Threat Hunting with MITRE ATT&CK Framework and Windows Event Logs

Introduction

What is MITRE?

MITRE is a non-profit organization that supports government and industry in research and development, focusing on national security, healthcare, and cybersecurity. They are known for creating frameworks like ATT&CK to enhance threat detection and defense strategies.

What is ATT&CK?

ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally accessible framework by MITRE that details adversary tactics and techniques based on real-world observations. It helps organizations understand and improve their cybersecurity defenses against various threats.

What is TTP?

TTP stands for Tactics, Techniques, and Procedures, which describe the behavior and methods used by adversaries during cyberattacks. It helps analysts understand and identify patterns of malicious activity to better defend against threats.

What is Windows Event Log?

Windows Event Log is a system in Microsoft Windows that records significant events like system notifications, errors, and security-related activities. It is used for monitoring and analyzing system behavior, aiding in the detection of security incidents.

Overview of MITRE ATT&CK Framework

Mapping Windows Event Log with MITRE ATT&CK Framework

It is important to note that it’s not 1=1 with Windows Event logs and MITRE ATT&CK Framework. Windows Event IDs can be linked with multiple tactics and techniques.

When investigating a possible attack it is always worthy to establish the context of the analysis.

For example, the ‘T1078 Valid Accounts’ exists under Initial Access, Persistence, Privilege Escalation tactics. So using the Event IDs: 4624, 4625, 4672, 4648, 4768, 4749, 4634, we can track which credentials were used then we can identify the context of the data enough to determine where its at in the framework. All I’m yapping about is that, these IDs are not a sure-fire way to get you the answer that you need. It’s still you, the analyst, whom will pin-down the answer that you’re looking for ;) you can do this.

And here the Windows Event Log description:

Personal thoughts

Hmm. Not really sure if these were accurate enough, haven’t tested it yet in an SIEM or log viewer. Definitely will test these. But FWIW, here’s Ultimate Windows Security and MITRE. Also, this project called DeTTECT looks cool. Worth to check out.