Threat Hunting in the Cloud

CHAPTER 3Exploration of MITRE Key Attack Vectors

What's in This Chapter

• Understanding the MITRE ATT&CK framework, its tactics, techniques, and case studies
• Threat hunting using five common techniques
• Analyzing the Zero Trust and defense-in-depth approaches
• Exploring the key threat-hunting tools to combat attack vectors
• Exploring the popular tools for analysis such as SIEM and SOAR

Understanding MITRE ATT&CK

Today, organizations are digitally evolving by choosing among diverse technology options to store business-critical data. On the other hand, the cyberthreat landscape is expanding geographically and constantly looking for vulnerabilities in the security layers to perform security compromises. Cyberattackers are consistently staying a step ahead of the security measures taken by organizations and succeeding in their data breach menace.

NOTE The MITRE ATT&CK framework can increase visibility and improve an organization's security efforts.

To address today's challenges, the threat-hunting team needs to build a set of techniques to investigate and create a hypothesis of how attacks would work. This includes determining what artifacts are in the logs and the other parts of the systems such as volatile memory, Registry, bootloader, etc., that need to be analyzed. Organizations with an offense-focused team, like a pen-test group or a red team, have in-house experts who research and practice attacker techniques. Others may need to rely on researching published materials ...