12th EU ATT&CK Community Workshop Hybrid Format

Centre for Cybersecurity Belgium (CCB)

The 12th  EU MITRE ATTACK® Community Workshop will take place on 17/05/24 from 9.30am until 5.30pm (CEST) and is hosted by the CCB.

SQUARE Brussels Meeting Centre

The 12th EU MITRE ATT&amp;CK® Community Workshop will take place on the 17th of May 2024 from 9:30am until 5.30pm (CEST) and will be hosted by the <a href="https://ccb.belgium.be/en" title="https://ccb.belgium.be/en" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">Centre for Cybersecurity Belgium (CCB)</a>. The event is hybrid: you can choose to attend online via videoconference or attend in-person at The Square, Mont des Arts, 1000 Brussels.Content of the Community WorkshopThe workshop is organized by practitioners and for practitioners with an interest in the use of the ATT&amp;CK® Framework in Prevention, Detection/Hunting and Response. You will hear updates from the <a href="https://mitre-engenuity.org/cybersecurity/center-for-threat-informed-defense/" title="https://mitre-engenuity.org/cybersecurity/center-for-threat-informed-defense/" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">Center For Threat-Informed Defense</a> and from the developers of systems and tools supporting the ATT&amp;CK® Framework. But even more importantly, you will learn best practices from your peers in the user community.The highly-effective format of short (15’) lightning talks will focus on the following themes:1. Tools and methods for sharing2. Rules, playbooks and processes3. ATT&amp;CK® flavours (cloud, telecom, ICS, Active Defence…)Registration is mandatoryParticipation to the event is at no cost for the participants, but registration is required. Please bear in mind that the number of available seats for both in-person and online participation are limited so the organizers reserve the right to select participants if necessary.• We insist that you provide your real name, affiliation and a corporate email address in your registration.• If you would like to participate in-person please select "Entry ticket for on-site participation"• Tickets are distributed on a "first come, first serve basis"

Agenda

Opening and welcome

At the Centre for Cybersecurity Belgium (CCB), the use of the MITRE ATT&CK framework for the past few years has been integral in analyzing intrusions, managing incidents, and attributing attacks to known groups or 	attacker types. This analytical work leverages both public and private reports, alongside incidents handled by CCB or reported by our constituents. With the introduction of the CyberFundamentals framework, we have 	begun incorporating its controls and measures into our reports. This integration aids Belgian organizations in using CyberFundamentals as their main cybersecurity framework to prioritize measures, enhance their risk 	assessment programs, and facilitate strategic communications with C-level executives and board members.

Enhancing Cybersecurity with MITRE ATT&CK and CyberFundamentals

This talk will present an innovative architecture that merges industry-leading SOC technologies, SIEM/XDR, SOAR, BAS, and a pinch of ChatGPT. The result is a detection engineering CI/CD pipeline that can automatically create, test, and deploy detection analytics. The proof is in the pudding: Live demo included!

 The Always-On Purple Team: An Automated CI/CD for Detection Engineering 

Adopting a Threat-Informed Defense requires combining its three core pillars: cyber-threat intelligence, testing/evaluation, and defensive measures. Each pillar complements the other and empowers defenders to stay ahead of attacks with precision and cost-effectiveness.  While many teams leverage the MITRE ATT&CK framework, they are quickly swarmed by the number of alerts and attempt to implement defenses that cut across the entire MITRE ATT&CK framework. While this approach might seem ideal from afar, it results in burnout and gaps due to resource limitations, staffing, etc. 

Threat-led attack emulation aims to precisely identify the specific threat actors relevant and important for enabling effective defense. This allows testing and balancing an organization's threat model, customized security tools, integrated CTI, and other adversarial signals to determine the factors that influence practical decision-making. 

Threat-Led Attack Emulation: Holistic & Efficient Adoption of Threat-Informed 

This presentation explores how automating purple teaming exercises with the MITRE ATT&CK framework can significantly enhance your organization's cybersecurity posture. We'll explore how ATT&CK's standardized approach to classifying adversary tactics, techniques, and procedures (TTPs) provides a common language for security teams and lays the groundwork for effective automation. I’ll also showcase a variety of tools that can be leveraged to automate different aspects of purple teaming with ATT&CK.

Purple Teaming Automation

This talk outlines an improved method for conducting controlled cyber-attack simulations in an organisation. It leverages real-world threat intelligence, thorough preparation, and collaborative rehearsals to improve existing cybersecurity breach response processes. Utilising the MITRE ATT&CK framework, we present a model to conduct continuous targeted attack simulations integrating red teaming and crisis simulation tests to exercise the crucial interplay between red, blue, and business teams. We will discuss how to define metrics, measure and track trends, showcasing real-world implementation outcomes that have supported CISOs effectively communicate program benefits to leadership.

TotalTest – An Integrated Approach to Conducting Attack Simulation

The concept of Threat-Informed Defense (TID) emphasizes the need to prioritize threats significant to an organization. However, implementing TID raises crucial questions. What are the practical steps for doing this? Should the Cyber Threat Intelligence (CTI) team bear the responsibility for critical decision making? Which techniques should be prioritized and how does one transition from merely identifying techniques to implementing detailed procedures? How do we effectively distinguish and keep track of these threats? Why isn't relying solely on detection sufficient in building a robust defense mechanism? 
 
In this presentation, we aim to address these questions based on our experience implementing threat-informed defense strategies. Additionally, it will be an invitation for a dialogue through which attendees can exchange diverse experiences and perspectives, thereby enriching our collective understanding and approach to TID.

Threat-Informed Defense: Transforming Intelligence into Countermeasures

Coffee

This presentation explores the application of Generative AI (GenAI) in leveraging ATT&CK for Threat-Informed Defense (TID). Utilizing GPTs, a Retrieval Augmented Generation (RAG) mechanism from OpenAI, we created a GenAI model for Threat-Informed Defense, called "GenAI for TID," by incorporating ATT&CK into its knowledge base. We empirically assessed its effectiveness in supporting TID Research & Development processes and evaluated its potential contributions as an R&D partner, based on our actual experiences. I will demonstrate how GenAI for TID can assist in R&D processes such as TF-IDF Attribution and its visualization. GenAI for TID delivered results that greatly surpassed our expectations, making it feel like we have an R&D companion by our side. This capability should prove invaluable to security researchers and analysts, who must continuously adapt their strategies in the ever-evolving threat landscape.

GenAI for Threat-Informed Defense - GenAI as Buddy for TID Research & Developm

In this presentation, we explore practical approaches for leveraging Large Language Models (LLMs) to derive insights on prevention, detection, and response from threat intelligence, focusing on the MITRE ATT&CK framework. The presentation aims to provide value to both technical and non-technical attendees, equipping them with the knowledge to delve into this emerging field and encourage meaningful conversations.

Chat with your CTI

This talk aims to show how to combine Mitre ATT&CK and Cyber Risk Quantification to further optimise a business risk mitigation decision, regardless of focus for either prevention, detection or response. The presentation will work through a small number of ATT&CK scenarios and shows possible next steps.

The rationale for Cyber Risk Quantification

Implementation of digital maintenance for trains (rolling stock) bridges the gap between safe and resilient operations - a goal for all transport operators - and cybersecurity.
Rolling stock (trains) may not yet have a broad and public evidence base against which to use ICS MITRE ATT&CK best practice, but the tactics and techniques can form a design basis to inform Digital Maintenance R&D. The presentation will cover recommendations and limitations, along with actionable insights on R&D roadmapping, particularly for those with legacy CNI who are looking to bridge the gap between safety, resilient operations and cybersecurity. 

Digital Maintenance for Rail: A MITRE ATT&CK Handbook for Today (and Tomorrow)

Lunch break

Update from the ATT&CK team

Center for Threat-Informed Defense R&D Update

One of the most requested features after the creation of Sigma was the capability to express relationships between events and correlations. A first proposal was made in the end of 2020 and at the end of 2023 the first open source implementation of Sigma Correlations was released in pySigma. This now enables to express certain common event correlations in a generic way and to convert these into queries of target systems that support the required query commands and operations. The first backend support was implemented in the Splunk backend and further backends will follow. This talk summarizes the new capabilities, requirements and limitations Sigma Correlations and gives an outlook on future developments.

Introduction of Sigma Correlations

SigmAIQ elevates the management of Sigma rules through its innovative design as a wrapper for pySigma backends and pipelines, integrating Large Language Model (LLM) support. This presentation will highlight SigmAIQ’s unique ability to convert, create, and refine Sigma detection rules directly from conversational prompts containing MITRE ATT&CK Tactics & Techniques, specific IOCs, and log examples. This functionality not only enhances the adaptability and precision of threat detection but also democratizes the development process, making it accessible and impactful for the cybersecurity community. By sharing our experiences and insights into SigmAIQ’s development and deployment, we aim to illustrate its contribution to advancing collaborative defenses and operational efficiencies for the open-source detection engineering community. 

SigmAIQ: Bridging Advanced LLM Support with Sigma Rules for Next-Gen Cyber Def

In the era of AI, one may wonder, how will we detect cyber attacks on time and be able to interpret their objectives. Even better, how can we act in advance? As our industry collaborates every day to describe lessons learned using MITRE ATT&CK, we can pave the way for the SOC and CTI Analysts on processing vast volumes of attacker behaviors faster and more precise than ever before. Since 2019, we have linked over 13,000 of Sigma rules to ATT&CK and now used them to train LLM of MITRE TRAM. We’ll discuss the outcomes and how we’re moving to the next step in threat detection evolution using TRAM, ATT&CK, Sigma and Roota rules to collaborate online, crowdsource threat detection and intelligence in v3 Threat Bounty program. We’re setting the new speed record in collective cyber defense, together.

TRAM LLM for ATT&CK

This session provides a data-driven review of publicly available intelligence around "less prominent" MITRE ATT&CK® Techniques (i.e. Techniques outside the well-known Windows space). Specifically, we'll focus on recent threat reports featuring Cloud, MacOS, and Linux Technique references and the Groups, Campaigns, & Software that used them, spotlighting several timely threats that don't yet appear in the formal knowledge base. We will also briefly demonstrate workflows useful for managing the growing volume of public CTI, including reports that do and do not explicitly reference Technique IDs.

A Look Outside the Window(s): CTI Spotlight on Less-Prominent ATT&CK Technique

The presentation focuses on how The State Service of Special Communications and Information Protection of Ukraine (hereinafter SSSCIP) leverages the MITRE ATT&CK framework to identify, assess, and counteract cyber threats. It includes the overview of implemented tools and technologies that support the ATT&CK, highlights the main challenges that the SSSCIP faces in operationalising threat intelligence effectively and sheds light on the used strategies to overcome these challenges. A case study regarding a recent joint analytical report by the SSSCIP and Palo Alto Networks Unit 42 concerning SmokeLoader malware will also be presented. 

Operationalizing Threat Intelligence to ATT&CK your Adversaries

Unlocking potential of MITRE ATT&CK

This presentation will provide an insight into the use of QR by threat actors and how the existing malware infrastructure evolved to cater for this remerging delivery method.

Matching the Attack - Growth in use of QR Codes

The EU Cybersecurity regulatory landscape is getting wider than ever :  DORA, CRA, NIS2, EUCS, .. Either you are selling products or managing critical systems and data, it is challenging to comply to multiple requirements coming from various different EU Countries. It is also very challenging to properly capture the threats and find mitigations.  Expleo Belgium has invested into a Requirement allocation model that provides more transparency on requirements allocation, related risks using MITRE Att&ck. It helps in providing a cost effective way to make systems and data compliant to multiple source of requirements needs. We wanted to share the model and return of experience with Belgian companies to this 12th Twelfth EU MITRE ATT&CK® Community workshop.

Cost effective requirements allocation with MITRE ATT&CK

The MITRE ATT&CK framework has become the Rosetta Stone of cyber defense. With growing popularity comes… more frameworks! This talk dives into the wild world of MITRE ATT&CK derivatives, exploring the challenge to integrate those with tools and highlighting the need for standardization. Get ready for a lightning-fast exploration of the challenges of navigating a landscape with new threat matrices popping up regularly. We'll discuss the benefits of a unified approach and brainstorm solutions to keep everyone speaking the same cyber language.

Standardising Threat Matrices: the good, the bad, the ...

Leveraging MITRE ATT&CK to Develop the MISP Galaxy Standard: Building a Robust

This talk demonstrates the use of honeypots in collecting data on entities conducting Internet-wide vulnerability scans. Through five distinct experiments, we discerned how a honeypot's profile impacts the results. The five honeypot profiles examined are: (1) a default Ubuntu box, (2) a Wordpress installation with the top vulnerable plugins, (3) a honeypot with robots.txt and security.txt files, (4) a "reverse" nuclei honeypot, and (5) a honeypot simulating CISA Known Vulnerabilities.

Honeypots and how to use them with ATT&CK

Closing

Our {communityGuidelinesLink} describe the sort of content we prohibit on Eventbrite. If you suspect an event may be in violation, you can report it to us so we can investigate.

To report other categories of prohibited or illegal content, submit {link}

12th EU ATT&CK Community Workshop Hybrid Format

More events from Centre for Cybersecurity Belgium (CCB)

Follow organizers to get events picked for you

12th EU ATT&CK Community Workshop Hybrid Format

More events from Centre for Cybersecurity Belgium (CCB)

Follow organizers to get events picked for you

You might also like...

Browse more events with different dates, prices, and formats to find your next great experience.