adversary_emulation_library - An open library of adversary emulation plans desig

项目说明

Ad Emulation Library

In collaboration with Center Participants, the MITRE Center for Threat-Informed Defense
(Center) maintains a library of ad emulation
plans to allow organizations to e their defensi against the
real-world threats they face. Emulation plans are an essential component in testing
current defenses for organizations that are looking to prioritize their defenses around
actual ad behavior. Focusing our energies on de a set of common emulation
plans that are a to all means that organizations can use their limited time and
resources to focus on understanding how their defenses actually fare against real-world
threats.

The library contains two types of ad emulation plans: full emulation and micro
emulation.

Full emulation plans are a comprehensi to emulating a specific ad,
e.g. FIN6, from initial access to exfiltration. These plans emulate a wide
range of ATT&CK tactics & techniques and are designed to emulate a real breach from the
designated ad.

Micro emulation plans are a focused approach to emulating compound behaviors seen
across multiple ad, e.g. webshells.
These plans emulate a small amount of ATT&CK techniques that are typically performed as
part of one ad action.

Also see our blogs on the Ad Emulation
Library
and Micro Emulation
Plans.

A ad emulation plans are listed below:

| Full Emulation Plans | Intelligence Summary |
| -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| APT29 | APT29 is thought to be an organized and well-resourced cyber threat actor whose collection objecti to align with the interests of the Russian Federation... |
| Blind Eagle | Blind Eagle is a South American threat actor focused on Colombia-based institutions, including entities in the financial, manufacturing, and petroleum sectors. Largely opportunistic in their motives, Blind Eagle le commodity RATs modified to fit the en... |
| Carbanak Group | Carbanak is a threat group who has been found to manipulate financial assets, such as by transferring funds from bank accounts or by taking over ATM infrastructures... |
| FIN6 | FIN6 is thought to be a financially motivated cyber-crime group. The group has aggressively targeted and compromised high- POS systems in the hospitality and retail sectors since at least 2015... |
| FIN7 | FIN7 is a financially-motivated threat group that has been associated with malicious operations dating back to late 2015. The group is characterized by their persistent targeting and large-scale theft of payment card data from systems... |
| menuPass | menuPass is thought to be threat group motivated by collection objectives, with targeting that is consistent with Chinese strategic objectives... |
| OceanLotus | OceanLotus is a cyber threat actor aligning to the interests of the go. First seen in 2012, OceanLotus targets private corporations in the manufacturing, consumer product, and hospitality sectors as well as foreign go, political dissidents, and journalists.... |
| OilRig | OilRig is a cyber threat actor with operations aligning to the strategic objectives of the Iranian go. OilRig has been operational since at least 2014 and has a history of widespread impact, with operations directed against financial, go, energy, chemical, telecommunications and other sectors around the globe... |
| Sandworm | Sandworm Team is a destructi group attributed to Russia's General Staff of the Armed Forces, Main Intelligence Directorate (GRU) that has been reportedly acti 2009. Sandworm is known for conducting large scale, well funded, destructive, and aggressi such as Olympic Destroyer, CrashO/Industroyer, and NotPetya... |
| Turla | Acti at least the early 2000s, Turla is a sophisticated Russian-based threat group that has infected in more than 50 countries. Turla le no and custom tooling and open-source tools to elude defenses and persist on target networks... |
| Wizard Spider | Wizard Spider is a Russia-based e-crime group originally known for the Trickbot banking malware. In August 2018, Wizard Spider added capabilities to their Trickbot software enabling the deployment of the Ryuk ransomware. This resulted in "big game hunting" campaigns, focused on targeting large organizations for high-ransom return rates... |

| Micro Emulation Plans | Intelligence Summary |
| ---------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Acti Enumeration | Emulate multiple TA0007 Discovery behaviors through commonly abused interfaces and services such as Acti (AD) |
| Data Exfiltration | Emulates the compound behaviors of an ad finding, staging, archiving, and extracting sensiti, as described in TA0010 Exfiltration |
| DLL Sideloading | Emulates an ad executing an otherwise legitimate/benign application in order to hijack its modules/libraries to instead inject their malicious payload, as described in T1574.002 Hijack Execution Flow: DLL Side-Loading |
| File Access and File Modification | Emulate file access and modification behaviors commonly associated with TA0009 Collection as well as T1486 Data Encrypted for Impact. (Data source: DS0022 File) |
| Log Clearing | Emulates an ad clearing Windows Event Log, as described in T1070.001 Indicator Removal: Clear Windows Event Logs |
| Named Pipes | Emulates the creation and use of named pipes commonly abused by malware (Data source: DS0023 Named Pipe) |
| Process Injection | Emulates the compound behavior of T1055 Process Injection followed by execution of arbitrary commands (T1059 Command and Scripting Interpreter) |
| Reflecti | Emulates an ad performing running malicious code within an arbitrary process to perform T1620 Reflective Code Loading |
| Remote Code Execution | Emulates an ad performing remote code execution against a web server as documented in T1190 Exploit Public-Facing Application |
| User Execution | Emulates the compound behavior of deli a malicious .one, .doc, .lnk, or .iso file (e.g. via T1566.001 Phishing: Spearphishing Attachment) and then executing arbitrary commands after a user invokes the file (T1204.002 User Execution: Malicious File and T1059 Command and Scripting Interpreter). |
| Web Shells | Emulates the compound behavior of planting a web shell (T1505.003 Ser Component: Web Shell) and then executing arbitrary commands through it (T1059 Command and Scripting Interpreter) |
| Windows Registry | Emulates a few common methods that ad use to modify the Windows Registry. (Data Source: DS0024 Windows Registry) |

Philosophy

These ad emulation plans are based on known-ad behaviors and designed to
empower red teams to manually emulate a specific threat actor in order to test and
e defensi from a threat-informed perspective. This approach
empowers defenders to operationalize cyber threat intelligence to better understand and
combat real-world ad. Rather than focusing on static signatures, these
intelligence-dri plans provide a repeatable means to test and tune
defensi and products against the e Tactics, Techniques, and
Procedures (TTPs) of threat actors and malware.

Ad Emulation Background

Ad emulation enables organizations to view their security through the eyes of a
cyber ad with the goal of improving defenses across the ad’s lifecycle. As
defenders this expands our attention and focus beyond just the final actions of the
ad achieving their operational objective to rather understand and appreciate
every distinct behavior (that could have been detected and/or mitigated) leading up to
that point.

Each emulation plan is rooted in intelligence reports and other artifacts that capture
and describe breaches and campaigns publicly attributed to a specific named threat
actor. To develop each plan, we research and model each threat actor, focusing not only
on what they do (ex: gather credentials from ) but also how (using what specific
tools/utilities/commands?) and when (during what stage of a breach?). We then develop
emulation content that mimics the underlying behaviors utilized by the threat actor
(i.e. not an exact representation, rather capturing the pertinent elements that
accurately generate appropriate test telemetry for defenders). This approach results in
nuanced emulation plans, each capturing unique scenarios and perspectives that we can
le as threat-informed defenders.

Getting Started with Full Ad Emulation Plans

As is the case with traditional red teaming and penetration testing, ad emulation
is a specific style of offensi performed to help us test and tune our
defenses. In this case, our objective is to operationalize cyber threat intelligence
describing behaviors observed in specific campaigns or malware samples. From this
intelligence, we select and execute a subset of behaviors (and their ) to
assess our defenses from the perspective of the specific threat.

As described in the next section, each emulation plan captures specific threat
scenarios. These scenarios can be executed end-to-end, or indi behaviors can be
tested. Organizations can also choose to further customize the scenarios and/or
behaviors within each emulation plan to better fit their specific en,
priorities, or to be shaped by additional intelligence.

In summary, each full emulation plan should be perceived as input to an offensive
assessment/red team. The content can be used as strict instructions to follow, or as
just a starting point to be built upon and personalized.

Full Emulation Plan Structure

Each emulation plan focuses on a specific named threat actor. The README of each
indi plan provides a curated summary of a cyber threat intelligence,
composed of an intelligence o of the actor (describing who they target, how, and
why where possible) as well as the scope of their activity (i.e. breadth of techniques
and malware used). All presented information is cited back to relevant publicly
a cyber threat intelligence and communicated and annotated via
ATT&CK.

Within each emulation plan, the operational flow provides a high-le of the
captured scenario(s). These scenarios will vary based on the ad and a
intelligence, but typically follow a sequential progression of how the actor breaches
then works towards achieving their operational objecti a en
(espionage, data/system destruction, etc.).

The content to execute the scenario(s) is broken down into step-by-step procedures
provided in both human and machine-readable formats. Scenarios can be executed
end-to-end or as indi tests. The human-readable formats provide additional
relevant background where possible as well as any setup prerequisites, while the
machine-readable format is designed to be programmatically parsed (ex: read,
reformatted, and ingested into an automated agent, such as
CALDERA and/or breach simulation frameworks).

Detailed documenation for our full emulation plan structure can be found
here.

Getting Started with Micro Emulation Plans

Similar to full emulation plans, micro emulation plans are a type of ad emulation
that is designed to help us test and tune our defenses. However, these plans can be
executed without a red team and without the need for an offensi. Each plan
is still composed of an intelligence o for the behaviors being emulated, however
we are emulating behaviors that are common across multiple ad as opposed to a
singular ad.

These plans are easy to execute, with no dependencies needed or special configuration of
your en. All plans can be executed from either a standalone or networked
machine. They can be executed manually or integrated into automation software. We have
provided an example of how to execute a plan with
CALDERA, but these plans can be broadly
applied to other platforms.

Each micro plan has default runtime options, however, detailed instructions can be found
on the README for each plan on how to customize execution to fit your specific needs.
We ha the source code and BUILD instructions for each plan, so that they
can be modified and recompiled, as needed.

The micro plans can be downloaded from the Releases
page.

Future Work

The threat landscape changes every day, as new groups/malware emerge and known
ad adapt and evolve. The Center will continue to populate and maintain this
library to match this growth cur dedicated research efforts that aim to either
create or update plans based on a specific ad.

Questions and Feedback

Please submit issues for any technical questions/concerns or contact
directly for more general inquiries.

Also see the guidance for contributors if are interested in
contributing.

Liability / Responsible Usage

This content is only to be used with appropriate prior, explicit authorization for the
purposes of assessing security posture and/or research.

Notice

Copyright 2020-2021 The MITRE Corporation. Approved for public release. Document number CT0005

Licensed under the Apache License, 2.0 (the "License"); you may not use this
file except in compliance with the License. You may obtain a copy of the License at

Unless required by applicable law or agreed to in writing, software distributed under
the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the specific language go
permissions and limitations under the License.

This project makes use of ATT&CK®

ATT&CK Terms of Use

项目信息

开发语言：C

Star 数：2168

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕An open library of adversary emulation plans designed to empower organizations to test their defenses based on real-world TTPs. 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。