LibGuides: CYB455: Module 3

Module 3 Required Resources

Practical Threat Intelligence and Data-Driven Threat Hunting by Valentina Costa-Gazcón
ISBN: 9781838556372

Publication Date: 2021-02-12

alacin, V. (2020). Practical Threat Intelligence and Data-Driven Threat Hunting. Packt Publishing.
Chapter 4: Mapping the adversary

This chapter introduces you to the MITRE ATT&CK framework and explores two use cases to show how to map the adversary’s behavior to this framework.

Chapter 6: Emulating the adversary

This chapter teaches you how to emulate an adversary following their TTPs using tools such as CALDERA. This exercise goes one step beyond regular red teaming activities of pen testing.

TTP-Based Hunting
MITRE ATT&CK matrix
An interactive guide to MITRE ATT&CK matrix showing the 14 tactics, the techniques under each tactic and the set of procedures for each technique. In addition to the TTPs, MITRE also provides a list of mitigations that could be implemented to prevent the technique, along with detection recommendations.
Inside Formbook Infostealer
This paper was presented at Virus Bulletin 2018 discucsses Formbook infostealer that has been around since at least 2016. It has been used in several campaigns that have impacted both the US and South Korea and is also related to some threat actors, such as SWEED and Cobalt.

MITRE ATT&CK Framework (4 minutes)
mitrecorp. (2021, January 25). MITRE ATT&CK® Framework [Video]. YouTube. https://www.youtube.com/watch?v=Yxv1suJYMI8
MITRE gives a concise description about MITRE ATT&CK framework.
MITRE Caldera – automatically emulating adversary (60 minutes)
BruCON Security Conference. (2019, October 10). Automated adversary emulation using Caldera - Erik Van Buggenhout [Video]. YouTube.
https://www.youtube.com/watch?v=lyWJJRnTbI0
In SANS Pentest Hackfest 2019, Eric Van Buggenhout describes what adversary emulation is and go into details of MITRE Caldera which is a tool that allows you to emulate adversaries.

MITRE ATT&CK: Design and Philosophy
This paper discuss the motivation behind creating MITRE ATT&CK matrix, its design philosophy and how it can be used.
APT3 emulation plan
This paper describe how to use CALDERA to emulate APT3 threat actor.