Analytic Frameworks
Now that the attacker’s motivations and some common tactics and techniques they use should be clear, the question remains of how can we identify an attack within our environment from the bits and pieces of evidence that we find during our research. How can we analyze this data to understand what is actually happening?
Analysis
What is that, anyway? The dictionary says it is "the detailed examination of the elements or structure of something".
That makes sense… In our case, cyber analysis is the act of examining the cyber threats.
Threats might be malicious or unintentional - they might be operational or strategic - they might be impactful or just annoying - but someone - that’s us - has to look at them, analyze them and make that determination.
Analytic Frameworks
Analytic frameworks attempt to break down the structure of cyber threats themselves into manageable and possibly trackable pieces - to identify handholds or rather ‘mind holds’ that can help analysts learn not only what to look for but how various different pieces of information can come together to construct the bigger picture of a cyber incident.
Different organizations will use different pieces of these frameworks or models as a part of their security operations process.
In this section, we will focus on 3 of these.
Play the video on each of the tabs below to learn more about each of them.
MITRE ATT&CK™ Enterprise Matrix
The MITRE ATT&CK™ framework categorizes cybersecurity attacks based on adversary techniques, tactics, and procedures (TTPs).
Binding security data to this framework allows analysts to understand adversary behaviors and assess environmental risks, helping prioritize security efforts.
Regular updates provide the latest TTPs and information on specific adversary groups, enhancing investigation and defense strategies.
Knowledge of TTPs aids analysts in identifying patterns, aiding detection and mitigating risks to users and devices.
The Cyber Kill Chain®
Developed by Lockheed Martin, it outlines seven steps adversaries follow to achieve their objectives.
The phases include:
Reconnaissance - Target selection and vulnerability assessment.
Weaponization - Creating or acquiring malware.
Delivery - Transmitting the weapon to the target.
Exploitation - Triggering the exploit on the target.
Installation - Establishing persistence via a backdoor.
Command and Control - Gaining remote access to the target.
Action on Objectives - Completing the main goal (e.g., data exfiltration).
Critiques include its focus on perimeter security, lacking account for insider threats and modern attack vectors.
The Diamond Model
The diamond model connects four core elements (adversary, capability, infrastructure, victim) to interpret intrusions effectively.
This simple but powerful structure aids in collaboration, analysis, and communication about security events.
Analysts can use the model to pivot between connection points, gaining deeper insights during investigations.
It supports hypothesis testing, classification of events, and forecasting adversary behavior, aiding in containment and mitigation.
In this example, there is an event in which it is identified that a Victim accidentally downloaded malware onto their machine.
The malware has attempted to establish a connection with a Command and Control domain, for which it is necessary to make a DNS request and translate it to an IP address.
Once we have an IP Address for the Command and control server, we can easily identify within firewall logs other infected machines, and our team can move to apply containment measures in those devices.
We can also use external Threat Intelligence sources to see if either the domain or IP address have been linked to a known adversary to gain additional insight about this incident and other malicious activity related to it.
The strategy in analytical pivoting is to be able to start at any point in the diamond and to be able to reach other connection points while gaining additional insight at each stop.