Threat Detection and Hunting for 5 of the Most Common MITRE ATT&CK Techniques: Connection Proxy, Service Execution, Exfiltration, Masquerading, Drive-by Compromise

6/11/2019 12:00:00 PM [(UTC-05:00) Eastern Time (US & Canada)] - Can't make the live event? Register anyway to receive a link to the recording.

Show/Hide All Time Zones

All Time Zones

Dateline Standard Time-(UTC-12:00) International Date Line West 6/11/2019 4:00:00 AM
UTC-11-(UTC-11:00) Coordinated Universal Time-11 6/11/2019 5:00:00 AM
Aleutian Standard Time-(UTC-10:00) Aleutian Islands 6/11/2019 7:00:00 AM
Hawaiian Standard Time-(UTC-10:00) Hawaii 6/11/2019 6:00:00 AM
Marquesas Standard Time-(UTC-09:30) Marquesas Islands 6/11/2019 6:30:00 AM
Alaskan Standard Time-(UTC-09:00) Alaska 6/11/2019 8:00:00 AM
UTC-09-(UTC-09:00) Coordinated Universal Time-09 6/11/2019 7:00:00 AM
Pacific Standard Time (Mexico)-(UTC-08:00) Baja California 6/11/2019 9:00:00 AM
UTC-08-(UTC-08:00) Coordinated Universal Time-08 6/11/2019 8:00:00 AM
Pacific Standard Time-(UTC-08:00) Pacific Time (US & Canada) 6/11/2019 9:00:00 AM
US Mountain Standard Time-(UTC-07:00) Arizona 6/11/2019 9:00:00 AM
Mountain Standard Time (Mexico)-(UTC-07:00) Chihuahua, La Paz, Mazatlan 6/11/2019 10:00:00 AM
Mountain Standard Time-(UTC-07:00) Mountain Time (US & Canada) 6/11/2019 10:00:00 AM
Central America Standard Time-(UTC-06:00) Central America 6/11/2019 10:00:00 AM
Central Standard Time-(UTC-06:00) Central Time (US & Canada) 6/11/2019 11:00:00 AM
Easter Island Standard Time-(UTC-06:00) Easter Island 6/11/2019 10:00:00 AM
Central Standard Time (Mexico)-(UTC-06:00) Guadalajara, Mexico City, Monterrey 6/11/2019 11:00:00 AM
Canada Central Standard Time-(UTC-06:00) Saskatchewan 6/11/2019 10:00:00 AM
SA Pacific Standard Time-(UTC-05:00) Bogota, Lima, Quito, Rio Branco 6/11/2019 11:00:00 AM
Eastern Standard Time (Mexico)-(UTC-05:00) Chetumal 6/11/2019 11:00:00 AM
Eastern Standard Time-(UTC-05:00) Eastern Time (US & Canada) 6/11/2019 12:00:00 PM
Haiti Standard Time-(UTC-05:00) Haiti 6/11/2019 12:00:00 PM
Cuba Standard Time-(UTC-05:00) Havana 6/11/2019 12:00:00 PM
US Eastern Standard Time-(UTC-05:00) Indiana (East) 6/11/2019 12:00:00 PM
Turks And Caicos Standard Time-(UTC-05:00) Turks and Caicos 6/11/2019 12:00:00 PM
Paraguay Standard Time-(UTC-04:00) Asuncion 6/11/2019 12:00:00 PM
Atlantic Standard Time-(UTC-04:00) Atlantic Time (Canada) 6/11/2019 1:00:00 PM
Venezuela Standard Time-(UTC-04:00) Caracas 6/11/2019 12:00:00 PM
Central Brazilian Standard Time-(UTC-04:00) Cuiaba 6/11/2019 12:00:00 PM
SA Western Standard Time-(UTC-04:00) Georgetown, La Paz, Manaus, San Juan 6/11/2019 12:00:00 PM
Pacific SA Standard Time-(UTC-04:00) Santiago 6/11/2019 12:00:00 PM
Newfoundland Standard Time-(UTC-03:30) Newfoundland 6/11/2019 1:30:00 PM
Tocantins Standard Time-(UTC-03:00) Araguaina 6/11/2019 1:00:00 PM
E. South America Standard Time-(UTC-03:00) Brasilia 6/11/2019 1:00:00 PM
SA Eastern Standard Time-(UTC-03:00) Cayenne, Fortaleza 6/11/2019 1:00:00 PM
Argentina Standard Time-(UTC-03:00) City of Buenos Aires 6/11/2019 1:00:00 PM
Greenland Standard Time-(UTC-03:00) Greenland 6/11/2019 2:00:00 PM
Montevideo Standard Time-(UTC-03:00) Montevideo 6/11/2019 1:00:00 PM
Magallanes Standard Time-(UTC-03:00) Punta Arenas 6/11/2019 1:00:00 PM
Saint Pierre Standard Time-(UTC-03:00) Saint Pierre and Miquelon 6/11/2019 2:00:00 PM
Bahia Standard Time-(UTC-03:00) Salvador 6/11/2019 1:00:00 PM
UTC-02-(UTC-02:00) Coordinated Universal Time-02 6/11/2019 2:00:00 PM
Mid-Atlantic Standard Time-(UTC-02:00) Mid-Atlantic - Old 6/11/2019 3:00:00 PM
Azores Standard Time-(UTC-01:00) Azores 6/11/2019 4:00:00 PM
Cape Verde Standard Time-(UTC-01:00) Cabo Verde Is. 6/11/2019 3:00:00 PM
UTC-(UTC) Coordinated Universal Time 6/11/2019 4:00:00 PM
GMT Standard Time-(UTC+00:00) Dublin, Edinburgh, Lisbon, London 6/11/2019 5:00:00 PM
Greenwich Standard Time-(UTC+00:00) Monrovia, Reykjavik 6/11/2019 4:00:00 PM
Sao Tome Standard Time-(UTC+00:00) Sao Tome 6/11/2019 4:00:00 PM
W. Europe Standard Time-(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna 6/11/2019 6:00:00 PM
Central Europe Standard Time-(UTC+01:00) Belgrade, Bratislava, Budapest, Ljubljana, Prague 6/11/2019 6:00:00 PM
Romance Standard Time-(UTC+01:00) Brussels, Copenhagen, Madrid, Paris 6/11/2019 6:00:00 PM
Morocco Standard Time-(UTC+01:00) Casablanca 6/11/2019 5:00:00 PM
Central European Standard Time-(UTC+01:00) Sarajevo, Skopje, Warsaw, Zagreb 6/11/2019 6:00:00 PM
W. Central Africa Standard Time-(UTC+01:00) West Central Africa 6/11/2019 5:00:00 PM
Jordan Standard Time-(UTC+02:00) Amman 6/11/2019 7:00:00 PM
GTB Standard Time-(UTC+02:00) Athens, Bucharest 6/11/2019 7:00:00 PM
Middle East Standard Time-(UTC+02:00) Beirut 6/11/2019 7:00:00 PM
Egypt Standard Time-(UTC+02:00) Cairo 6/11/2019 6:00:00 PM
E. Europe Standard Time-(UTC+02:00) Chisinau 6/11/2019 7:00:00 PM
Syria Standard Time-(UTC+02:00) Damascus 6/11/2019 7:00:00 PM
West Bank Standard Time-(UTC+02:00) Gaza, Hebron 6/11/2019 7:00:00 PM
South Africa Standard Time-(UTC+02:00) Harare, Pretoria 6/11/2019 6:00:00 PM
FLE Standard Time-(UTC+02:00) Helsinki, Kyiv, Riga, Sofia, Tallinn, Vilnius 6/11/2019 7:00:00 PM
Israel Standard Time-(UTC+02:00) Jerusalem 6/11/2019 7:00:00 PM
Kaliningrad Standard Time-(UTC+02:00) Kaliningrad 6/11/2019 6:00:00 PM
Sudan Standard Time-(UTC+02:00) Khartoum 6/11/2019 6:00:00 PM
Libya Standard Time-(UTC+02:00) Tripoli 6/11/2019 6:00:00 PM
Namibia Standard Time-(UTC+02:00) Windhoek 6/11/2019 6:00:00 PM
Arabic Standard Time-(UTC+03:00) Baghdad 6/11/2019 7:00:00 PM
Turkey Standard Time-(UTC+03:00) Istanbul 6/11/2019 7:00:00 PM
Arab Standard Time-(UTC+03:00) Kuwait, Riyadh 6/11/2019 7:00:00 PM
Belarus Standard Time-(UTC+03:00) Minsk 6/11/2019 7:00:00 PM
Russian Standard Time-(UTC+03:00) Moscow, St. Petersburg 6/11/2019 7:00:00 PM
E. Africa Standard Time-(UTC+03:00) Nairobi 6/11/2019 7:00:00 PM
Iran Standard Time-(UTC+03:30) Tehran 6/11/2019 8:30:00 PM
Arabian Standard Time-(UTC+04:00) Abu Dhabi, Muscat 6/11/2019 8:00:00 PM
Astrakhan Standard Time-(UTC+04:00) Astrakhan, Ulyanovsk 6/11/2019 8:00:00 PM
Azerbaijan Standard Time-(UTC+04:00) Baku 6/11/2019 8:00:00 PM
Russia Time Zone 3-(UTC+04:00) Izhevsk, Samara 6/11/2019 8:00:00 PM
Mauritius Standard Time-(UTC+04:00) Port Louis 6/11/2019 8:00:00 PM
Saratov Standard Time-(UTC+04:00) Saratov 6/11/2019 8:00:00 PM
Georgian Standard Time-(UTC+04:00) Tbilisi 6/11/2019 8:00:00 PM
Volgograd Standard Time-(UTC+04:00) Volgograd 6/11/2019 8:00:00 PM
Caucasus Standard Time-(UTC+04:00) Yerevan 6/11/2019 8:00:00 PM
Afghanistan Standard Time-(UTC+04:30) Kabul 6/11/2019 8:30:00 PM
West Asia Standard Time-(UTC+05:00) Ashgabat, Tashkent 6/11/2019 9:00:00 PM
Ekaterinburg Standard Time-(UTC+05:00) Ekaterinburg 6/11/2019 9:00:00 PM
Pakistan Standard Time-(UTC+05:00) Islamabad, Karachi 6/11/2019 9:00:00 PM
Qyzylorda Standard Time-(UTC+05:00) Qyzylorda 6/11/2019 9:00:00 PM
India Standard Time-(UTC+05:30) Chennai, Kolkata, Mumbai, New Delhi 6/11/2019 9:30:00 PM
Sri Lanka Standard Time-(UTC+05:30) Sri Jayawardenepura 6/11/2019 9:30:00 PM
Nepal Standard Time-(UTC+05:45) Kathmandu 6/11/2019 9:45:00 PM
Central Asia Standard Time-(UTC+06:00) Astana 6/11/2019 10:00:00 PM
Bangladesh Standard Time-(UTC+06:00) Dhaka 6/11/2019 10:00:00 PM
Omsk Standard Time-(UTC+06:00) Omsk 6/11/2019 10:00:00 PM
Myanmar Standard Time-(UTC+06:30) Yangon (Rangoon) 6/11/2019 10:30:00 PM
SE Asia Standard Time-(UTC+07:00) Bangkok, Hanoi, Jakarta 6/11/2019 11:00:00 PM
Altai Standard Time-(UTC+07:00) Barnaul, Gorno-Altaysk 6/11/2019 11:00:00 PM
W. Mongolia Standard Time-(UTC+07:00) Hovd 6/11/2019 11:00:00 PM
North Asia Standard Time-(UTC+07:00) Krasnoyarsk 6/11/2019 11:00:00 PM
N. Central Asia Standard Time-(UTC+07:00) Novosibirsk 6/11/2019 11:00:00 PM
Tomsk Standard Time-(UTC+07:00) Tomsk 6/11/2019 11:00:00 PM
China Standard Time-(UTC+08:00) Beijing, Chongqing, Hong Kong, Urumqi 6/12/2019 12:00:00 AM
North Asia East Standard Time-(UTC+08:00) Irkutsk 6/12/2019 12:00:00 AM
Singapore Standard Time-(UTC+08:00) Kuala Lumpur, Singapore 6/12/2019 12:00:00 AM
W. Australia Standard Time-(UTC+08:00) Perth 6/12/2019 12:00:00 AM
Taipei Standard Time-(UTC+08:00) Taipei 6/12/2019 12:00:00 AM
Ulaanbaatar Standard Time-(UTC+08:00) Ulaanbaatar 6/12/2019 12:00:00 AM
Aus Central W. Standard Time-(UTC+08:45) Eucla 6/12/2019 12:45:00 AM
Transbaikal Standard Time-(UTC+09:00) Chita 6/12/2019 1:00:00 AM
Tokyo Standard Time-(UTC+09:00) Osaka, Sapporo, Tokyo 6/12/2019 1:00:00 AM
North Korea Standard Time-(UTC+09:00) Pyongyang 6/12/2019 1:00:00 AM
Korea Standard Time-(UTC+09:00) Seoul 6/12/2019 1:00:00 AM
Yakutsk Standard Time-(UTC+09:00) Yakutsk 6/12/2019 1:00:00 AM
Cen. Australia Standard Time-(UTC+09:30) Adelaide 6/12/2019 1:30:00 AM
AUS Central Standard Time-(UTC+09:30) Darwin 6/12/2019 1:30:00 AM
E. Australia Standard Time-(UTC+10:00) Brisbane 6/12/2019 2:00:00 AM
AUS Eastern Standard Time-(UTC+10:00) Canberra, Melbourne, Sydney 6/12/2019 2:00:00 AM
West Pacific Standard Time-(UTC+10:00) Guam, Port Moresby 6/12/2019 2:00:00 AM
Tasmania Standard Time-(UTC+10:00) Hobart 6/12/2019 2:00:00 AM
Vladivostok Standard Time-(UTC+10:00) Vladivostok 6/12/2019 2:00:00 AM
Lord Howe Standard Time-(UTC+10:30) Lord Howe Island 6/12/2019 2:30:00 AM
Bougainville Standard Time-(UTC+11:00) Bougainville Island 6/12/2019 3:00:00 AM
Russia Time Zone 10-(UTC+11:00) Chokurdakh 6/12/2019 3:00:00 AM
Magadan Standard Time-(UTC+11:00) Magadan 6/12/2019 3:00:00 AM
Norfolk Standard Time-(UTC+11:00) Norfolk Island 6/12/2019 3:00:00 AM
Sakhalin Standard Time-(UTC+11:00) Sakhalin 6/12/2019 3:00:00 AM
Central Pacific Standard Time-(UTC+11:00) Solomon Is., New Caledonia 6/12/2019 3:00:00 AM
Russia Time Zone 11-(UTC+12:00) Anadyr, Petropavlovsk-Kamchatsky 6/12/2019 4:00:00 AM
New Zealand Standard Time-(UTC+12:00) Auckland, Wellington 6/12/2019 4:00:00 AM
UTC+12-(UTC+12:00) Coordinated Universal Time+12 6/12/2019 4:00:00 AM
Fiji Standard Time-(UTC+12:00) Fiji 6/12/2019 4:00:00 AM
Kamchatka Standard Time-(UTC+12:00) Petropavlovsk-Kamchatsky - Old 6/12/2019 5:00:00 AM
Chatham Islands Standard Time-(UTC+12:45) Chatham Islands 6/12/2019 4:45:00 AM
UTC+13-(UTC+13:00) Coordinated Universal Time+13 6/12/2019 5:00:00 AM
Tonga Standard Time-(UTC+13:00) Nuku'alofa 6/12/2019 5:00:00 AM
Samoa Standard Time-(UTC+13:00) Samoa 6/12/2019 5:00:00 AM
Line Islands Standard Time-(UTC+14:00) Kiritimati Island 6/12/2019 6:00:00 AM

Webinar Registration

In this technical real training for free session, we will take 5 techniques from the MITRE ATT&CK framework, and demonstrate how to use them to detect and respond to threats.

The MITRE ATT&CK framework is quickly becoming a focal point in the security world — and for good reason. This framework provides a consistent, industry-wide standard on which you can assess the effectiveness of your security monitoring and alerting capabilities. If you are new to ATT&CK, check out my earlier webinar that introduces the framework and discusses how to align and enrich your security monitoring efforts with it:     https://www.ultimatewindowssecurity.com/webinars/register.aspx?id=1534

In this webinar, we will build on the last webinar and get deep into application. We will zero in on using the MITRE ATT&CK framework to focus and prepare your threat detection capabilities.

Here are the 5 techniques we’ve selected, based off the tactic prevalence:

ID

Name

Tactic

Data Sources

T1090

Connection Proxy

Command and Control

Process use of network, Process monitoring, Netflow/Enclave netflow, Packet capture

T1048

Exfiltration Over Alternative Protocol

Exfiltration

User interface, Process monitoring, Process use of network, Packet capture, Netflow/Enclave netflow, Network protocol analysis

T1036

Masquerading

Defense Evasion

File monitoring, Process monitoring, Binary file metadata

T1189

Drive-by Compromise

Initial Access

Packet capture, Network device logs, Process use of network, Web proxy, Network intrusion detection system, SSL/TLS inspection

T1035

Service Execution

Execution

Windows Registry, Process monitoring, Process command-line parameters

 

We’ll explore each one of these techniques with you, highlighting how the attackers use them and how you can detect them. We will discuss which logs you need to be collecting, what audit policy needs to enabled, and what you need to look for in those logs.

These 5 techniques each come from a different Tactic category in ATT&CK, and relate to different phases in an attack’s lifecycle. Mature threat detection and response requires that you have capabilities across the threat lifecycle, from initial access through command and control and into exfiltration.

We’ll then pivot to Dan Kaiser and Brian Coulson from our sponsor, LogRhythm, who will demonstrate how to use each of these techniques with an actual SIEM. Brian and Dan are part of a large project at LogRhythm Labs in which they are aligning MITRE ATT&ACK with their SIEM platform.

When coupled with a SIEM solution, the MITRE ATT&CK framework allows you to effectively test your security monitoring environment against attack techniques to validate that your technology and rules are truly working and alert you to the right anomalous behavior.

To this end, LogRhythm Labs is developing a MITRE ATT&CK module designed to detect and alert to anomalous behavior on a per-technique basis. With the LogRhythm MITRE ATT&CK module, you can ensure that you’re catching critical threats that hit your network.

In this real time training for free session, you’ll learn:

  • How to incorporate ATT&CK to work in your environment
  • Building out practical, technical threat detection
  • How to use SIEM technology and logs for threat hunting

Please join us for this real training for free event.

 

First Name:   
Last Name:   
Work Email:  
Phone:  
Organization:  
Country:    
State:  
Job Title:
 

Your information will be shared with the sponsor.

By clicking "Submit", you're agreeing to our Privacy Policy and consenting to be contacted by us.

 

 

Additional Resources