CISA consistently encourages incident responders and analysts to leverage the MITRE ATT&CK framework in mapping observed threat actor activity to defined tactics and techniques.
MITRE ATT&CK is a free knowledge-based repository of cyber actors’ tactics and techniques based on real-world observations. These tactics and techniques include known exploits used on cloud systems, such as Create Account: Cloud Account [T1136.003] and Cloud Infrastructure Discovery [T1580]. Understanding the techniques cyber threat actors use to compromise cloud environments can help defenders better target detections and mitigations to those techniques. This understanding can also assist network defenders in identifying tailored defenses. This framework provides an abundance of information for organizations of any size to leverage in their respective organizations.
Network defenders can leverage ATT&CK to identify defensive gaps, assess security tool capabilities, organize detections, hunt for threats, engage in red team activities, or validate mitigation controls.
On March 1, 2023, CISA, together with the Homeland Security Systems Engineering and Design Institute (HSSEDI), operated by the MITRE Corporation, released Decider. Decider assists incident responders and analysts in mapping observed activity to the MITRE ATT&CK framework. The tool makes mapping to ATT&CK easier by providing step-by-step guidance, including techniques used against cloud systems.
Decider starts with a series of questions to help network defenders properly identify adversary tactics, techniques, or sub techniques. With Decider, users can filter queries relevant to user analysis to determine the best possible identification
method. After gaining proper mapping accuracy, users are then able to:
For guidance on how to properly use Decider, see CISA’s Decider Fact Sheet, video, and blog. CISA encourages analysts and incident responders to use the tool in conjunction with the recently updated Best Practices for MITRE ATT&CK®
Note: This factsheet provides examples of tools for informational purposes only. CISA does not endorse any commercial
product or service, including any subjects of analysis. Any reference to specific commercial products, processes, or services does not constitute or imply their endorsement, recommendation, or favoring by CISA
If you are interested in finding out more about the IISF, or would like to attend one of our Chapter Meetings as an invited guest, please contact the
Enhance your Cybersecurity knowledge and learn from those at the coalface of information Security in Ireland
Sponsors are featured prominently throughout the IISF.IE website, social media channels as well as enjoying other benefits Read more