Offensive Security: Towards Proactive Threat Hunting via Adversary Emulation

Abstract

Attackers increasingly seek to compromise organizations' systems and data with advanced methods, often utilising legitimate tools. In the main, organisations employ reactive approaches to cyber security, focused on rectifying immediate incidents and preventing repeat attacks, through protections such as Security Information and Event Management (SIEM), firewalls, anti-spam/anti-malware solutions and system patches have been demonstrated to have significant weaknesses in addressing modern attacks. Proactive approaches, have been seen as part of the solution to this problem. However, techniques such as vulnerability and penetration testing (VAPT) are recognised as having limited scope and only working with threats that have already been discovered. Promising methods such as threat hunting are gaining momentum, enabling organisations to identify and rapidly respond to any potential attacks, though they have been criticised for their significant cost. In this paper, we present a novel model for uncovering tactics, techniques, and procedures (TTPs) through offensive security, specifically threat hunting via adversary emulation. The proposed technique is based on a novel approach of inducing adversary emulation (mapping each respective phase) model inside the threat hunting approach. The experimental results show that the proposed approach exploits the threat hunting via adversary emulation and has countervailing effects on hunting advance level threats. Moreover, the threat detection ability of the proposed approach utilizes minimum resources. The proposed approach can be exploited to develop the offensive security-aware environment for organizations to uncover advanced attack mechanisms and test their ability for attack detection.

Study of bypassing Microsoft Windows Security using the MITRE CALDERA Framework

“…This then leads to providing the right solution/recommendation to the blue teams/organizations. 14,15 CALDERA can also be utilized to test endpoint security arrangements and evaluate a network's security capability to withstand the common post-compromise, antagonistic strategies contained within the ATT&CK approach. 14 CALDERA leverages the ATT&CK approach to distinguish and imitate enemy behaviors as if a genuine interruption is happening.…”

Knowing the unknown: The hunting loop

“…Hypothesis development focuses on the type of hypothesis. According to the SANS Institute, the definition of a hypothesis is based on intelligence, domain knowledge, and situational awareness (Ajmal et al, 2021). Intelligence-based assumptions come from an understanding of the attacker's tactics, techniques, and procedures (TTPs), and behaviors.…”

“…To track threats with particular attention to certain attackers, it is required to improve the accuracy of the threat intelligence. Threat intelligence informs threat hunters of content that can be detected by a particular attacker's TTP (Ajmal et al, 2021).…”

“…The combined hypothesis should cover the entire system under investigation. Each hypothesis focuses on a specific analytical problem related to the target, regardless of its composition (Ajmal et al, 2021).…”

Turning the Hunted into the Hunter via Threat Hunting: Life Cycle, Ecosystem, Challenges and the Great Promise of AI

“…The use of this approach help organizations to discover advanced attack mechanisms and measure their ability to detect attacks [103]. As opposed to traditional approaches that emphasize on identified threats including vulnerability assessment and penetration testing, new unknown threats can be identified and addressed with this method [104].…”