MITRE ATT&CK & Detection Engineering

ATT&CK memetakan perilaku penyerang — bahasa bersama antara red & blue team. Taktik (mengapa): Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact. Teknik (bagaimana): - T1059 Command and Scripting Interpreter - T1078 Valid Accounts - T1055 Process Injection Alur detection engineering:

  1. Pilih teknik relevan -> 2. Tulis hipotesis
  3. Buat rule -> 4. Uji dengan simulasi (Atomic Red Team)
  5. Ukur coverage di ATT&CK Navigator

Sigma rule bisa dikonversi ke query Splunk/Elastic/Sentinel.