How Breach and Attack Simulation Helps You to Operationalize MITRE ATT&CK

MITRE ATT&CK has become a go-to framework for security teams. Yet, by being so comprehensive, it can be difficult to know where to begin in your mission to operationalize it.

In this blog, we offer advice to help get started with ATT&CK and explain how Breach and Attack Simulation (BAS) can be used to accelerate your efforts to leverage it in your daily security operations.

Areas we cover:

• Getting starting with ATT&CK
• Becoming proactive in your approach 
• Responding to evolving attacker behaviors
• Operationalizing ATT&CK with Breach and Attack Simulation(BAS)
• How Picus can improve your success

Getting starting with ATT&CK

Starting out with MITRE ATT&CK can initially seem daunting. Containing over 180 techniques and 375 sub-techniques (distinct ways that attackers perform malicious activities) the framework is very thorough - making it tricky to decide where to focus your attention.

A key piece of advice before starting out is to forgo any ambition to achieve complete threat coverage. Very few organizations have the time and resources needed to observe every adversary behavior. Instead, focus on identifying threat actors that pose the greatest risk to your organization and the types of tactics and techniques they use.

On the MITRE’s website, there is a list of prominent adversary groups. Conduct a search to identify the adversaries that are more likely to target your organization based upon the vertical industry in which you operate. Learn about the techniques they exhibit and apply this information to create a prioritized list of required detections. To help identify the most common techniques, try using MITRE’s free ATT&CK Navigator tool, which can help you to visualize the behaviors of multiple threat groups simultaneously.

Becoming more proactive in your approach 

Identifying and detecting the activities of the threat actors that are more likely to target your organization will provide a solid foundation to leverage the framework further. However, to keep up-to-date with new threats that emerge daily, you’ll need to become more proactive in your approach.

Being proactive in your use of ATT&CK will require you to use cyber threat intelligence to observe new threat behaviors and then map these to the framework. Threat intelligence can be curated from open-source and commercial threat feeds as well as your own internal investigations. Leverage whatever data is available to you.

At this stage of your journey to operationalize ATT&CK, things can quickly start to become more complex. Discovering and mapping emerging threat behaviors is rarely straightforward and can easily become a drain on your resources.

A significant amount of time and effort for defenders to build new detections to identify high-risk behaviors must also be factored in. New detections will require new correlation rules to be developed and tested. 

As a rough guide, it can take a security engineer approximately seven hours to write and implement a new detection rule. Additional time will need to be allocated if new data sources are needed to achieve the visibility required.

Responding to evolving attacker behaviors

Although improving your coverage of ATT&CK might be labor intensive, the ever-evolving threat landscape makes this vital if you are to achieve a greater level of assurance.

To illustrate this point, The Picus Red Report found that over half of the top ten most commonly observed ATT&CK techniques in 2021 did not appear on the equivalent list in 2020 - highlighting the extent to which adversarial approaches change.

For the same reason, you can never be 100% sure of identifying a given technique in your environment. To improve their chance of success, adversaries will continue to think up new ways to execute attacks, making it important to regularly review and validate your existing coverage.

Operationalizing ATT&CK with Breach and Attack Simulation(BAS)

If your organization is thinking of adopting ATT&CK or is struggling to take your use of it to the next level, Breach and Attack Simulation is a great way to accelerate your approach, reduce the level of manual effort required to operationalize the framework, and measure the success of your actions.

BAS platforms, such as The Complete Security Control Validation Platform by Picus, simulate real-world cyber-threats to automatically and continuously validate security control effectiveness. 

By identifying prevention and detection gaps, BAS can be used to determine the threat behaviors that pose the greatest risk to your organization and help you take swifter action to mitigate them.

How Picus can improve your success

The Picus Complete Security Control Validation Platform is an end-to-end BAS solution for security control validation; one that not only validates the performance of security controls but also provides actionable insights to get the best protection from them.

The Picus platform can help you to operationalize ATT&CK more swiftly and effectively by challenging the effectiveness of your network security, SIEM and EDR tools and by mapping assessment results to the framework automatically.

With Picus, quickly and easily simulate malware, ransomware and web application attacks, and techniques to exploit vulnerabilities such as Log4j. The Picus Threat Library contains over 11,000 threat samples and is updated daily by offensive security experts - reducing the need for your in-house security team to monitor cyber threat intelligence to discover new tactics, techniques and procedures (TTPs).

To identify and help address threat coverage and visibility blind spots, Picus validates that detection rules are in place and that they reliably trigger alerts. For any gaps identified, the platform supplies log source suggestions and vendor-specific prevention signatures and detection rules.

To help you get started, Picus’ customer success team will guide you through how to use the platform with ATT&CK so that you are able to identify and prioritize mitigating the greatest risks to your organization.

See Picus in action

Watch this short video to discover how our award-winning platform helps to take the hard work out of operationalizing ATT&CK. In it, we demonstrate how to simulate OS Credential Dumping - one of the top ten most common ATT&CK techniques observed by Picus in the Red Report 2021 - and see the results of the assessment mapped to the framework.

Want to learn more? Please reach out to our friendly team to request a personal demo of our platform and learn how it can help you to improve your organization’s cyber resilience.