How Can We Use the MITRE ATT&CK Framework for Threat Hunting? How to Hunt APT Groups Using the MITRE ATT&CK Framework?

MITRE ATT&CK framework is always a guiding path for all security researchers, defenders, and red teamers. This creates a common standard taxonomy for organizations for easy communication.

In our previous article, we discussed on what is MITRE ATT&CK framework and its benefits. In this article, let us look into how we can use the MITRE ATT&CK framework for threat hunting or how to hunt APT groups using the MITRE ATT&CK framework. Before this, let’s clear some concepts like APT groups, threat hunting, and cyber kill chain.

What is An APT Group?

Advanced Persistent Threats (APTs) are sophisticated hacker groups, which may be state-sponsored, nation sponsored, etc., that are capable of infiltrating and lodging in a network for an extended period of time without being detected. These groups are resourceful and have access to vast resources, time, and expertise to conduct large-scale infiltration operations. They remain undetected by using a range of techniques that allow them to gain access to systems and networks without raising suspicion.

What is Threat Hunting?

Threat hunting is the proactive approach of searching for indications of malicious activity or the presence of a threat actor within an organization’s networks and systems. The goal of threat hunting is to detect, investigate, and respond to potential malicious activity before it can cause damage.

APT groups are so advanced that the average dwelling time in an organization’s network without being detected can be around 15-20 days. Their activities will be so subtle that defense tools might not be able to catch them. Threat hunting will help to catch such malicious activities or APT groups and prevent them before it causes more damage.

What is the Cyber Kill Chain?

The cyber kill chain is a framework developed by Lockheed Martin which explains the various stages and structures of an attack. The cyber kill chain consists of 7 steps.

Stages of cyber kill chain

MITRE ATT&CK vs Cyber Kill Chain

As we discussed in the previous article, we know the MITRE ATT&CK framework is created based on references from various real-life scenarios. We also discussed the tactics in the MITRE ATT&CK framework. All 14 tactics are designed in such a way it reflects the cyber-attack kill chain.

Credits: CyCraft Technology

Threat hunting is a very broad terminology, so in order to hunt for an APT group with the help of the MITRE ATT&CK framework, We need to follow some steps.

How to Hunt APT Groups Using the MITRE ATT&CK Framework?

Threat hunting is a very broad terminology, so in order to hunt for an APT group with the help of the MITRE ATT&CK framework, We need to follow some steps

Find and research the behaviour 

The Analyst should understand what they are looking into. The primary and most important step is to understand the reason behind the attacker performing the attack. What their intent is, and what they are trying to achieve.

This can be from raw data from an ongoing incident or a finished intelligence report. Researching online about the port number or the commands used can give more visibility on what to search.

Translate the behaviour into Tactic 

The behaviour can be obtained from a finished intelligence report or raw data. If the source is from a finished report, it will be easier for the analyst to match it with a tactic as the author of the report might have provided the intent behind the attack. To map a tactic from raw data can be more difficult. Analysts should have good domain knowledge to understand and map the behaviour into a tactic.

Figuring out technique from the Tactic

Once the Tactic is identified, we can look into what all techniques are listed under each Tactic. This might make things easier. Another way of doing mapping can be by researching more on the behaviour and mapping it directly to a MITRE ATT&CK technique. Mapping your observation into a technique can be tedious work. We can make it easier by searching for keywords in the ATT&CK matrix.