CyCraft Classroom: MITRE ATT&CK vs. Cyber Kill Chain vs. Diamond Model
By: Cycraft Technology Corp
Tags: Hacking, Security, Information Security, Data Breach, Cybersecurity

For example, blocking a file or IP address is rather easy for an attacker to get around. Blocking a domain name is slightly more troublesome as the attacker might have to alter a few lines of code on their programs. Blocking FTP outbound on your network could prevent the attacker from exfiltrating data, but they could just as easily tunnel the data out through another encrypted tunnel.

Taking away an attacker’s tool is challenging as they will have to devise a new way of carrying out their objectives; however, as most security analysts will tell you programming defenses to detect tool after tool feels a bit like the game whack-a-mole. Advanced attackers often design their own custom tools or customize variations of existing tools. It takes time and is quite challenging, but it can be done by advanced attackers.

At the top of the Pyramid of Pain, are the tactics, techniques, and procedures that the ATT&CK Framework documents. This is the behavior profile mentioned earlier and is much more difficult for the attacker to alter this and circumvent defenses at this level.

Defenders could have alerts in place if Mimikatz is ever detected; however, disabling or restricting NTLM (New Technology LAN Manager) and monitoring command line arguments help defend against multiple tools used for Credential Dumping, and not just Mimikatz.

Difficulties with the Cyber Kill Chain

While the Cyber Kill Chain has been accepted in the cybersecurity community, it has not been universally adopted. Critics of the Kill Chain often point to what they believe are the fundamental flaws in the model.

The Cyber Kill Chain assumes a traditional perimeter-focused defense where a firewall is the main line of defense and so fails to cover other attack vectors and internal attack paths; modern organizations need to leverage defensive solutions within the perimeter.

The Cyber Kill Chain does not focus enough on what to do after an attacker has broken into your network successfully, which they inevitably can with enough persistence.

The Cyber Kill Chain’s phase sequence cannot accurately depict all attacks as several kill chain phases can be bypassed entirely.

Once inside a victim’s network, the timing of each attack phase is inconsistent. Phases can take anywhere from minutes to months to years. Attackers could lay dormant for prolonged periods of time waiting for the optimal window to launch the final phase of their attack to apply the most impact on their target.

Difficulties with the Diamond Model

The Diamond Model comes from a different time when there was more of a focus on analytic outcomes than process and principles — hence the opening quotation:

‘‘Intelligence analysts should be self-conscious about their reasoning process. They should think about how they make judgments and reach conclusions, not just about the judgments and conclusions themselves.”

-Richards J. Heuer Jr. (ex-CIA and author of “Psychology of Intelligence Analysis”)

It was part of a push for a more intelligence-driven intrusion analysis standard, which, in many ways, is now the norm today; however, modern advancements in machine learning have propelled intrusion analysis even further through the automation of data-driven intelligence.

The Diamond Model is still useful today. While ATT&CK primarily documents adversarial behavior, the Diamond Model is more useful for clustering intrusions for analysis. These separate strengths are complementary; mapping attack techniques within the ATT&CK matrix should prove useful data for the Diamond Model when analyzing a threat actor’s capabilities.

On page 52 of the original paper, the authors (Caltagirone, Pendergast, and Betz) discussed at length on how the Diamond Model is complementary to the Cyber Kill Chain. Resources gained from one intrusion are commonly used by the attacker to enable future intrusions or exploit internal trust relationships to gain deeper access into a victim’s network. This can be displayed by combining the Diamond Model with the Cyber Kill Chain, as seen in Figure 6 below.

Figure 6 of the Original Lockheed Martin Report: The Diamond Model of Intrusion Analysis

Does MITRE ATT&CK replace the Cyber Kill Chain or Diamond Models?

No.

The Cyber Kill Chain and Diamond Model are both still in use today; however, intrusion analysis is all about context. MITRE ATT&CK provides a common and precise language so defenders can have more actionable conversations backed up by easily referenceable data-driven intelligence. This modern lexicon enriches both models, which are both still useful and relevant today.

You can hear it straight from the horse’s mouth.

“ATT&CK and the Cyber Kill Chain are complementary. ATT&CK sits at a lower level of definition to describe adversary behavior than the Cyber Kill Chain. ATT&CK Tactics are unordered and may not all occur in a single intrusion because adversary tactical goals change throughout an operation, whereas the Cyber Kill Chain uses ordered phases to describe high-level adversary objectives.”

-MITRE ATT&CK FAQ

Despite MITRE ATT&CK’s claims on how ATT&CK is complementary, many researchers feel that the ATT&CK framework will (or already has) replace both the Cyber Kill Chain and Diamond Model — mostly for the reasons cited above. This is further demonstrated by the trends of vendors implementing ATT&CK terminology into their solutions and organizations requesting ATT&CK terminology in solutions.

How to Start Implementing the ATT&CK Framework into your Security

There are numerous benefits to incorporating the ATT&CK Framework into your security culture; some of which have already been mentioned, such as having actionable and data-driven conversations. Here are the five use cases for the ATT&CK Framework and the order that you should implement them into your security culture.

Step 1 — Reference Library

The ATT&CK Framework not only documents known adversarial techniques but also the adversaries who have used them. Don’t add to your workload. Prioritize it. The ATT&CK Framework helps your red teams and research teams focus their work with the right questions and provides leadership with a clear understanding of the security tasks ahead.

What adversaries target our specific industry? What techniques do those adversaries commonly use? What tools do those adversaries use to carry out those techniques? What’s our current coverage? Are we capable of detecting these techniques? What preventative controls mitigate this technique?

The ATT&CK Framework answers these questions and makes it easy to create heat maps of attacker techniques known to have been used against similar peers in your industry. ATT&CK Navigator on GitHub is an excellent tool for this and is quite easy to use. If you haven’t seen MITRE’s instructional video, you should. It covers most of the basic features.

In this example, we focus on threat actors who target financial institutions. Red techniques are used by all four threat actors, whereas green techniques are only used by some. White techniques have not been known to be used by these four threat actors.

ATT&CK Navigator can be used to create interactive heat maps like the one above. This particular heat map is of known techniques used by Carbanak, Cobalt Group, APT38, and FIN7 — threat actors known for targeting financial institutions.

Step 2 — Map Defense Controls

Knowing how you will be attacked is as important as knowing your own defense capabilities. Mapping your defense controls on the ATT&CK matrix will not only give a clear view of what you can defend against but is also the first step in tuning your detection and response capabilities.

Step 3 — Tune Detection

SOCs need to shift the conversation from “what we have” to “what we should have”. A common misconception by vendors of the ATT&CK Framework is that they need to check every box in the matrix. The ATT&CK Framework is not Pokemon; you can’t catch them all.

Instead of exhausting organizational resources on defending against the 220+ techniques, focus on the techniques known to have attacked similar peers in your industry.

Overlaying your controls and the known threats of your industry allows you to fill the gaps in your defense and reduce redundancies.

Step 4 — Train Staff

Train your staff on the MITRE ATT&CK Framework by implementing the tactics and techniques into your workflow and daily routines. The ATT&CK matrix itself won’t change hacker behavior, but it will and has changed the global cybersecurity conversation by creating common classifications resulting in more data-driven and actionable discussions.

Changing company culture is not easy. However, every SOC should make the shift from a compliance-based culture (worrying about audits and regulations) to a more intelligence-driven culture and prioritizing resources on the most likely threats.

ATT&CK has quickly become one of the most definitive resources of hacker techniques available today. The cybersecurity community increasingly talks about cyberattack techniques in ATT&CK terms and choosing software based on the MITRE ATT&CK Framework. Having everyone on your team familiar with the terms of the ATT&CK Framework is paramount prior to undertaking the next step.

Step 5 — Adversarial Emulation

Is your current coverage capable of detecting techniques used by adversaries that target your industry?

In July 2019, the Ponemon Institute reported that 53 percent of IT leaders don’t know if their cybersecurity controls are working. Knowing your defense capabilities is not as valuable as knowing their efficacy.

Ultimately, the best use case for the ATT&CK Framework is to test defensive solutions and provide metrics to gauge the efficacy of your defenses. This is best demonstrated through attack simulations. Many organizations do have internal red teams, and there are third party red team services out there. However, MITRE has also provided an open-source tool on GitHub called Caldera.