Adversary Emulation: Generating MITRE ATT&CK Technique Sequences

on YouTube ↗31m

" summary

Automates sequencing of MITRE ATT&CK techniques by modeling each technique as promises (requires/provides) and building a promise vocabulary covering all techniques, then running an open-source tool that accepts ATT&CK layers or JSON and an objective. Outputs a staged table and a success/fail verdict. Demo shows Lazarus only stalls until specific techniques are added (gather victim identity T1589, acquire infrastructure T1583, network service scanning T1046) and a SolarWinds layer reaches multiple stages. Tool is iterative, maps every technique, and identifies missing promises.

AI-written summary · about

" chapters (8)

1. 0:00Adversary emulation basics
2. 2:22MITRE ATT&CK limitations
3. 4:29Automating attack chains
4. 6:03Applying promise theory
5. 11:29Developing the automation tool
6. 15:34Tool demonstration
7. 22:16Issues and caveats
8. 27:53Future work and conclusions

" related talks

• 01h 47mMITRE ATT&CK FundamentalsSean Whitley · FIRST & AfricaCERT Virtual Symposium for the African and Arab Regions 2021
• 13mAPTGen: An Approach towards Generating Practical Dataset Labelled with Targeted...Yusuke Takahashi, Shigeyoshi Shima, Rui Tanabe, Katsunari Yoshioka · 13th USENIX Workshop on Cyber Security Experimentation and Test (CSET '20)
• 48mMITRE ATT&CK: The Play at Home EditionRyan Kovar, Katie Nickels · Black Hat USA 2019
• 58mMITRE ATT&CK for DevelopersChris Ayers · NDC Security 2026
• 31mDon't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting ActivityJohn Stoner · BSidesSF 2019
• 36mBeing A Better Defender By Channeling Your Worst Adversary:John Stoner · 34th Annual FIRST Conference 2022
• 40mAdversary Simulation: Close the Gaps in Your Security PostureJake Williams · RSAC 2021
• 38mSightings Ecosystem: A Data-driven Analysis of ATT&CK in the WildKellyn Wagner Ramsdell, Mike Cunningham · 34th Annual FIRST Conference 2022