Skip to main content
UploadLanguage (EN)Support
BusinessMobileSocial MediaMarketingTechnologyArt & PhotosCareerDesignEducationPresentations & Public SpeakingGovernment & NonprofitHealthcareInternetLawLeadership & ManagementAutomotiveEngineeringSoftwareRecruiting & HRRetailSalesServicesScienceSmall Business & EntrepreneurshipFoodEnvironmentEconomy & FinanceData & AnalyticsInvestor RelationsSportsSpiritualNews & PoliticsTravelSelf ImprovementReal EstateEntertainment & HumorHealth & MedicineDevices & HardwareLifestyle
MA
Uploaded byMITRE ATT&CK
PDF, PPTX1,647 views

State of the ATT&CK

The document discusses updates to the MITRE ATT&CK framework since ATT&CKcon 2.0 in 2020. Major updates include the addition of ATT&CK for ICS focusing on industrial control systems, enterprise sub-techniques providing more granular technique details, new platforms covering pre-attack behaviors, network infrastructure, cloud, and containers, and enhanced enterprise data sources. The ATT&CK framework continues to grow and improve based on contributions from a large community of cybersecurity professionals and organizations.

Technology◦
Download as PDF, PPTX
State of the ATT&CK Adam Pennington ATT&CK Lead @_whatshisface ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
System Owner/User Discovery (T1033) adamp$ whoami • He/him/his • Lead of MITRE ATT&CK • 13 years with MITRE • Focused on threat intel and deception • Past defender and CTI analyst • Involved with ATT&CK since it was a spreadsheet with no & • SCUBA diver certified for decompression and rebreather diving ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
MITRE ATT&CK Remains Strong ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
Almost 2.5 years since ATT&CKcon 2.0! ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
We’d already come a long way ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
Impact Data Destruction Data Encrypted for Impact Defacement Disk Content Wipe Disk Structure Wipe Endpoint Denial of Service Firmware Corruption Inhibit System Recovery Network Denial of Service Resource Hijacking Runtime Data Manipulation Service Stop Stored Data Manipulation Transmitted Data Manipulation © 2019 The MITRE Corporation. All rights reserved. Matrix current as of May 2019. Command and Control Commonly Used Port Communication Through Removable Media Connection Proxy Custom Command and Control Protocol Custom Cryptographic Protocol Data Encoding Data Obfuscation Domain Fronting Domain Generation Algorithms Fallback Channels Multiband Communication Multi-hop Proxy Multilayer Encryption Multi-Stage Channels Port Knocking Remote Access Tools Remote File Copy Standard Application Layer Protocol Standard Cryptographic Protocol Standard Non-Application Layer Protocol Uncommonly Used Port Web Service Exfiltration Automated Exfiltration Data Compressed Data Encrypted Data Transfer Size Limits Exfiltration Over Other Network Medium Exfiltration Over Command and Control Channel Exfiltration Over Alternative Protocol Exfiltration Over Physical Medium Scheduled Transfer Collection Audio Capture Automated Collection Clipboard Data Data from Information Repositories Data from Local System Data from Network Shared Drive Data from Removable Media Data Staged Email Collection Input Capture Man in the Browser Screen Capture Video Capture Lateral Movement AppleScript Application Deployment Software Distributed Component Object Model Exploitation of Remote Services Logon Scripts Pass the Hash Pass the Ticket Remote Desktop Protocol Remote File Copy Remote Services Replication Through Removable Media Shared Webroot SSH Hijacking Taint Shared Content Third-party Software Windows Admin Shares Windows Remote Management Credential Access Discovery Network Sniffing Account Manipulation Account Discovery Bash History Application Window Discovery Brute Force Credential Dumping Browser Bookmark Discovery Credentials in Files Credentials in Registry Domain Trust Discovery Exploitation for Credential Access File and Directory Discovery Network Service Scanning Forced Authentication Network Share Discovery Hooking Password Policy Discovery Input Capture Peripheral Device Discovery Input Prompt Permission Groups Discovery Kerberoasting Process Discovery Keychain Query Registry LLMNR/NBT-NS Poisoning and Relay Remote System Discovery Security Software Discovery Password Filter DLL System Information Discovery Private Keys Securityd Memory System Network Configuration Discovery Two-Factor Authentication Interception System Network Connections Discovery System Owner/User Discovery System Service Discovery System Time Discovery Virtualization/Sandbox Evasion Execution Persistence Privilege Escalation Defense Evasion Scheduled Task Binary Padding Launchctl Access Token Manipulation Local Job Scheduling Bypass User Account Control LSASS Driver Extra Window Memory Injection Trap Process Injection AppleScript DLL Search Order Hijacking CMSTP Image File Execution Options Injection Command-Line Interface Plist Modification Compiled HTML File Valid Accounts Control Panel Items Accessibility Features BITS Jobs Dynamic Data Exchange AppCert DLLs Clear Command History Execution through API AppInit DLLs CMSTP Execution through Module Load Application Shimming Code Signing Dylib Hijacking Compiled HTML File Exploitation for Client Execution File System Permissions Weakness Component Firmware Hooking Component Object Model Hijacking Graphical User Interface Launch Daemon InstallUtil New Service Control Panel Items Mshta Path Interception DCShadow PowerShell Port Monitors Deobfuscate/Decode Files or Information Regsvcs/Regasm Service Registry Permissions Weakness Regsvr32 Setuid and Setgid Disabling Security Tools Rundll32 Startup Items DLL Side-Loading Scripting Web Shell Execution Guardrails Service Execution .bash_profile and .bashrc Exploitation for Privilege Escalation Exploitation for Defense Evasion Signed Binary Proxy Execution Account Manipulation Authentication Package SID-History Injection File Deletion Signed Script Proxy Execution BITS Jobs Sudo File Permissions Modification Bootkit Sudo Caching Source Browser Extensions File System Logical Offsets Space after Filename Change Default File Association Gatekeeper Bypass Third-party Software Group Policy Modification Trusted Developer Utilities Component Firmware Hidden Files and Directories User Execution Component Object Model Hijacking Hidden Users Windows Management Instrumentation Hidden Window Create Account HISTCONTROL Windows Remote Management External Remote Services Indicator Blocking Hidden Files and Directories Indicator Removal from Tools XSL Script Processing Hypervisor Kernel Modules and Extensions Indicator Removal on Host Indirect Command Execution Launch Agent Install Root Certificate LC_LOAD_DYLIB Addition InstallUtil Login Item Launchctl Logon Scripts LC_MAIN Hijacking Modify Existing Service Masquerading Netsh Helper DLL Modify Registry Office Application Startup Mshta Port Knocking Network Share Connection Removal Rc.common Redundant Access NTFS File Attributes Registry Run Keys / Startup Folder Obfuscated Files or Information Re-opened Applications Port Knocking Screensaver Process Doppelgänging Security Support Provider Process Hollowing Shortcut Modification Redundant Access SIP and Trust Provider Hijacking Regsvcs/Regasm Regsvr32 System Firmware Rootkit Systemd Service Rundll32 Time Providers Scripting Windows Management Instrumentation Event Subscription Signed Binary Proxy Execution Signed Script Proxy Execution Winlogon Helper DLL SIP and Trust Provider Hijacking Software Packing Space after Filename Template Injection Timestomp Trusted Developer Utilities Virtualization/Sandbox Evasion Web Service XSL Script Processing Initial Access Drive-by Compromise Exploit Public-Facing Application External Remote Services Hardware Additions Replication Through Removable Media Spearphishing Attachment Spearphishing Link Spearphishing via Service Supply Chain Compromise Trusted Relationship Valid Accounts The real shape of ATT&CK at ATT&CKcon 2.0 ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
ATT&CK today (really) ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
What’s new since ATT&CKcon 2.0? ATT&CK for ICS Enterprise Sub-techniques PRE Platform Network Platform New Cloud and Containers Platforms Enterprise Data Sources ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
ATT&CK for ICS • Released January 7, 2020 • Adversary behaviors on Industrial Control Systems • Unique space • Unique adversaries • Parallel updates in own site ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
Enterprise Sub-techniques • Released July 8, 2020 • Added a new level to techniques • Most happy with the change • Most have made the switch • Coming over time to rest of ATT&CK ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
PRE Platform • Released October 27, 2020 • Replaced Pre-ATT&CK with two Tactics • Describes left of Initial Access ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
Network Platform • Released October 27, 2020 • Covers network infrastructure devices • Routers/Switches ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
New Cloud and Containers Platforms • Released April 29, 2021 • New Containers Platform • New Google Workspace Platform • IaaS replaced AWS, GCP, and Azure https://media.giphy.com/media/r3Yeh3aAjsyYGObizC/giphy.gif ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
Enterprise Data Sources Data Sources Before • Just a list of text strings • Inconsistent application • No details beyond the name • No descriptions behind them ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
Enterprise Data Sources in ATT&CK v9 Released April 29, 2021 ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
Enterprise Data Sources in ATT&CK v10 Released October 21, 2021 ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
Enterprise Data Sources in ATT&CK v10 ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
ATT&CK’s Community • ATTACK started with adversary data from MITRE deception ops • ATT&CK released to the public in May 2015 • ATT&CK’s community has kept us going ever since ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
ATT&CK’s Contributors @ionstorm Abel Morales, Exabeam Achute Sharma, Keysight Alain Homewood, Insomnia Security Alan Neville, @abnev Alex Hinchliffe, Palo Alto Networks Alex Soler, AttackIQ Alexandros Pappas Alfredo Abarca Alfredo Oliveira, Trend Micro Allen DeRyke, ICE Anastasios Pingios Andrew Smith, @jakx_ Antonio Villani, @LDO_CyberSec, Leonardo's Cyber Security Division Arie Olshtein, Check Point Ariel Shuper, Cisco Arnim Rupp, Deutsche Lufthansa AG Assaf Morag, @MoragAssaf, Team Nautilus Aqua Security Atul Nair, Qualys Aviran Hazum, Check Point Avneet Singh Ayan Saha, Keysight Barry Shteiman, Exabeam Bart Parys Bartosz Jerzman Bencherchali Nasreddine, @nas_bench, ELIT Security Team (DSSD) Bernaldo Penas Antelo Blake Strom, Microsoft 365 Defender Bobby, Filar, Elastic Brad Geesaman, @bradgeesaman Brent Murphy, Elastic Brian Wiltse @evalstrings Bryan Lee Carlos Borges, @huntingneo, CIP Carrie Roberts, @OrOneEqualsOne Casey Smith Center for Threat-Informed Defense (CTID) Chen Erlich, @chen_erlich, enSilo Chris Roffe Chris Ross @xorrior Christiaan Beek, @ChristiaanBeek Christoffer Strömblad Christopher Glyer, Mandiant, @cglyer Cody Thomas, SpecterOps Craig Aitchison CrowdStrike Falcon OverWatch Cybereason Nocturnus, @nocturnus Dan Borges, @1njection Dan Nutting, @KerberToast Daniel Oakley Daniel Prizmant, Palo Alto Networks Daniel Stepanic, Elastic Daniil Yugoslavskiy, @yugoslavskiy, Atomic Threat Coverage project Daniyal Naeem, BT Security Darren Spruell Dave Westgard David Ferguson, CyberSponse David Fiser, @anu4is, Trend Micro David French, Elastic David Lu, Tripwire David Routin Deloitte Threat Library Team Diogo Fernandes Dor Edry, Microsoft Doron Karmi, @DoronKarmi Drew Church, Splunk Ed Williams, Trustwave, SpiderLabs Edward Millington Elastic Elger Vinicius S. Rodrigues, @elgervinicius, CYBINT Centre Eli Salem, @elisalem9 Elia Florio, Microsoft Elly Searle, CrowdStrike — contributed to tactic definitions Emile Kenning, Sophos Emily Ratliff, IBM Eric Kuehn, Secure Ideas Erik Schamper, @Schamperr, Fox-IT Erika Noerenberg, @gutterchurl, Carbon Black Erye Hernandez, Palo Alto Networks ESET Expel ExtraHop Felipe Espósito, @Pr0teus Filip Kafka, ESET FIRST.ORG's Cyber Threat Intelligence SIG FS-ISAC Gaetan van Diemen, ThreatFabric Gal Singer, @galsinger29, Team Nautilus Aqua Security Gareth Phillips, Seek Ltd. George Allen, VMware Carbon Black Gordon Long, Box, Inc., @ethicalhax Hans Christoffer Gaardløs Harry Kim, CODEMIZE Harry, CODEMIZE Harshal Tupsamudre, Qualys Heather Linn Hiroki Nagahama, NEC Corporation Ibrahim Ali Khan Idan Frimark, Cisco Idan Revivo, @idanr86, Team Nautilus Aqua Security Isif Ibrahima Itamar Mizrahi, Cymptom Itzik Kotler, SafeBreach Ivan Sinyakov Jacob Wilkin, Trustwave, SpiderLabs Jacques Pluviose, @Jacqueswildy_IT James Dunn, @jamdunnDFW, EY Jan Miller, CrowdStrike Jan Petrov, Citi Janantha Marasinghe Jannie Li, Microsoft Threat Intelligence Center (MSTIC) Jared Atkinson, @jaredcatkinson Jaron Bradley @jbradley89 Jay Chen, Palo Alto Networks Jean-Ian Boutin, ESET Jeff Felling, Red Canary Jeff Sakowicz, Microsoft Identity Developer Platform Services (IDPM Services) Jen Burns, HubSpot Jeremy Galloway Jesse Brown, Red Canary Jimmy Astle, @AstleJimmy, Carbon Black Joas Antonio dos Santos, @C0d3Cr4zy Joas Antonio dos Santos, @C0d3Cr4zy, Inmetrics Johann Rehberger John Lambert, Microsoft Threat Intelligence Center John Strand Jon Sheedy Jon Sternstein, Stern Security Jonathan Boucher, @crash_wave, Bank of Canada Jonathan Shimonovich, Check Point Jonhnathan Ribeiro, 3CORESec, @_w0rk3r Jorell Magtibay, National Australia Bank Limited Jorge Orchilles, SCYTHE Jose Luis Sánchez Martinez Josh Abraham Josh Campbell, Cyborg Security, @cyb0rgsecur1ty Josh Day, Gigamon Josh Liburdi, @jshlbrd João Paulo de A. Filho, @Hug1nN__ Justin Warner, ICEBRG Jörg Abraham, EclecticIQ Karim Hasanen, @_karimhasanen Kaspersky Katie Nickels, Red Canary Kiyohito Yamamoto, RedLark, NTT Communications Kobi Eisenkraft, Check Point Kobi Haimovich, CardinalOps Kyaw Pyiyt Htet, @KyawPyiytHtet Kyoung-ju Kwak (S2W) Lab52 by S2 Grupo Lacework Labs Lee Christensen, SpecterOps Leo Loobeek, @leoloobeek Leo Zhang, Trend Micro Lior Ribak, SentinelOne Loic Jaquemet Lorin Wu, Trend Micro Lucas da Silva Pereira, @vulcanunsec, CIP Lukáš Štefanko, ESET Maarten van Dantzig, @MaartenVDantzig, Fox-IT Magno Logan, @magnologan, Trend Micro Manikantan Srinivasan, NEC Corporation India Marc-Etienne M.Léveillé, ESET Maril Vernon @shewhohacks Mark Wee Martin Jirkal, ESET Martin Smolár, ESET Martin Sohn Christensen, Improsec Mathieu Tartare, ESET Matias Nicolas Porolli, ESET Matt Brenton, Zurich Global Information Security Matt Brenton, Zurich Insurance Group Matt Burrough, @mattburrough, Microsoft Matt Graeber, @mattifestation, SpecterOps Matt Kelly, @breakersall Matt Snyder, VMware Matthew Demaske, Adaptforward Matthew Molyett, @s1air, Cisco Talos Matthieu Faou, ESET Mayuresh Dani, Qualys McAfee Menachem Shafran, XM Cyber Michael Cox Michael Katchinskiy, @michael64194968, Team Nautilus Aqua Security Michal Dida, ESET Microsoft Detection and Response Team (DART) Microsoft Security Microsoft Threat Intelligence Center (MSTIC) Mike Burns, Mandiant Mike Kemmerer Milos Stojadinovic Mnemonic Mnemonic AS Mugdha Peter Bansode Nathaniel Quist, Palo Alto Networks Naveen Vijayaraghavan, Nilesh Dherange (Gurucul) Netskope Nick Carr, Mandiant Nik Seetharaman, Palantir Nino Verde, @LDO_CyberSec, Leonardo's Cyber Security Division Nishan Maharjan, @loki248 Oddvar Moe, @oddvarmoe Ofir Almkias, Cybereason Ohad Mana, Check Point Oleg Kolesnikov, Securonix Oleg Skulkin, Group-IB Oleksiy Gayda Omkar Gudhate Patrick Campbell, @pjcampbe11 Patrick Sungbahadoor Paul Speulstra, AECOM Global Security Operations Center Pawan Kinger, @kingerpawan, Trend Micro Pedro Harrison Phil Stokes, SentinelOne Philip Winther Pooja Natarajan, NEC Corporation India Praetorian Prasad Somasamudram, McAfee Prasanth Sadanala, Cigna Information Protection (CIP) - Threat Response Engineering Team Prashant Verma, Paladion Rahmat Nurfauzi, @infosecn1nja, PT Xynexis International Red Canary RedHuntLabs, @redhuntlabs Regina Elwell Rex Guo, @Xiaofei_REX, Confluera Ricardo Dias Richard Gold, Digital Shadows Richie Cyrus, SpecterOps Rick Cole, Mandiant Rob Smith Robby Winchester, @robwinchester3 Robert Falcone Robert Simmons, @MalwareUtkonos Robert Wilson Rodrigo Garcia, Red Canary Roi Kol, @roykol1, Team Nautilus Aqua Security Romain Dumont, ESET Rory McCune, Aqua Security Ruben Dodge, @shotgunner101 Ryan Becwar Ryan Benson, Exabeam Ryo Tamura, SecureBrain Corporation Sahar Shukrun Saisha Agrawal, Microsoft Threat Intelligent Center (MSTIC) SarathKumar Rajendran, Trimble Inc Scott Knight, @sdotknight, VMware Carbon Black Scott Lundgren, @5twenty9, Carbon Black Sebastian Salla, McAfee Sekhar Sarukkai, McAfee Sergey Persikov, Check Point Shailesh Tiwary (Indian Army) Shane Tully, @securitygypsy Shlomi Salem, SentinelOne Shotaro Hamamoto, NEC Solution Innovators, Ltd Shuhei Sasada, Cyber Defense Institute, Inc Silvio La Porta, @LDO_CyberSec, Leonardo's Cyber Security Division SOCCRATES Stan Hegt, Outflank Stefan Kanthak Steven Du, Trend Micro Sudhanshu Chauhan, @Sudhanshu_C Sunny Neo Suzy Schapperle - Microsoft Azure Red Team Swapnil Kumbhar Swetha Prabakaran, Microsoft Threat Intelligence Center (MSTIC) Syed Ummar Farooqh, McAfee Sylvain Gil, Exabeam Sébastien Ruel, CGI Takuma Matsumoto, LAC Co., Ltd Tatsuya Daitoku, Cyber Defense Institute, Inc. Ted Samuels, Rapid7 Teodor Cimpoesu The DFIR Report, @TheDFIRReport Thijn Bukkems, Amazon Tim (Wadhwa-)Brown Tim MalcomVetter Toby Kohlenberg Tom Ueltschi @c_APT_ure Tony Lambert, Red Canary Travis Smith, Tripwire Trend Micro Incorporated Tristan Bennett, Seamless Intelligence Vadim Khrykov Valerii Marchuk, Cybersecurity Help s.r.o. Varonis Threat Labs Veeral Patel Vikas Singh, Sophos Vinayak Wadhwa, Lucideus Vincent Le Toux Viren Chaudhari, Qualys Vishwas Manral, McAfee Walker Johnson Wayne Silva, F-Secure Countercept Wes Hurd Will Thomas, Cyjax William Cain Yaniv Agman, @AgmanYaniv, Team Nautilus Aqua Security Ye Yint Min Thu Htut, Offensive Security Team, DBS Bank Yonatan Gotlib, Deep Instinct Yoshihiro Kori, NEC Corporation Yossi Nisani, Cymptom Yossi Weizman, Azure Defender Research Team Yusuke Kubo, RedLark, NTT Communications Yusuke Niwa, ITOCHU Corporation Yuval Avrahami, Palo Alto Networks Zaw Min Htun, @Z3TAE Ziv Karliner, @ziv_kr, Team Nautilus Aqua Security Ziv Kaspersky, Cymptom 308 orgs and individuals 82 in 2019 130 in 2020 155 in 2021 4.5pt font ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
The Future ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
ATT&CK for Mobile • Sub-technique beta coming in next ATT&CK release (April) • Final release this summer (depending on feedback) • Next up: Data Sources Blog post at https://bit.ly/ATTMob ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
ATT&CK Update Presentations Defensive ATT&CK Campaigns ICS ATT&CK Mac/Linux ATT&CK ATT&CK’s Open Source ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
ATT&CK Updates: Defensive ATT&CK • Today – 1:30pm EDT • Lex Crumpton • Refactoring detections in Enterprise • Today a text blob • Soon structured and tied to data sources • Dealing with multiple platform sources • Upcoming changes to CAR ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
ATT&CK Updates: Campaigns • Today – 3:45pm EDT • Matt Malone 1. Grouping of intrusion activity 2. Specific period of time 3. Common targets, objectives • Enable unnamed activity • Retain nuance from reporting ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
ATT&CK Updates: ICS ATT&CK • Tomorrow – 10:15am EDT • Otis Alexander • Moving to attack.mitre.org in v11 • Expanding assets • Adding detections • Improving Enterprise parity ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
ATT&CK Updates: Mac/Linux ATT&CK • Tomorrow – noon EDT • Cat Self • Unique spaces getting focused attention • Ongoing review improvement of Mac techniques • Starting in on similar improvements to Linux ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
ATT&CK Updates: ATT&CK’s Open Source • Tomorrow – 2:15pm EDT • Jared Ondricek • Many resources from us that you can use • ATT&CK Navigator • Layer manipulation scripts • Our website • More at https://github.com/mitre-attack/ ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
There’s one more thing… ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
Next ATT&CK release April 25! Miss Congeniality (2000) ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.
https://attack.mitre.org attack@mitre.org @mitreattack Adam Pennington @_whatshisface ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-00706-27.