Sightings Ecosystem: A Data-driven Analysis of ATT&CK in the Wild

on YouTube ↗38m

" summary

MITRE’s Sightings aggregates crowdsourced ATT&CK mappings and finds 6 million raw techniques reduced to 1.1 million usable techniques across ~800,000 sightings covering 184 ATT&CK techniques. Fifteen techniques account for 90% of observations, with scheduled task/job, command and scripting interpreter, and DLL search-order hijacking most frequent; proxy and non-application-layer protocol co-occur almost always. Command-and-scripting acts as a facilitator for masquerading and obfuscated files, and a common chain is scripting → impair defenses → indicator removal. Analysis hits mapping, contributor and detection-tuning limits and calls for detection auditing and a public portal.

AI-written summary · about

" chapters (7)

1. 0:00Start
2. 3:37Benefits of CTI Reporting
3. 4:30Limitations of CTI Reporting
4. 10:13Main Findings
5. 10:56Top 5 Techniques
6. 12:39Co-occurrence Analysis
7. 14:57Defense is Hard

" related talks

• 40mThreat Informed Planning with Macro-level ATT&CK TrendingRyan Fetterman · RSA Conference 2023
• 01h 47mMITRE ATT&CK FundamentalsSean Whitley · FIRST & AfricaCERT Virtual Symposium for the African and Arab Regions 2021
• 30mThe SOC Counter ATT&CKMathieu Saulnier · NorthSec 2019
• 48mMITRE ATT&CK: The Play at Home EditionRyan Kovar, Katie Nickels · Black Hat USA 2019
• 58mMITRE ATT&CK for DevelopersChris Ayers · NDC Security 2026
• 31mDon't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting ActivityJohn Stoner · BSidesSF 2019
• 13mAPTGen: An Approach towards Generating Practical Dataset Labelled with Targeted...Yusuke Takahashi, Shigeyoshi Shima, Rui Tanabe, Katsunari Yoshioka · 13th USENIX Workshop on Cyber Security Experimentation and Test (CSET '20)
• 30mCTI Bake-Off: A Recipe for Measuring, Integrating, and Prioritizing a CTI ProgramKellyn Wagner Ramsdell · FIRST Cyber Threat Intelligence Symposium 2022