Episode 125: Origins of MITRE ATT&CK

Welcome to the Azure Security Podcast, where we discuss topics relating to security, privacy, reliability, and compliance on the Microsoft Cloud Platform. Hey everybody, welcome to episode 125. This week it's myself, Michael, and Mark. And our guest this week is Blake Strom, who's here to talk to us about MITRE ATT &CK.

But before we get to our guest, why don't we take a little lap around the news. Mark, why don't you kick things off? A couple of different things I wanted to highlight. I've been working on this data security diagram to add to the Microsoft Cybersecurity Reference Architecture, or MCRA.

And so I shared that out with the LinkedIn kind of socials world. So I'd love to get feedback on it, get your thoughts on it. And if it looks good or, hey, you forgot this or you didn't think about that, I'd love to get feedback on that. So that'll be going out in the next release, which does not have a date yet, but we'll leave it at soon.

Now, there are a couple of things that sort of caught my eye is there was a great thing. It's like an eight or nine minute video on zero trust on Microsoft Mechanics. And it did a really good job, especially by Michael Magical. And it did a really good job of hovering sort of here's the theoretical concept, the architectural in a nice, quick, concise way.

And then here's some technology and some demos. And here's how it actually becomes real. and kind of showing how that sort of concept of zero trust applies effectively to the new world of agents and AI and all that kind of stuff. So it's a really nice one to check out while worth it.

And I also did an AI security talk, I don't know, sometime around a month or so ago, give or take. And so I released the slides for that. So I will pop a link in the news for that one so you can take advantage of that and sort of the way I'm thinking about that from an architecture strategy perspective. And I will be doing a fun talk in the not too distant future, besides in Tampa, on security as a team sport.

But we're not playing like a team. So you can have a little bit of fun with that. Talk about roles, responsibilities, accountabilities, and some stuff for people to kind of manage their careers effectively and get more done as a team. So that's what I got.

Back to you, Michael. All right, I've got a few items. First one for Azure Kubernetes Service, AKS, for node auto -provisioning now allows support for encryption host and disk encryption sets. I didn't even know that it didn't do this, but apparently it didn't do it, but now it does.

Again, I do wish Sarah was here because this is her baby, AKS, but anyway, I'm covering it today. So yeah, so node auto -provisioning now supports encryption at host and disk encryption sets, and that is generally available. Next one in public preview, Azure Front Door Premium now supports Azure Private Link Origins in UAE North. So I want to spend just a couple of seconds on Azure Front Door.

At Microsoft, we've been adding more front door support. in front of many services that you know and love within Azure to provide a very strong level of defense in front of these various services. If you have an application of your own that's at global scale, it's really worthwhile seriously considering Azure Front Door as literally the front door to your application because it provides so much benefit at a global scale. So that's in public preview, Azure Front Door Premium, and Azure Private Link in UAE North.

Generally available, there is now support for AMD version 6 confidential VMs in more regions. I'm not going to rattle them all off, but a couple that come to mind are Canada Central, Norway East, France South, Australia East, and a few more. There will be more coming on stream as well, but this is great to see. Huge fan of confidential VMs, so it's great to see more coverage.

Next, we have generally available the default rule set 2 .2 in WAF for Azure Application Gateway. This is basically just an incremental improvement. It uses the OWASP core rule set 3 .

3 .4 and allows protection from things like SQL injection, cross -site scripting, and so on and so forth. This actually... Again, it's just really a fine tuning of the current rule set.

And it ships by default to what's called paranoia level number one, just to help reduce the chance that legitimate traffic is actually blocked. So look at that. It's good to see, nice to see just small improvements being made. Even small improvements can make a big difference over time.

Still on the topic of WAF, Web Application Firewall, there's now Azure Application Gateway WAF Insights. This is now in preview. Essentially, it's just a better pane of glass looking at what is going on in the WAF when you're using it with Azure Application Gateway. And the last one is we now have in public preview some new security capabilities in Azure Monitor Pipeline.

Most notably, and this is the one that I really sort of piqued my interest, was secure ingestion with TLS and mutual TLS. This is so important. It's incredibly important that you always authenticate both ends of a communication, whether that's a user, whether it's a process, whatever. It's so important that you actually authenticate both ends.

So with mutual TLS, you're not just authenticating the server because normally TLS is used to do server authentication. But a lot of people don't realize that TLS can also do client authentication as well. And that's often referred to as mutual TLS. So now secure ingestion with Azure Monitor Pipelines now supports mutual TLS.

So good to see. Great little roundup of sort of, you know, a big smattering of security improvements across the board. Always a good thing to see. All right.

Now that we have the news out of the way, let's turn our attention to our guest. As I mentioned at the top, our guest this week is Blake Strom, who's here to talk to us about MITRE ATT &CK. Blake, welcome to the podcast. Would you like to take a moment and introduce yourself to our listeners?

Yeah, thanks for having me. So I'm Blake Strom. I've been at Microsoft for almost six years now, mostly working in the XDR and SIEM cybersecurity research and development space, so building new capabilities and getting them to customers. So before I came to Microsoft, though, I was at MITRE for about seven years.

Started the ATT &CK project, was working in a bunch of different areas related to ATT &CK at MITRE. And then my background before MITRE was actually at the National Security Agency. So I was there for about three years in cyber threat intel and defensive operations. To go into a little bit more detail, since a lot of people may not know.

what MITRE is. So it's a nonprofit that was established back in 1958. So MITRE has been around for a very long time. But it's basically an organization that manages several federally funded research and development centers on behalf of the federal government.

So these are entities that are set up for various reasons around the defensive sector. Homeland Security, several different other areas to basically focus research and developments in sort of an unbiased way that sort of a nonprofit is best suited for. So a lot of people recognize them, at least in the cybersecurity space, for CVE, Common Vulnerabilities and Exposures, CWE, Around Weaknesses, Enumeration, Sticks and Taxi. But they do a whole lot more actual developments and research on behalf of the governments.

even to source selections of contracts across the defense industrial base. So they have quite a wide and expansive array of work that they do and capabilities across the federal government. So let's start with the basics because we've got a lot of listeners on our podcast, everyone from CISOs with lots of scars to people that are just entering the industry and trying to figure things out. Can you kind of baseline us on what is MITRE ATT &CK and kind of how did it come about?

What was it intended for, if it was intended for anything? And just tell us the story of how this thing came to be and how it's evolved. Yeah, so ATT &CK as it is today is basically a knowledge base of cyber threat actor TTPs. And it's mostly focused on what...

actors have actually been observed doing. So there's a big difference between what can be done and what is actually done. And I think that makes a really big difference when you talk about how to prioritize defenses against certain threats. Because you can go look at CVE or CWE and see a whole sort of enumeration of things that are possible, but they may not be things that attackers are actually using day to day.

And a TTP is a tactic, technique, or procedure, correct? Correct. Yeah, attack techniques and procedures. And so the background of ATT &CK is kind of an interesting and long story.

So there is quite a purpose behind how it was developed. So back in, I think it was 2010, 2011, MITRE had started a research program under the premise that attackers will always find a way in. and so the the typical uh process of discovering iocs like malwares ips domains wasn't really working um and mitre being part of the defense industrial base working on behalf of the government of course they often get targeted by you know advanced threat actors and very persistent threats so they have sort of a vested interest in protecting themselves but also given mitre's charter to work in the public interest on behalf of the government, they also took this as an opportunity to figure out, okay, so what else can we do beyond IOCs to defend ourselves and defend the customers?

Yeah, and IOCs being indicators of compromise, right? Right, yep. Yeah, so in the red team, you talked about TTPs. So TTPs, whenever we're doing a readout of an operation that the red team has performed, we always enumerate.

the TTPs, like what things we actually did to actually go along the breach path until we got to our final objective. And a big part of what I do is learning from those TTPs, like how did that particular TTP eventuate, like how did it happen? And more importantly, what can we do moving forward to reduce the chance that that particular TTP will be used? So this project was called FMX.

It was called the Fort Meade experiment because of the MITRE location that it was being conducted in. But basically, they were trying to figure out ways of sensing an internal network to discover the behaviors of the actors rather than the IOCs that were being left behind. And this is sort of at the very early days of the evolution of EDR and sort of like process monitoring and behavioral monitoring on networks. So things like Sysmon had not been developed yet.

Companies like CrowdStrike were still in their infancy. And so there was a lot of internal developments of tools. So very Sysmon -like tool was developed to do process monitoring. We tried to use the most common host -based security systems at the time that were being used by our government sponsors.

Was there something more that we can do and inform them to do with these systems? I think it was McAfee HVSS at the time. So we sensed this, or they set up this network to do the sensing and decided to do red team operations using some of the skills for the red team operators that were at the site from MITRE. So in a way it was like...

trying to shift from, hey, we've got footprints of the last attack, look for guys with these footprints, which is kind of what an IOC is, to let's figure out their methods and the things that they do, their patterns over and over again kind of thing. Right. Yeah, that's a really good way to look at how the industry was starting to evolve at the time. And so I had actually joined MITRE at the beginning of 2012.

So this project had already started. And they had already done one sort of red team test where the red team sort of came up with their own plan, operated within this network, which was the actual MITRE environment. It was a live corporate network that we were allowed to operate in to sort of test the research hypothesis and ideas. And the blue team sort of came in and tried to discover the actions.

And my first sort of assignment when I joined MITRE was, okay, try to figure out how to connect these two things together, like what the red team did and what the blue team found. And that was a very interesting process because one of the first things that I discovered was, hey, the red team isn't really using TTPs that are similar to known actors. And so that was, you know, in the reports, the very first version of this report was, you know, very device centric, trying to figure out exactly the right way to talk about what the right team did in sequence and how to relate that to the Splunk analytics and data that was being discovered by the blue team.

It's fascinating to hear you say that because I've seen the same thing of like, it's such a different thought process of, you know, attacker and a red team side. versus the defenders frequently. And I know John Lambert has a famous quote around attackers think in graphs and defenders think in lists, right? And there's just so many other different elements to it of just that thought process of it's just a different set of objectives, right?

As a defender, because there's a complexity in architecture and this and that, it often gets boiled down to just a checklist of compliance. And on the attacker side, it's just get the job done. Yeah, exactly. And it's really hard to bridge those two different mindsets.

So I have two questions. The first question is, can you give us an overview of what actually is in MITRE ATT &CK? Like how it's broken up, what sort of data is in there? And the second one, which is really just the follow on, is if I was, you know, Jane or John security person in an organization, I mean, how would I use MITRE ATT &CK?

yeah yeah so at the top level um when you go to the attack website you'll see basically what's considered the the attack matrix and so that's the organization of tactics which are Basically, the purpose of an adversary sort of conducting a technique, so that spans reconnaissance, initial access, persistence, defense evasion, credential access, and it goes all the way to impact or exfiltration. And in each row within those tactics are the various techniques. And those tend to be high level or sort of medium term buckets for how to organize the sub techniques.

And so those are very specific ways that an actor would perform a technique to accomplish a tactic. And so what this provides is basically a common language or lingua franca between what an attacker would do, why they would do it. And then when you drill into the technique or sub technique level, the very detailed information on. how they're doing it, down to the specific platforms that they would use these techniques against, what procedure examples for real threat actors that have done this and have been reported out in the wild, and then any mitigation or detection strategies that one could imply to actually employ to do some sort of detection or mitigation against those techniques.

So you had this internal research, and then it became... a essentially not quite a standard, but kind of a, just a de facto standard that everyone refers to and uses. Yeah. I'd love to hear like, you know, how that journey kind of went.

Was it something that was just like an instant hit? Was it something that y 'all had to promote? I'm just kind of curious, you know, about that journey and, and, and how that, how that went. Yeah.

So like many things, when they first get started, there's a lot of internal convincing. that this is something new and useful. So there was quite a bit of that in the early days within MITRE as we started to socialize it a bit. So a lot of people would sort of come out of the woodwork and say like, okay, this is already done in CWE.

This is already sort of done in CVE. So we had to get really good about the story as to why we were doing these things. Really the big differentiator was sort of the attacker mindset that it was centered around. And the fact that we were focused on was this actually observes attacker activity.

And so as it grew internally over time, as we were using ATT &CK for these red and blue team evaluations internally, I think it finally dawned on some of the research leaders and, of course, the CISO at the time within MITRE that this was something that was actually kind of unique and special and very much in line with what MITRE's mission was. So much so that it was something that they wanted to share with the world, basically, because it was so useful for us internally to test and evaluate our internal defenses that it didn't make sense to sort of keep this in -house.

And so that started off the process of basically the internal reviews that had to happen, the pre -publication reviews that had to happen with sponsors, and then finally publishing it about two or three years after. We had started ATT &CK internally, and I think it was May 2015 is when we first published it. Wow, it's only been 10 years. It's funny, like you get used to something and it just feels like it's been around forever.

It's interesting because it's one of the few frameworks that directly addresses the attacker side, the red team side of the equation. So always been a big fan of that and kind of like, you know, we need to explore and define that space a lot better than we have. Love it. So this is just kind of like a curiosity question because like, you know, Michael and I have both, you know, are both history buffs and like love these origin story kind of things.

I'm curious, like, is there anything that you kind of wish you did differently? Are you happy the way it works? Or is there some stuff that didn't, you know, land like the way you expected or thought it might? I'm just kind of curious on that one.

And of course, you know, hindsight's 20 -20 and you always see things that you never saw in the moment. So I'm just, you know, more of a curiosity thing. Yeah, that's a good one. So I think one of the, you always have to start somewhere and there's never going to be a perfect solution right out of the gate.

But I think one of the things that I feel like we should have done much earlier was to implement the sub technique concept because there was, as attack had evolved from its earliest state, which was I think 64 techniques to a point where it was, across multiple platforms and had hundreds of techniques. It became very difficult for somebody to figure out even where to start with it just because it was so big. So the sub -technique layer added a necessary sort of like evenness across how we would define things at a technique and sub -technique level that was missing.

There's either too much detail or not enough detail in a lot of spaces. So I think that was the piece that was sorely needed for a long time. that we managed to implement right before I left MITRE. And that was one of the things I know we'll probably get to more of these questions, more of this type of question, maybe a little bit later, but that was one of the things that I absolutely had to do before I left was to get ATT &CK in a more stable state.

You feel like an accountability to your baby. Yeah. Yes. Yeah, of course.

I know that feeling well. I have a really stupid question. I have a really stupid question. It's talking about origins.

Why is the second letter A in the word attack not a letter A? Why is it an N symbol? Oh my gosh. This always goes back to lawyers.

That was a stylization. that was done basically because MITRE didn't want to try to copyright ATT &CK with the letter A in it just for reasons they thought it would be too difficult. So they asked us to stylize it a bit. And it was actually very helpful that they decided to push us to do that because it became very easy to figure out when people were using ATT &CK.

And of course there's a lot of funny things that happen after that too because I've seen so many different like uh special characters that people have put i don't know on purpose or by accident like basically hold shift and hit any number of the the keys up there from like dollar signs uh asterisk or whatever like i've seen it all like it's it's pretty funny when people try to do attack that's like a whole gamut of things that show up there yeah but there is one other thing that i wanted to mention um that's sort of in the same realm of like what would you do differently i i don't think we can really answer that question without also mentioning the ATT &CK evaluations.

That was one of sort of the offshoots that MITRE had done related to ATT &CK, but it's more MITRE being a third party sort of unbiased evaluator of endpoint detection and response systems using ATT &CK as sort of the benchmark. And so do you guys mind if I sort of go into a little bit of the story? Yeah, I'd love to hear it. We're history busted.

MITRE had started using ATT &CK -based evaluations, like constructing an adversary -based plan from ATT &CK to evaluate EDR tools for several of the government sponsors across the defense and dark of. And so this became basically a program in and of itself because a lot of the... security vendors that we were working with basically saw this as the next sort of gen testing because there's like AV tests out there. I think there was SE labs at the time and the industry didn't really feel like they were capturing the essence of what an EDR product would use and tend to be more focused on antivirus detection.

So we ended up doing something that MITRE had never done before because they typically only do these sorts of unbiased evaluations on behalf of sponsors to actually do this for the industry and create a whole program around it. And part of what was special with the earlier days of that program was we would actually work very closely with the vendors themselves. Because we were sort of operating under the mindset that we want to help them understand where their gaps are. And it isn't just something that they would contribute to and we would publish for sort of the industries to see and make more informed decisions about products.

It was really helping the vendors themselves sort of raise the tide a bit on the products in the industry. And so that was really special at the time. And as the sort of evaluations evolved, so to speak, over time, I kind of feel like it lost some of that luster a little bit. And I don't want to be too hard on MITRE.

Like there's very smart people that are driving this program still. They have really good ideas to bring a lot of the innovation back to it. But I think if you go talk to basically anybody who's been involved in this test from the vendor space. They've been very frustrated with the past few iterations of tests.

And so I don't think that would be necessarily something that I would change, but it was something that very much sort of like weighs on me as one of the... people who started this whole process. I really want to see it evolve over time and get back to something that's more innovative, more special that people are getting value out of rather than just being sort of a marketing stunt that I think it's turned into. Yeah, it's a tough space because there's so much money on the line of how well did you do in this or that that the salespeople love and customers love to get to justify whatever their favorite tool is or whatever.

It's a tough space because it's just there's so many competing interests that have so much power, right? I couldn't even imagine running a program like that. I'd have to have a very different style of personality to engage with people. I wanted to ask a couple more questions I wanted to cover here while we got you.

You kind of hinted at it a little bit. I'm curious, how do you see people misinterpret or misuse it? Like I said, it's the only thing in that red team space that covers the attacker side, whether it's simulated or real. Do you see people stretching it into use cases where you're just like, no, it doesn't do that?

I'm very curious about some of those elements. I think the biggest misconception of attack is that it's like a checkbox. It's more about the process of getting your network and up to a point where you can defend against these attacks and then continuing to evolve it because attackers are not static these techniques are not static they're always going to change over time and if you treat this as okay like i'm covered with attack i'm done like you're never going to be done you make it into a steady state where you have the the processes in place and you're understanding the updates to attack and understanding threats where you can uh better protect and better secure your environment but it's it's never going to be done and i think that's one of the misconceptions that a lot of people have especially when they first get started uh with attack that they treat it like a checkbox like okay i'm good now like i can tell my sees a little covered and then some catastrophic things happens uh like three months later and you know somebody's in the hot seat for uh for saying the wrong thing when they weren't actually covered And ATT &CK doesn't cover absolutely everything.

So there's no sort of like guarantee that MITRE has covered all known techniques for everything. And so that's why it's more about the process of protecting yourself with something like ATT &CK rather than just checking all the boxes. Yeah, and there's a lot of nuance again between the difference in the way the red and blue teams think is, you know, the red team, this is a thing and there could be 17 variations of how I could execute it. And congratulations, you detected one of them.

or your vendor says they detect one of them. What about the other 16 ways of doing it? Oh, those just slip past. What?

It's just like that tricky area between the two. Yeah, definitely. We've definitely seen a lot of people take some creative ways of interpreting what attack means. Did you expect it to be this successful?

Oh, no way. Yeah. No. And so one of our, I guess he was my manager at MITRE at the time, but he was sort of a really good thought leader in cyber within MITRE.

His name was Todd Whitbold. And I don't think ATT &CK could have happened without his guidance, but actually really early on in the process of defining ATT &CK and getting sort of like the internal buy -in on it. He said something to me that I didn't believe at the time. He said, a few years down the road, I think MITRE is going to be known for one main thing, and that's going to be ATT &CK.

And sure enough, he was right. Because when a lot of companies talk about ATT &CK, they refer to it as MITRE instead and not ATT &CK. So I think we were all a little bit shocked that it has gotten that much brand recognition. MITRE itself has gotten that much brand recognition just from this one.

when MITRE has been around for so many years and has done so many things that this is the one that it's mostly recognized for. Yeah, you don't really hear about MITRE CVE or MITRE CWE, but MITRE ATT &CK just falls off the tongue. Yeah, for sure. So that kind of leads me to my last question.

And it's more about you as a person because you spent seven years on it, as you mentioned. How do you move on to do something else? Because a long time ago, I was like the PKI guy in Microsoft support, and I kind of stopped that with Windows 2003. Yes, I'm that old.

And so I'm curious, your experience from like, okay, now that I'm done with this, and now that I'm moving on, and I've closed out all the things I really wanted to do. Has it been challenging? How did you think about that? How did you go through that?

Yeah, this is a really good question. So I am the type of person, for better or for worse, that needs to, at some point, move on to something else. So I don't know if it's like a sense of boredom per se, or just like, I need something new to learn about, to dive into. And I definitely started feeling that maybe about five years into ATT &CK.

And so the attack certainly wasn't the only thing that I did at Miner. So I started this other project called Caldera, which is an automated adversary emulation system that was largely based on attack to try to give defenders a more realistic way of testing their network against the techniques when they may not have a red team or have the resources to do the red team. And I was really... more interested in in that project for a long time um but it got to a point where i just couldn't split my time between the two and i ended up giving like caldera to another person to lead so that i can focus on attack because that was sort of the more important thing to work on over over time so i made these series of sacrifices for for attack but it finally gets to a point where i needed to to move on to something else to get closer to operations again.

And that's basically why I decided to come to Microsoft because of all the various like large amounts of data that we can leverage and all the interesting things that we can do to build new capabilities to actually counter these threats. So I got a little bit tired of talking about the threats and wanted to actually do something about them again. But it is really hard to step away from something like ATT &CK. because I had contacts out throughout the industry, was doing talks all the time, and I needed ATT &CK to be in a good spot before I could leave it.

Hence the discussion a little bit earlier about the sub -techniques there. So that was one of the things that I knew I needed to do before I could feel comfortable stepping away. And then the second one was I needed to make sure that there was a lead capable of driving ATT &CK in the future. and still maintaining the same sort of principles that we had started when it began.

And so Adam Pennington is the lead now. He was sort of, you know, he sat in the same room with me as ATT &CK was getting started. And so he was there along the way and then ended up playing a significant role. All right.

So as Mark kind of alluded to, let's bring this episode to an end. So one of the questions, there's two questions we asked. So the first one is, what does a typical day in the life of Blake look like? Lots of meetings.

So I've got a pretty large team. We engage with a lot of internal research stakeholders and product teams and engineering teams. So unfortunately, my day -to -day isn't really that interesting. It tends to be a lot of meetings, level setting, planning, check -ins for various projects and efforts that we're working on.

But there are some exciting moments, especially when one of our research proof of concepts starts producing really good results and we start getting really good customer feedback and generating a lot of good interest around. and being able to celebrate that with the team tends to be the highlights of the days. Mostly it's just meetings. All right, so let's really bring this episode to an end.

So if you had one thought to leave our listeners with, what would it be? Basically, you know, check out ATT &CK. If you have a role, whether it's offense, defense, or compliance, you just want to understand the threats of today a little bit better. There's lots of reasons to check it out and understand it and see how it applies to your day -to -day sort of work.

Yeah, I guess ultimately, if you don't look at it, you don't know what's in there. And if you don't know what's in there, you don't know if it's going to be of use to you. So take a look. All right, so let's bring this episode finally to an end.

Blake, thank you so much for joining us this week. Don't want to keep you away from your meetings. And to all our listeners, we hope you found this episode useful. Stay safe and we'll see you next time.

Thanks for listening to the Azure Security Podcast. You can find show notes and other resources at our website, azsecuritypodcast .net. If you have any questions, please find us on Twitter at AzureSecPod.

Background music is from ccmixter .com and licensed under the Creative Commons License.