Scott J Roberts Head of Threat Research 2023-10-25 Leveraging Limited Resources to Build an Evolving Threat Repository Driving Intelligence with MITRE ATT&CK 

Scott J Roberts Head of Threat Research at Interpres 

What Interpres Does Defense Readiness 01 Defense Surface Op1miza1on 02 Prioritize Vulnerabilities 03 Stack & Product Ra1onaliza1on 04 

The Goal 

MITRE ATT&CK for Internal Customers Interpres is Intel driven from the core. Built originally on public threat intelligence data straight from mitre/cti. Needed custom threat data to keep up. 

Metrics for Threat Research at Interpres Depth Breadth Speed Accuracy 

Goals • Code First: git push or bust • Depth: Collection Requirements • Breadth: Collection Requirements • Speed: Automation • Accuracy: Automation & Manual Review • Compatibility: Output to STIX2 

The Problem (Well… 3!!!) 

STIX2 != ATT&CK && ATT&CK != STIX2 

We want MITRE Intelligence & Interpres Intelligence… with as little duplication as possible! 

Tooling is Limited 

The Solution 

STIX2 != ATT&CK && ATT&CK != STIX2 ATT&CK Tactics Techniques Groups Software Campaigns STIX2 Attack- Pattern Attack- Pattern Intrusion-Set Malware (Usually…) Campaigns ATT&CK to STIX2 

STIX2 != ATT&CK && ATT&CK != STIX2 

We want MITRE Intelligence & Interpres Intelligence… with as little duplication as possible! 

We want MITRE Intelligence & Interpres Intelligence… with as little duplication as possible! • Wherever possible we use MITRE ATT&CK Content  Exclusively using MITRE ATT&CK Techniques  Leverage MITRE ATT&CK Groups, Malware, Campaigns, & Relationships • Build custom Groups, Malware, Campaigns & Relationships  Based on internal research, RFIs, etc  More on that a bit later • Relationships are intelligently divided between MITRE/CTI & Intrepres/CTI • DANGER (But Available): All lookups prioritize Interpres/CTI 

An Aside for a Good Name™ 

Tooling is Limited • All content is code (STIX2) and created with code  Automated: Custom Automapper (Let computer do what computers are good at)  By Hand Creation & Curation: Jupyter Notebooks + STIX2 Library • Actively working on STIX2 Helper Library  Merging, Bulk Actions, etc  Testing Mapping Scenarios • Git is workflow management • Yes, we looked at Decider, TRAM, & ATT&CK Workbench 

Advantages of Intelligence As Code: CI Error 

Advantages of Intelligence As Code: CI Error 

Advantages of Intelligence As Code: Solutions as Code 

Advantages of Intelligence As Code: CI 

Advantages of Intelligence As Code: CI 

The Future There are limitations of STIX2 Library & Jupyter Notebooks Synapse is code for Intelligence & Easier to Extend ConBnue leveraging STIX2 for CompaBbility & Tooling 

Salvador Dali “Have no fear of perfection – you’ll never reach it.” 

Thank you! 

InterpresSecurity.com