and views provided herein, including strategies, goals, targets, and indicators are for illustrative purposes only and should not be regarded as representative of the participants' employers or respective portfolios. To the extent that this participation, discussion, and interview outlines a general technology direction, the participants' employers have no obligation to pursue any such approach or to develop or use any functionality mentioned herein. Any suggested technology strategy or possible future developments are subject to change at the employers' sole discretion without notice. Content in this presentation is the intellectual property of the applicable creators and may be protected under the copyright laws of the United States and/or other countries. All trademarks are the property of their respective owners and are used for informational purposes only."}