JUST RELEASED: ATT&CK for Industrial Control Systems
November 2019 Contribution Update

Due to the major change to ATT&CK with the addition of sub-techniques, we are asking for the community’s patience because we will be delayed in incorporating contributions into Enterprise and PRE-ATT&CK over the next several months until we complete the sub-technique migration. You can read more about sub-techniques and why this is such a big change for ATT&CK here. For new technique contributions, you may continue to send them to attack@mitre.org, but please keep in mind that we may not reply for several months as we work to include contributions into the sub-technique refactoring. Contributions for Mobile will continue as normal. For new Group and Software contributions to Enterprise or PRE-ATT&CK, we ask that you please temporarily put a hold on sending these to us until we make the change to sub-techniques. (This will allow us to focus on migrating existing Groups and Software, as new contributions would add to our workload.) We do appreciate your contributions and feedback, but ask for your patience and understanding over the next several months as we focus all our efforts on adding sub-techniques.

If you send technique contributions, it may take us several months to get back to you. We may ask you follow-up questions to help us understand your contribution and gather additional information. We recommend you read our philosophy paper to understand our approach to maintaining ATT&CK so that we get the right details up front. If we find the contribution fills a gap, then we will make edits and send you a draft version of the technique page for your review prior to it being published, listing you as a contributor if desired. The next content update will not be until 2020 and will be in a parallel site to attack.mitre.org to allow the community time to incorporate sub-techniques.

Contribute

You can help contribute to ATT&CK.

ATT&CK is in a constant state of development. We are always on the lookout for new information to help refine and extend what is covered. If you have additional techniques, know about variations on one already covered, have examples of techniques in use, or have other relevant information, then we would like to hear from you.

We are looking for contributions in the following areas in particular, but if you have other information you think may be useful, please reach us at attack@mitre.org.

All contributions and feedback to ATT&CK are appreciated. Due to the high volume of contributions, it may take us about a week to get back to you. We may ask you follow-up questions to help us understand your contribution and gather additional information. We recommend you read our philosophy paper to understand our approach to maintaining ATT&CK so that we get the right details up front. If we find the contribution fills a gap, then we will make edits and send you a draft version of the technique or Group/Software page for your review prior to it being published, listing you as a contributor if desired. Content updates happen roughly every 3-6 months.

Contributing to ATT&CK

Techniques

We appreciate your help to let us know about what new techniques and technique variations adversaries and red teamers are using. You can start by emailing us the technique name, a brief description, and references or knowledge about how it is being used by adversaries or red teams. We suggest you take a close look at what we already have on our site, paying attention to the level of abstraction of techniques. Since we are working on adding new technique details constantly, we will deconflict what you send with what we’re working on. We’ll provide feedback and work with you to get the content added.

macOS and Linux

While we are looking for new techniques for Windows, macOS, and Linux, we are interested in macOS and Linux techniques in particular since there is a lack of publicly available threat intel for techniques used against those systems. This leads to gaps in the knowledge base that you can help fill.

Threat Intelligence (Contributions paused until early 2020 due to sub-technique migration)

We map Group and Software examples on our site, and there is too much open source threat intelligence reporting for us to keep up on everything. We appreciate your help with referenced information about how Groups and Software samples use ATT&CK techniques. Threat intelligence contributions are most helpful to us when they are in the specific format we have on our website, including citing techniques and group names or associated groups to publicly-available references. We ask that you provide the technique name, a brief description of how the technique is implemented, and the publicly-available reference.

Data Sources

We often don’t have direct access to endpoint or network log data for technique use in incidents. We’re always looking for partners who would be interested in sharing relevant data from logs that show how adversaries are using ATT&CK techniques beyond what appears in threat reporting.

Your Use Cases

It’s always helpful for us to hear about how you’re using ATT&CK in your organization. We appreciate any information you can share with us about your specific use case or application of ATT&CK, and particularly any success stories you’ve had as a result.

Contribution Examples

New Technique Example
Technique Name:

COM, ROM, & BE GONE

Tactic:

Persistence

Platform:

Windows

Required Permissions:

User

Data Sources: Windows API, Process monitoring, or other sources that can be used to detect this activity

Description: Component Object Model (COM) servers associated with Graphics Interchange Format (GIF) image viewers can be abused to corrupt arbitrary memory banks. Adversaries may leverage this opportunity to modify, mux, and maliciously annoy (MMA) read-only memory (ROM) regularly accessed during normal system operations.

Detection: Monitor the JIF viewers for muxing and malicious annoyance. Use event ID 423420 and 234222 to detect changes.

Mitigation: Configure the Registry key HKLM\SYSTEM\ControlSet\001\Control\WindowsJIFControl\ to 0 to disable MMA access if not needed within the environment.

Adversary Use: Here is a publicly-available reference about FUZZYSNUGGLYDUCK using this technique: (www[.]awesomeThreatReports[.]org/FUZZYSNUGGLYDUCK_NOMS _ON_ROM_VIA_COM). Additionally, our red team uses this in our operations.

Additional References: Here is a reference from the researcher who discovered this technique: (www[.]crazySmartResearcher[.]net/POC_DETECTIONS_&_MITIGATIONS_4_WHEN_COM_RAMS_ROM)

Group & Software Example (Contributions paused until early 2020 due to sub-technique migration)

Group Name: FUZZYSNUGGLYDUCK (www[.]sourceX[.]com)

Associated Groups: APT1337 (www[.]sourceY[.]com)

Description: FUZZYSNUGGLYDUCK is a Great Lakes-based threat group that has been active since at least May 2018. The group focuses on targeting the aviation sector. (www[.]sourceY[.]com)

Techniques:
  • Spearphishing Attachment (T1193) – FUZZYSNUGGLYDUCK has used spearphishing email attachments containing images of stale bread to deliver malware. (www[.]sourceX[.]com)
  • File and Directory Discovery (T1083) – FUZZYSNUGGLYDUCK has searched files and directories for the string *quack*. (www[.]sourceY[.]com)

Software Name: FLYINGV (www[.]sourceX[.]com) (wwwVsourceZ[.]com)

Group Association: FLYINGV has been used by FUZZYSNUGGLYDUCK. (www[.]sourceZ[.]com)

Description: FLYINGV is custom malware used by FUZZYSNUGGLYDUCK as a second-stage RAT. (www[.]sourceZ[.]com)

Platform: Windows

Techniques:
  • Registry Run Keys / Start Folder (T1060) – FLYINGV has added the Registry Run key “HueyDeweyLouie” to establish persistence. (www[.]sourceX[.]com)
  • File and Directory Discovery (T1083) – FLYINGV has used rundll32.exe to load its malicious dll file, estevez.dll. (www[.]sourceX[.]com)

Content Errors on the Website

If you find errors or typos on the site related to content, please let us know by sending an email to attack@mitre.org with the subject Website Content Error.

Please let us know the following:

  1. The url where you found the error.
  2. A short description of the error.

Examples of errors:

  • Typos and syntax errors
  • Improperly formatted web pages
  • 404 errors when links are clicked

Contributors

The following individuals or organizations have contributed information regarding the existence of a technique, details on how to detect and/or mitigate use of a technique, or threat intelligence on adversary use:

  • Alain Homewood, Insomnia Security
  • Alan Neville, @abnev
  • Alex Hinchliffe, Palo Alto Networks
  • Alfredo Abarca
  • Allen DeRyke, ICE
  • Anastasios Pingios
  • Andrew Smith, @jakx_
  • Avneet Singh
  • Barry Shteiman, Exabeam
  • Bart Parys
  • Bartosz Jerzman
  • Brian Prange
  • Bryan Lee
  • Carlos Borges, @huntingneo, CIP
  • Casey Smith
  • Christiaan Beek, @ChristiaanBeek
  • Christoffer Strömblad
  • Cody Thomas, SpecterOps
  • Craig Aitchison
  • CrowdStrike Falcon OverWatch
  • Cybereason Nocturnus, @nocturnus
  • Daniel Oakley
  • Darren Spruell
  • Dave Westgard
  • David Ferguson, CyberSponse
  • David Lu, Tripwire
  • David Routin
  • Deloitte Threat Library Team
  • Drew Church, Splunk
  • Ed Williams, Trustwave, SpiderLabs
  • Edward Millington
  • Elger Vinicius S. Rodrigues, @elgervinicius, CYBINT Centre
  • Elia Florio, Microsoft
  • Elly Searle, CrowdStrike — contributed to tactic definitions
  • Emily Ratliff, IBM
  • ENDGAME
  • Eric Kuehn, Secure Ideas
  • Erika Noerenberg, @gutterchurl, Carbon Black
  • Erye Hernandez, Palo Alto Networks
  • ESET
  • Felipe Espósito, @Pr0teus
  • Filip Kafka, ESET
  • FS-ISAC
  • Hans Christoffer Gaardløs
  • Heather Linn
  • Itamar Mizrahi
  • Itzik Kotler, SafeBreach
  • Ivan Sinyakov
  • Jacob Wilkin, Trustwave, SpiderLabs
  • Jan Miller, CrowdStrike
  • Jannie Li, Microsoft Threat Intelligence Center (MSTIC)
  • Jared Atkinson, @jaredcatkinson
  • Jean-Ian Boutin, ESET
  • Jeff Sakowicz, Microsoft Identity Developer Platform Services (IDPM Services)
  • Jeremy Galloway
  • Jimmy Astle, @AstleJimmy, Carbon Black
  • Johann Rehberger
  • John Lambert, Microsoft Threat Intelligence Center
  • John Strand
  • Josh Abraham
  • Justin Warner, ICEBRG
  • Jörg Abraham, EclecticIQ
  • Kaspersky
  • Lab52 by S2 Grupo
  • Leo Loobeek, @leoloobeek
  • Loic Jaquemet
  • Lucas da Silva Pereira, @vulcanunsec, CIP
  • Lukas Štefanko, ESET
  • Lukáš Štefanko, ESET
  • Marc-Etienne M.Léveillé, ESET
  • Mark Wee
  • Martin Jirkal, ESET
  • Martin Smolar, ESET
  • Matias Nicolas Porolli, ESET
  • Matt Graeber, @mattifestation, SpecterOps
  • Matt Kelly, @breakersall
  • Matthew Demaske, Adaptforward
  • Matthew Molyett, @s1air
  • McAfee
  • Michael Cox
  • Michal Dida, ESET
  • Microsoft Threat Intelligence Center (MSTIC)
  • Mike Kemmerer
  • Milos Stojadinovic
  • Mnemonic
  • Netskope
  • Nick Carr, FireEye
  • Nik Seetharaman, Palantir
  • Nishan Maharjan, @loki248
  • Oddvar Moe, @oddvarmoe
  • Oleg Kolesnikov, Securonix
  • Oleg Skulkin, Group-IB
  • Omkar Gudhate
  • Patrick Campbell, @pjcampbe11
  • Paul Speulstra, AECOM Global Security Operations Center
  • Pedro Harrison
  • Praetorian
  • Prashant Verma, Paladion
  • Rahmat Nurfauzi, @infosecn1nja, PT Xynexis International
  • Red Canary
  • RedHuntLabs (@redhuntlabs)
  • RedHuntLabs, @redhuntlabs
  • Ricardo Dias
  • Richard Gold, Digital Shadows
  • Richie Cyrus, SpecterOps
  • Rob Smith
  • Robby Winchester, @robwinchester3
  • Robert Falcone
  • Romain Dumont, ESET
  • Ryan Becwar
  • Ryan Benson, Exabeam
  • Sahar Shukrun
  • Saisha Agrawal, Microsoft Threat Intelligent Center (MSTIC)
  • Scott Lundgren, @5twenty9, Carbon Black
  • Shailesh Tiwary (Indian Army)
  • Shane Tully, @securitygypsy
  • Stefan Kanthak
  • Sudhanshu Chauhan, @Sudhanshu_C
  • Sunny Neo
  • Swetha Prabakaran, Microsoft Threat Intelligence Center (MSTIC)
  • Sylvain Gil, Exabeam
  • Tatsuya Daitoku, Cyber Defense Institute, Inc.
  • Teodor Cimpoesu
  • Tim MalcomVetter
  • Tom Ueltschi @c_APT_ure
  • Tony Lambert, Red Canary
  • Travis Smith, Tripwire
  • Tristan Bennett, Seamless Intelligence
  • Valerii Marchuk, Cybersecurity Help s.r.o.
  • Veeral Patel
  • Vincent Le Toux
  • Walker Johnson
  • Wayne Silva, Countercept
  • Ye Yint Min Thu Htut, Offensive Security Team, DBS Bank
  • Yonatan Gotlib, Deep Instinct

Thanks to those who have contributed to ATT&CK!