A short summary of the conference dedicated to the MITRE ATT&CK community. MITRE’s ATT&CKcon (v3.0) returned to an in-person event at their headquarters in McLean, Virginia, a little over a month ago (March 29 and 30), and was in-part the inspiration for my last post; MITRE ATT&CK 101. There was…

Going below the surface of the ATT&CK matrix. When speaking to customers about adding ATT&CK, they almost always have the Matrix in their mind. But there is so much more to ATT&CK below the surface Matrix. Tactics and Techniques are linked to many other knowledge-base items that can be really…

Last weeks post introduced the basics of Sentinel Detection and Hunting rules. If you missed it, you should read it here first before reading this post any further. In this weeks post we’ll look at the query part of the rule. Querires are written in Kusto Query Language (KQL). Kusto? Kusto…

I see more-and-more people we work with starting to use Microsoft Sentinel. Sentinel, whilst not exclusively a SIEM (it started life as a log aggregation platform), it is now beginning to compete well with other SIEM’s in the market that have grown from similar beginnings (Splunk, Elastic, etc.). Given many…

Put the skills you learned about STIX 2.1 Patterning in last weeks post to the test. I wanted to turn this weeks post into a game. The game is simple: Analyse the STIX 2.1 Pattern against the sample log line Determine if it makes a detection; true or false Answers…

Deconstructing STIX Patterns to write effective detection rules. STIX 2.1 Indicator Domain Objects are often confused with Indicators of Compromise (IOCs). STIX Indicator Objects can contain zero or more IOCs, but they are not IOCs themselves. IOCs are atomic indicators. These are elements or fragments of data that cannot be…

The STIX 2.1 is a schema that defines a taxonomy of cyber threat intelligence that is represented by different Object types. In total there are 3 Core Object types: STIX Domain Objects (SDOs) STIX Cyber-observable Objects (SCOs) STIX Relationship Objects (SROs) Most widely known are the 18 STIX Domain Objects…

At the end of last year I ran a series of post describing the syntax of Sigma rules (used for threat detection). If you missed any posts in that series, they are available here. This week I’m going to take a look at Google’s threat detection language, YARA-L, built for…

STIX 2.1 Domain Objects are a great way to describe threat intelligence. For a long time, many teams thought of threat intelligence as simply being indicators of compromise (IP addresses, URL’s, emails, etc). As the adoption of STIX 2.1 increases, this way of thinking is disappearing. Teams want context, and…