Incident Response

In January of 2024, a US government agency initiated an investigation with CPIRT following suspicious RDP (Remote Desktop Protocol) connections to one of their devices. This event occurred in the wake of two critical CVEs (CVE-2023-46805 and CVE-2024-21887) potentially impacting their Ivanti VPN. The customer’s team, along with the Check Point Incident Response Team (CPIRT), embarked on a forensic analysis to assess the extent of the breach.

In this CPIRT blog post, we will dive into the vulnerabilities exploited, the actions of the threat actor, the investigation logs, and the lessons learned.

In the upcoming third installment, we delve into the realm of visualizing ATT&CK® (Sub-)Techniques and associated Tactics for enhanced Incident Response insights. Discover approaches and ideas that bring clarity to the intricate landscape of cybersecurity events. From MITRE Navigator Layers to CTID Attack Flow Builder, explore ways to represent the flow of (Sub-)Techniques, aiding in the interpretation of Incident Response investigations. Stay tuned as we unlock the potential of static condensed Navigator images and Attack Flow visualizations, providing supporting visuals in Incident Response Reporting.

In this second blog post, we’ll decompose the JSON data structure for enterprise-attack.json provided on Github by MITRE. We’ll cover the elements that are of interest for automating pulling information from the JSON file and generating overviews of the collections of identified ATT&CK® (Sub-)Techniques with the available mitigations and detections from the ATT&CK® framework. We’ll extent this information with the help of the CIS Controls – MITRE ATT&CK® mappings and eventually the NIST 800-53 Rev 5 controls – MITRE ATT&CK® mappings. We’ll also include the Open Source Security Events Metadata (OSSEM) Detection Model in the detections part, and throw in Atomic Red Team™ tests into the party to generate an initial validations part.

Welcome to an enlightening series on MITRE ATT&CK implementations tailored for Incident Response Teams. Each post in this series builds upon the last, offering insights for which the depth of the application vary based on experience, maturity, and the environment's capabilities.

In this initial blog post, we delve exploring MITRE ATT&CK into post-incident reporting. MITRE ATT&CK, a repository of adversary Tactics, Techniques, and Procedures (TTPs), serves as a common vocabulary for reporting. We'll explore the hierarchical structure of Tactics and (Sub-)Techniques, and demonstrate how we supplement the incident report with standardize language describing the observed activities. This supports the victim in understanding the chain of events and be presented with a set of actionable recommendations.

Future posts will cover integrating mitigations and detections into reports, making this method applicable beyond post-incident reporting. Whether dealing with news, advisories, or threat intelligence, this approach offers a standardized transformation, promoting coherent communication and collaboration across various security contexts.

A podcast for security operations practitioners. Folks doing IR and SOC work or managing those who do.