TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Huntress

Exploring the Value of Indicators In Small Business Defense

2023-12-07 · Read original ↗

ATT&CK techniques detected

6 predictions
T1021.001Remote Desktop Protocol
96%
“to approach this ideal. but for many organizations, particularly within the smb space, having any security program at all is a significant milestone, let alone one that applies a best - of - class approach to information that many dedicated information security vendors fail to me…”
T1486Data Encrypted for Impact
95%
“hostname : desktop - 3itpfta. while this host has migrated across multiple hosting ip addresses, identifying rdp ( or any ) activity from this system name represented a high - confidence observable during the time of this ransomware campaign that entities could use to rapidly ide…”
T1071.001Web Protocols
93%
“a compromise investigation. unfortunately, iocs are often conflated with raw indicators : technical data or observables but not yet linked to a known compromise, or leveraged outside of forensic analysis. differentiating between iocs and indicators used for other purposes, such a…”
T1080Taint Shared Content
54%
“hostname : desktop - 3itpfta. while this host has migrated across multiple hosting ip addresses, identifying rdp ( or any ) activity from this system name represented a high - confidence observable during the time of this ransomware campaign that entities could use to rapidly ide…”
T1018Remote System Discovery
35%
“. in his influential “ pyramid of pain ” blog, bianco emphasizes how “ simple ” indicators ( hash values, ip addresses, domain names ) are trivially changed and highly ephemeral in adversary operations. this point has been repeated and refined by many in the decade since. yet des…”
T1592Gather Victim Host Information
34%
“##components of technical indicators — such as the hosting provider for a given ip address or specific functions in a malware sample — become items enabling further analysis and behavioral understanding of what an adversary is trying to achieve and how to do so. such understandin…”

Summary

Discover how leveraging technical indicators can boost cybersecurity effectiveness and empower small business defense. Read on for practical insights.