Making Magnets for Needles in Noisy Haystacks: Operationalizing ATT&CK with Risk Based Alerting – Haylee Mills

MITRE ATT&CK helps us identify threats, prioritize data sources, and improve security posture, but how do we actualize those insights for better detection and alerting? We shift to alerts on aggregated behaviors over direct alerts, and make our noisy datasets into valuable treasure troves tagged with ATT&CK metadata. Let’s discuss the key features needed to implement this in any security toolset!

Operationalizing ATT&CK (5m)
I can’t make direct alerts for a lot of what ATT&CK identifies… my SOC would kill me. What do?!
Results of RBA Projects (5m)
Reduce alert volume by 50-90%, increased alert fidelity, cover huge swaths of ATT&CK
What is Risk Based Alerting (8m)
Rather than “high severity direct alert” and “alert nobody responds to”, shift to observations of behavior stored in buckets for each user or system, and only alert on buckets with interesting things.
Skeleton of a Risk Rule (4m)
Go over pieces of a not-alerting but observation-generating risk rule.
Security Metadata Enrichment (3m)
Example adding fields to IDS data.
Tweaking Scores by Object Attributes (3m)
Incorporating data about our objects to tweak levers up and down.
Alerting on ATT&CK (7m)
Now we build a rule that looks at risk events and discuss interesting alerting methods.
Rethinking Detection (13m)
Having AV, DLP, EDR, IDS, proxy, email, firewall, etc. speak this language is where we get so much more value. Discuss lenses for SOC, Fraud, Insider Threat, Machine Learning. Discuss: threat hunting queues – threat object/behavior alerting – capturing “zero risk” observations as forensics-lite
Wrap-Up (2m)
Reiterate how we save so much time on alert volume, investigation speed, and easier to develop content.