SlideShare una empresa de Scribd logo

Attack eu 2021 attack4cvc

•
•
A
Andrey Bezverkhiy

concept of MITRE ATT&CK for connected cars and vehicles as presented at EU ATT&CK Workshop #8. Initiative to use Sigma rules for VSOC to proactively map out threats for connected cars.

Motor
1 de 22
MITRE ATT&CK and Sigma improvements for Connected Cars MITRE ATT&CK EU Community #8, 2021 ~by Andrii Bezverkhyi, SOC Prime twitter @andriinb
_whoami NotPetya attribution using ATT&CK < 5 days, July 2, 2017 Tagging Sigma w ATT&CK since 2017 -> 2018 uncoder.io and tdm.socprime.com and cti.uncoder.io THANK YOU MITRE, EU ATT&CK & Sigma community & SOC Prime team, for making this possible.
How I got into hacking my own car
The Problem
GPS randomly wakes up Head Unit, which in turn starts draining car battery
Mitigation
Initial reads, if you’re a car hacking noob like me and want to get into car cyber security safety: Hacking Connected Cars: Tactics, Techniques, and Procedures by Alyssa Knight RSAC 2020 “SESSION ID: STR-F03 Mercedes-Benz and 360 Group: Defending a Luxury Fleet with the Community Keen Security Lab blog at https://keenlab.tencent.com/
ATT&CK for Connected Vehicles concept codename ‘attack4cvc’
Let’s make it simple “New” Digital stuff Good Ol’ CAN Bus & new car network Real World Head Unit Telematics Box BLE, WiFi, 4/5G OBD-II, USB Gets diagnostics and issues commands to ECU and any digitalized car parts Lights Engine Doors ABS / ESP / ADAS / LIDAR Roof, Airbags
attack4cvc: impact
attack4cvc: initial access
Tactics: lateral movement Technique: CAN bus Tactics: Persistence: Infotainment System / Head Unit Telematics system (T-Box) Sub-techniques will include firmware, OS, apps, drivers
attack4cvc: linux techniques
attack4cvc: android techniques
Sigma for VSOC, we get to be Proactive Using sigma rules to describe Detections for known Techniques & Tools on connected vehicles based on red team reports and observations Easy translation to VSOC backend platforms like Google Chronicle, Azure Sentinel, ELK stack, Splunk, Humio etc. Exchange the early signals without sharing CTI (sigma is not CTI) Use ATT&CK for Linux + experimental attack4cvc tags How can I help: Sigma training, uncoder, attack4cvc as open-source project, getting Threat Bounty researchers aligned behind it.
One Rule to improve all your Sigma rules Status Stable: the rule is considered as stable and may be used in production systems or dashboards. Test: an almost stable rule that possibly could require some fine tuning. Experimental: an experimental rule that could lead to false results or be noisy, but could also identify interesting events. Severity (Level in Sigma) Critical: Highly relevant event that indicates an incident. Critical events should be reviewed immediately. High: Relevant event that should trigger an internal alert and requires a prompt review. Medium: Relevant event that should be reviewed manually on a more frequent basis. Low: Notable event but rarely an incident. Low rated events can be relevant in high numbers or combination with others. Immediate reaction shouldn't be necessary, but a regular review is recommended.
Do not connect aftermarket Head Unit to CAN bus Use Sigma Level and Status Stay safe Thank you

Recomendados

Elastic user group London nov 2019
Elastic user group London nov 2019Elastic user group London nov 2019
Elastic user group London nov 2019Andrey Bezverkhiy
 
Visibility on the network a tactical cti-based approach
Visibility on the network a tactical cti-based approachVisibility on the network a tactical cti-based approach
Visibility on the network a tactical cti-based approachAlfredo Hickman
 
MITRE ATT&CKcon 2.0: The World's Most Dangerous ATT&CKers; Robert Lipovsky, ESET
MITRE ATT&CKcon 2.0: The World's Most Dangerous ATT&CKers; Robert Lipovsky, ESETMITRE ATT&CKcon 2.0: The World's Most Dangerous ATT&CKers; Robert Lipovsky, ESET
MITRE ATT&CKcon 2.0: The World's Most Dangerous ATT&CKers; Robert Lipovsky, ESETMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: VCAF: Expanding the ATT&CK Framework to cover VERIS Thr...
MITRE ATT&CKcon 2018: VCAF: Expanding the ATT&CK Framework to cover VERIS Thr...MITRE ATT&CKcon 2018: VCAF: Expanding the ATT&CK Framework to cover VERIS Thr...
MITRE ATT&CKcon 2018: VCAF: Expanding the ATT&CK Framework to cover VERIS Thr...MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...MITRE - ATT&CKcon
 
BlueHat v18 || Dep for the app layer - time for app sec to grow up
BlueHat v18 || Dep for the app layer - time for app sec to grow upBlueHat v18 || Dep for the app layer - time for app sec to grow up
BlueHat v18 || Dep for the app layer - time for app sec to grow upBlueHat Security Conference
 
MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,...
MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,...MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,...
MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,...MITRE - ATT&CKcon
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsSergey Soldatov
 

Recomendados

Elastic user group London nov 2019
Elastic user group London nov 2019Elastic user group London nov 2019
Elastic user group London nov 2019Andrey Bezverkhiy
 
Visibility on the network a tactical cti-based approach
Visibility on the network a tactical cti-based approachVisibility on the network a tactical cti-based approach
Visibility on the network a tactical cti-based approachAlfredo Hickman
 
MITRE ATT&CKcon 2.0: The World's Most Dangerous ATT&CKers; Robert Lipovsky, ESET
MITRE ATT&CKcon 2.0: The World's Most Dangerous ATT&CKers; Robert Lipovsky, ESETMITRE ATT&CKcon 2.0: The World's Most Dangerous ATT&CKers; Robert Lipovsky, ESET
MITRE ATT&CKcon 2.0: The World's Most Dangerous ATT&CKers; Robert Lipovsky, ESETMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: VCAF: Expanding the ATT&CK Framework to cover VERIS Thr...
MITRE ATT&CKcon 2018: VCAF: Expanding the ATT&CK Framework to cover VERIS Thr...MITRE ATT&CKcon 2018: VCAF: Expanding the ATT&CK Framework to cover VERIS Thr...
MITRE ATT&CKcon 2018: VCAF: Expanding the ATT&CK Framework to cover VERIS Thr...MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...MITRE - ATT&CKcon
 
BlueHat v18 || Dep for the app layer - time for app sec to grow up
BlueHat v18 || Dep for the app layer - time for app sec to grow upBlueHat v18 || Dep for the app layer - time for app sec to grow up
BlueHat v18 || Dep for the app layer - time for app sec to grow upBlueHat Security Conference
 
MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,...
MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,...MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,...
MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,...MITRE - ATT&CKcon
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsSergey Soldatov
 
What's a MITRE with your Security?
What's a MITRE with your Security?What's a MITRE with your Security?
What's a MITRE with your Security?MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...
MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...
MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: Decision Analysis Applications in Threat Analysis Frame...
MITRE ATT&CKcon 2018: Decision Analysis Applications in Threat Analysis Frame...MITRE ATT&CKcon 2018: Decision Analysis Applications in Threat Analysis Frame...
MITRE ATT&CKcon 2018: Decision Analysis Applications in Threat Analysis Frame...MITRE - ATT&CKcon
 
MITRE ATTACKcon Power Hour - October
MITRE ATTACKcon Power Hour - OctoberMITRE ATTACKcon Power Hour - October
MITRE ATTACKcon Power Hour - OctoberMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...
MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...
MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...MITRE - ATT&CKcon
 
Sharpening your Threat-Hunting Program with ATTACK Framework
Sharpening your Threat-Hunting Program with ATTACK FrameworkSharpening your Threat-Hunting Program with ATTACK Framework
Sharpening your Threat-Hunting Program with ATTACK FrameworkMITRE - ATT&CKcon
 
kyoungju_kwak_the_new_wave_of_cyber_terror
kyoungju_kwak_the_new_wave_of_cyber_terrorkyoungju_kwak_the_new_wave_of_cyber_terror
kyoungju_kwak_the_new_wave_of_cyber_terrorPacSecJP
 
Security precognition chaos engineering in incident response
Security precognition chaos engineering in incident responseSecurity precognition chaos engineering in incident response
Security precognition chaos engineering in incident responsePriyanka Aash
 
Elizabeth Lawler - Devops, security, and compliance working in unison
Elizabeth Lawler - Devops, security, and compliance working in unisonElizabeth Lawler - Devops, security, and compliance working in unison
Elizabeth Lawler - Devops, security, and compliance working in unisonDevSecCon
 
Advanced red teaming all your badges are belong to us
Advanced red teaming all your badges are belong to usAdvanced red teaming all your badges are belong to us
Advanced red teaming all your badges are belong to usPriyanka Aash
 
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE - ATT&CKcon
 
The Rise of the Purple Team
The Rise of the Purple TeamThe Rise of the Purple Team
The Rise of the Purple TeamPriyanka Aash
 
Luncheon 2016-01-21 - Emerging Threats and Strategies for Defense by Paul Fle...
Luncheon 2016-01-21 - Emerging Threats and Strategies for Defense by Paul Fle...Luncheon 2016-01-21 - Emerging Threats and Strategies for Defense by Paul Fle...
Luncheon 2016-01-21 - Emerging Threats and Strategies for Defense by Paul Fle...North Texas Chapter of the ISSA
 
Unraveling Detection Methodologies: Indicators vs. Anomalies vs. Behaviors
Unraveling Detection Methodologies: Indicators vs. Anomalies vs. Behaviors Unraveling Detection Methodologies: Indicators vs. Anomalies vs. Behaviors
Unraveling Detection Methodologies: Indicators vs. Anomalies vs. Behaviors Dragos, Inc.
 
Solnet dev secops meetup
Solnet dev secops meetupSolnet dev secops meetup
Solnet dev secops meetuppbink
 
Agile Network India | DevSecOps - The What and the Why | Ritesh Shregill
Agile Network India | DevSecOps - The What and the Why | Ritesh ShregillAgile Network India | DevSecOps - The What and the Why | Ritesh Shregill
Agile Network India | DevSecOps - The What and the Why | Ritesh ShregillAgileNetwork
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You ArePutting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You AreKatie Nickels
 
Brksec 2048-demystifying aci-security
Brksec 2048-demystifying aci-securityBrksec 2048-demystifying aci-security
Brksec 2048-demystifying aci-securityCisco
 
Predicting exploitability-forecasts-for-vulnerability-management
Predicting exploitability-forecasts-for-vulnerability-managementPredicting exploitability-forecasts-for-vulnerability-management
Predicting exploitability-forecasts-for-vulnerability-managementPriyanka Aash
 
Security Architecture for Cyber Physical Systems
Security Architecture for Cyber Physical SystemsSecurity Architecture for Cyber Physical Systems
Security Architecture for Cyber Physical SystemsAlan Tatourian
 
Highly dependable automotive software
Highly dependable automotive softwareHighly dependable automotive software
Highly dependable automotive softwareAlan Tatourian
 

Más contenido relacionado

La actualidad más candente

What's a MITRE with your Security?
What's a MITRE with your Security?What's a MITRE with your Security?
What's a MITRE with your Security?MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...
MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...
MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: Decision Analysis Applications in Threat Analysis Frame...
MITRE ATT&CKcon 2018: Decision Analysis Applications in Threat Analysis Frame...MITRE ATT&CKcon 2018: Decision Analysis Applications in Threat Analysis Frame...
MITRE ATT&CKcon 2018: Decision Analysis Applications in Threat Analysis Frame...MITRE - ATT&CKcon
 
MITRE ATTACKcon Power Hour - October
MITRE ATTACKcon Power Hour - OctoberMITRE ATTACKcon Power Hour - October
MITRE ATTACKcon Power Hour - OctoberMITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...
MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...
MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...MITRE - ATT&CKcon
 
Sharpening your Threat-Hunting Program with ATTACK Framework
Sharpening your Threat-Hunting Program with ATTACK FrameworkSharpening your Threat-Hunting Program with ATTACK Framework
Sharpening your Threat-Hunting Program with ATTACK FrameworkMITRE - ATT&CKcon
 
kyoungju_kwak_the_new_wave_of_cyber_terror
kyoungju_kwak_the_new_wave_of_cyber_terrorkyoungju_kwak_the_new_wave_of_cyber_terror
kyoungju_kwak_the_new_wave_of_cyber_terrorPacSecJP
 
Security precognition chaos engineering in incident response
Security precognition chaos engineering in incident responseSecurity precognition chaos engineering in incident response
Security precognition chaos engineering in incident responsePriyanka Aash
 
Elizabeth Lawler - Devops, security, and compliance working in unison
Elizabeth Lawler - Devops, security, and compliance working in unisonElizabeth Lawler - Devops, security, and compliance working in unison
Elizabeth Lawler - Devops, security, and compliance working in unisonDevSecCon
 
Advanced red teaming all your badges are belong to us
Advanced red teaming all your badges are belong to usAdvanced red teaming all your badges are belong to us
Advanced red teaming all your badges are belong to usPriyanka Aash
 
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE - ATT&CKcon
 
The Rise of the Purple Team
The Rise of the Purple TeamThe Rise of the Purple Team
The Rise of the Purple TeamPriyanka Aash
 
Luncheon 2016-01-21 - Emerging Threats and Strategies for Defense by Paul Fle...
Luncheon 2016-01-21 - Emerging Threats and Strategies for Defense by Paul Fle...Luncheon 2016-01-21 - Emerging Threats and Strategies for Defense by Paul Fle...
Luncheon 2016-01-21 - Emerging Threats and Strategies for Defense by Paul Fle...North Texas Chapter of the ISSA
 
Unraveling Detection Methodologies: Indicators vs. Anomalies vs. Behaviors
Unraveling Detection Methodologies: Indicators vs. Anomalies vs. Behaviors Unraveling Detection Methodologies: Indicators vs. Anomalies vs. Behaviors
Unraveling Detection Methodologies: Indicators vs. Anomalies vs. Behaviors Dragos, Inc.
 
Solnet dev secops meetup
Solnet dev secops meetupSolnet dev secops meetup
Solnet dev secops meetuppbink
 
Agile Network India | DevSecOps - The What and the Why | Ritesh Shregill
Agile Network India | DevSecOps - The What and the Why | Ritesh ShregillAgile Network India | DevSecOps - The What and the Why | Ritesh Shregill
Agile Network India | DevSecOps - The What and the Why | Ritesh ShregillAgileNetwork
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You ArePutting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You AreKatie Nickels
 
Brksec 2048-demystifying aci-security
Brksec 2048-demystifying aci-securityBrksec 2048-demystifying aci-security
Brksec 2048-demystifying aci-securityCisco
 
Predicting exploitability-forecasts-for-vulnerability-management
Predicting exploitability-forecasts-for-vulnerability-managementPredicting exploitability-forecasts-for-vulnerability-management
Predicting exploitability-forecasts-for-vulnerability-managementPriyanka Aash
 

La actualidad más candente (20)

What's a MITRE with your Security?
What's a MITRE with your Security?What's a MITRE with your Security?
What's a MITRE with your Security?
 
MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...
MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...
MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...
 
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
 
MITRE ATT&CKcon 2018: Decision Analysis Applications in Threat Analysis Frame...
MITRE ATT&CKcon 2018: Decision Analysis Applications in Threat Analysis Frame...MITRE ATT&CKcon 2018: Decision Analysis Applications in Threat Analysis Frame...
MITRE ATT&CKcon 2018: Decision Analysis Applications in Threat Analysis Frame...
 
MITRE ATTACKcon Power Hour - October
MITRE ATTACKcon Power Hour - OctoberMITRE ATTACKcon Power Hour - October
MITRE ATTACKcon Power Hour - October
 
MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...
MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...
MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...
 
Sharpening your Threat-Hunting Program with ATTACK Framework
Sharpening your Threat-Hunting Program with ATTACK FrameworkSharpening your Threat-Hunting Program with ATTACK Framework
Sharpening your Threat-Hunting Program with ATTACK Framework
 
kyoungju_kwak_the_new_wave_of_cyber_terror
kyoungju_kwak_the_new_wave_of_cyber_terrorkyoungju_kwak_the_new_wave_of_cyber_terror
kyoungju_kwak_the_new_wave_of_cyber_terror
 
Security precognition chaos engineering in incident response
Security precognition chaos engineering in incident responseSecurity precognition chaos engineering in incident response
Security precognition chaos engineering in incident response
 
Elizabeth Lawler - Devops, security, and compliance working in unison
Elizabeth Lawler - Devops, security, and compliance working in unisonElizabeth Lawler - Devops, security, and compliance working in unison
Elizabeth Lawler - Devops, security, and compliance working in unison
 
Advanced red teaming all your badges are belong to us
Advanced red teaming all your badges are belong to usAdvanced red teaming all your badges are belong to us
Advanced red teaming all your badges are belong to us
 
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
 
The Rise of the Purple Team
The Rise of the Purple TeamThe Rise of the Purple Team
The Rise of the Purple Team
 
Luncheon 2016-01-21 - Emerging Threats and Strategies for Defense by Paul Fle...
Luncheon 2016-01-21 - Emerging Threats and Strategies for Defense by Paul Fle...Luncheon 2016-01-21 - Emerging Threats and Strategies for Defense by Paul Fle...
Luncheon 2016-01-21 - Emerging Threats and Strategies for Defense by Paul Fle...
 
Unraveling Detection Methodologies: Indicators vs. Anomalies vs. Behaviors
Unraveling Detection Methodologies: Indicators vs. Anomalies vs. Behaviors Unraveling Detection Methodologies: Indicators vs. Anomalies vs. Behaviors
Unraveling Detection Methodologies: Indicators vs. Anomalies vs. Behaviors
 
Solnet dev secops meetup
Solnet dev secops meetupSolnet dev secops meetup
Solnet dev secops meetup
 
Agile Network India | DevSecOps - The What and the Why | Ritesh Shregill
Agile Network India | DevSecOps - The What and the Why | Ritesh ShregillAgile Network India | DevSecOps - The What and the Why | Ritesh Shregill
Agile Network India | DevSecOps - The What and the Why | Ritesh Shregill
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You ArePutting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You Are
 
Brksec 2048-demystifying aci-security
Brksec 2048-demystifying aci-securityBrksec 2048-demystifying aci-security
Brksec 2048-demystifying aci-security
 
Predicting exploitability-forecasts-for-vulnerability-management
Predicting exploitability-forecasts-for-vulnerability-managementPredicting exploitability-forecasts-for-vulnerability-management
Predicting exploitability-forecasts-for-vulnerability-management
 

Similar a Attack eu 2021 attack4cvc

Security Architecture for Cyber Physical Systems
Security Architecture for Cyber Physical SystemsSecurity Architecture for Cyber Physical Systems
Security Architecture for Cyber Physical SystemsAlan Tatourian
 
Highly dependable automotive software
Highly dependable automotive softwareHighly dependable automotive software
Highly dependable automotive softwareAlan Tatourian
 
How to Build a Faster, Laser-Sharp SOC with Intelligent Orchestration
How to Build a Faster, Laser-Sharp SOC with Intelligent OrchestrationHow to Build a Faster, Laser-Sharp SOC with Intelligent Orchestration
How to Build a Faster, Laser-Sharp SOC with Intelligent OrchestrationIBM Security
 
OWASP AppSec Cali 2018 - Enabling Product Security With Culture and Cloud (As...
OWASP AppSec Cali 2018 - Enabling Product Security With Culture and Cloud (As...OWASP AppSec Cali 2018 - Enabling Product Security With Culture and Cloud (As...
OWASP AppSec Cali 2018 - Enabling Product Security With Culture and Cloud (As...Patrick Thomas
 
Using ATT&CK® for Containers to Level Up your Cloud Defenses - Jen Burns, fwd...
Using ATT&CK® for Containers to Level Up your Cloud Defenses - Jen Burns, fwd...Using ATT&CK® for Containers to Level Up your Cloud Defenses - Jen Burns, fwd...
Using ATT&CK® for Containers to Level Up your Cloud Defenses - Jen Burns, fwd...Jennifer Burns
 
SOC, Amore Mio! | Security Webinar
SOC, Amore Mio! | Security WebinarSOC, Amore Mio! | Security Webinar
SOC, Amore Mio! | Security WebinarSplunk
 
Keynote WFIoT2019 - Data Graph, Knowledge Graphs Ontologies, Internet of Thin...
Keynote WFIoT2019 - Data Graph, Knowledge Graphs Ontologies, Internet of Thin...Keynote WFIoT2019 - Data Graph, Knowledge Graphs Ontologies, Internet of Thin...
Keynote WFIoT2019 - Data Graph, Knowledge Graphs Ontologies, Internet of Thin...Amélie Gyrard
 
Mitre ATT&CK by Mattias Almeflo Nixu
Mitre ATT&CK by Mattias Almeflo NixuMitre ATT&CK by Mattias Almeflo Nixu
Mitre ATT&CK by Mattias Almeflo NixuNixu Corporation
 
Advance security in cloud computing for military weapons
Advance security in cloud computing for military weaponsAdvance security in cloud computing for military weapons
Advance security in cloud computing for military weaponsIRJET Journal
 
AWS live hack: Docker + Snyk Container on AWS
AWS live hack: Docker + Snyk Container on AWSAWS live hack: Docker + Snyk Container on AWS
AWS live hack: Docker + Snyk Container on AWSEric Smalling
 
AWS live hack: Atlassian + Snyk OSS on AWS
AWS live hack: Atlassian + Snyk OSS on AWSAWS live hack: Atlassian + Snyk OSS on AWS
AWS live hack: Atlassian + Snyk OSS on AWSEric Smalling
 
85320337 networking-case-study
85320337 networking-case-study85320337 networking-case-study
85320337 networking-case-studyhomeworkping3
 
Microservices: The Future-Proof Framework for IoT
Microservices: The Future-Proof Framework for IoTMicroservices: The Future-Proof Framework for IoT
Microservices: The Future-Proof Framework for IoTCapgemini
 
Highly dependable automotive software
Highly dependable automotive softwareHighly dependable automotive software
Highly dependable automotive softwareAlan Tatourian
 
DevSecOps in 2031: How robots and humans will secure apps together Log
DevSecOps in 2031: How robots and humans will secure apps together LogDevSecOps in 2031: How robots and humans will secure apps together Log
DevSecOps in 2031: How robots and humans will secure apps together LogStefan Streichsbier
 
5 benefits that ai gives to cloud security venkat k - medium
5 benefits that ai gives to cloud security venkat k - medium5 benefits that ai gives to cloud security venkat k - medium
5 benefits that ai gives to cloud security venkat k - mediumusmsystem
 
Seceon 2023 Cybersecurity Predictions by Seceon Thought Leadership - Seceon.pptx
Seceon 2023 Cybersecurity Predictions by Seceon Thought Leadership - Seceon.pptxSeceon 2023 Cybersecurity Predictions by Seceon Thought Leadership - Seceon.pptx
Seceon 2023 Cybersecurity Predictions by Seceon Thought Leadership - Seceon.pptxCompanySeceon
 
Leveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common LanguageLeveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common LanguageErik Van Buggenhout
 
Sécuriser Docker - Utilisation du CIS Docker 1.12 by @guytalbot
Sécuriser Docker - Utilisation du CIS Docker 1.12 by @guytalbotSécuriser Docker - Utilisation du CIS Docker 1.12 by @guytalbot
Sécuriser Docker - Utilisation du CIS Docker 1.12 by @guytalbotJulien Maitrehenry
 
CySA+_CS0-002_May_2023-v1.1.pdf
CySA+_CS0-002_May_2023-v1.1.pdfCySA+_CS0-002_May_2023-v1.1.pdf
CySA+_CS0-002_May_2023-v1.1.pdfCCIEHOMER
 

Similar a Attack eu 2021 attack4cvc (20)

Security Architecture for Cyber Physical Systems
Security Architecture for Cyber Physical SystemsSecurity Architecture for Cyber Physical Systems
Security Architecture for Cyber Physical Systems
 
Highly dependable automotive software
Highly dependable automotive softwareHighly dependable automotive software
Highly dependable automotive software
 
How to Build a Faster, Laser-Sharp SOC with Intelligent Orchestration
How to Build a Faster, Laser-Sharp SOC with Intelligent OrchestrationHow to Build a Faster, Laser-Sharp SOC with Intelligent Orchestration
How to Build a Faster, Laser-Sharp SOC with Intelligent Orchestration
 
OWASP AppSec Cali 2018 - Enabling Product Security With Culture and Cloud (As...
OWASP AppSec Cali 2018 - Enabling Product Security With Culture and Cloud (As...OWASP AppSec Cali 2018 - Enabling Product Security With Culture and Cloud (As...
OWASP AppSec Cali 2018 - Enabling Product Security With Culture and Cloud (As...
 
Using ATT&CK® for Containers to Level Up your Cloud Defenses - Jen Burns, fwd...
Using ATT&CK® for Containers to Level Up your Cloud Defenses - Jen Burns, fwd...Using ATT&CK® for Containers to Level Up your Cloud Defenses - Jen Burns, fwd...
Using ATT&CK® for Containers to Level Up your Cloud Defenses - Jen Burns, fwd...
 
SOC, Amore Mio! | Security Webinar
SOC, Amore Mio! | Security WebinarSOC, Amore Mio! | Security Webinar
SOC, Amore Mio! | Security Webinar
 
Keynote WFIoT2019 - Data Graph, Knowledge Graphs Ontologies, Internet of Thin...
Keynote WFIoT2019 - Data Graph, Knowledge Graphs Ontologies, Internet of Thin...Keynote WFIoT2019 - Data Graph, Knowledge Graphs Ontologies, Internet of Thin...
Keynote WFIoT2019 - Data Graph, Knowledge Graphs Ontologies, Internet of Thin...
 
Mitre ATT&CK by Mattias Almeflo Nixu
Mitre ATT&CK by Mattias Almeflo NixuMitre ATT&CK by Mattias Almeflo Nixu
Mitre ATT&CK by Mattias Almeflo Nixu
 
Advance security in cloud computing for military weapons
Advance security in cloud computing for military weaponsAdvance security in cloud computing for military weapons
Advance security in cloud computing for military weapons
 
AWS live hack: Docker + Snyk Container on AWS
AWS live hack: Docker + Snyk Container on AWSAWS live hack: Docker + Snyk Container on AWS
AWS live hack: Docker + Snyk Container on AWS
 
AWS live hack: Atlassian + Snyk OSS on AWS
AWS live hack: Atlassian + Snyk OSS on AWSAWS live hack: Atlassian + Snyk OSS on AWS
AWS live hack: Atlassian + Snyk OSS on AWS
 
85320337 networking-case-study
85320337 networking-case-study85320337 networking-case-study
85320337 networking-case-study
 
Microservices: The Future-Proof Framework for IoT
Microservices: The Future-Proof Framework for IoTMicroservices: The Future-Proof Framework for IoT
Microservices: The Future-Proof Framework for IoT
 
Highly dependable automotive software
Highly dependable automotive softwareHighly dependable automotive software
Highly dependable automotive software
 
DevSecOps in 2031: How robots and humans will secure apps together Log
DevSecOps in 2031: How robots and humans will secure apps together LogDevSecOps in 2031: How robots and humans will secure apps together Log
DevSecOps in 2031: How robots and humans will secure apps together Log
 
5 benefits that ai gives to cloud security venkat k - medium
5 benefits that ai gives to cloud security venkat k - medium5 benefits that ai gives to cloud security venkat k - medium
5 benefits that ai gives to cloud security venkat k - medium
 
Seceon 2023 Cybersecurity Predictions by Seceon Thought Leadership - Seceon.pptx
Seceon 2023 Cybersecurity Predictions by Seceon Thought Leadership - Seceon.pptxSeceon 2023 Cybersecurity Predictions by Seceon Thought Leadership - Seceon.pptx
Seceon 2023 Cybersecurity Predictions by Seceon Thought Leadership - Seceon.pptx
 
Leveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common LanguageLeveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common Language
 
Sécuriser Docker - Utilisation du CIS Docker 1.12 by @guytalbot
Sécuriser Docker - Utilisation du CIS Docker 1.12 by @guytalbotSécuriser Docker - Utilisation du CIS Docker 1.12 by @guytalbot
Sécuriser Docker - Utilisation du CIS Docker 1.12 by @guytalbot
 
CySA+_CS0-002_May_2023-v1.1.pdf
CySA+_CS0-002_May_2023-v1.1.pdfCySA+_CS0-002_May_2023-v1.1.pdf
CySA+_CS0-002_May_2023-v1.1.pdf
 

Último

VVIP Mumbai Call Girls Mumbai Central Call On 9920725232 With Elite Staff And...
VVIP Mumbai Call Girls Mumbai Central Call On 9920725232 With Elite Staff And...VVIP Mumbai Call Girls Mumbai Central Call On 9920725232 With Elite Staff And...
VVIP Mumbai Call Girls Mumbai Central Call On 9920725232 With Elite Staff And...amitlee9823
 
Is Your Volvo XC90 Displaying Anti-Skid Service Required Alert Here's Why
Is Your Volvo XC90 Displaying Anti-Skid Service Required Alert Here's WhyIs Your Volvo XC90 Displaying Anti-Skid Service Required Alert Here's Why
Is Your Volvo XC90 Displaying Anti-Skid Service Required Alert Here's WhyBavarium Autoworks
 
Just Call Vip call girls Kovalam Escorts ☎️9352988975 Two shot with one girl ...
Just Call Vip call girls Kovalam Escorts ☎️9352988975 Two shot with one girl ...Just Call Vip call girls Kovalam Escorts ☎️9352988975 Two shot with one girl ...
Just Call Vip call girls Kovalam Escorts ☎️9352988975 Two shot with one girl ...gajnagarg
 
FARIDABAD CALL GIRL Anal shot #8168257667 BOOK Shilpa 7999/-
FARIDABAD CALL GIRL Anal shot #8168257667 BOOK Shilpa 7999/-FARIDABAD CALL GIRL Anal shot #8168257667 BOOK Shilpa 7999/-
FARIDABAD CALL GIRL Anal shot #8168257667 BOOK Shilpa 7999/-Hyderabad Escorts Agency
 
FULL NIGHT — 9999894380 Call Girls In Jagat Puri | Delhi
FULL NIGHT — 9999894380 Call Girls In Jagat Puri | DelhiFULL NIGHT — 9999894380 Call Girls In Jagat Puri | Delhi
FULL NIGHT — 9999894380 Call Girls In Jagat Puri | DelhiSaketCallGirlsCallUs
 
Just Call Vip call girls Amroha Escorts ☎️9352988975 Two shot with one girl (...
Just Call Vip call girls Amroha Escorts ☎️9352988975 Two shot with one girl (...Just Call Vip call girls Amroha Escorts ☎️9352988975 Two shot with one girl (...
Just Call Vip call girls Amroha Escorts ☎️9352988975 Two shot with one girl (...gajnagarg
 
+97470301568>>buy vape oil,thc oil weed,hash and cannabis oil in qatar doha}}
+97470301568>>buy vape oil,thc oil weed,hash and cannabis oil in qatar doha}}+97470301568>>buy vape oil,thc oil weed,hash and cannabis oil in qatar doha}}
+97470301568>>buy vape oil,thc oil weed,hash and cannabis oil in qatar doha}}Health
 
Top Rated Call Girls Vashi : 9920725232 We offer Beautiful and sexy Call Girl...
Top Rated Call Girls Vashi : 9920725232 We offer Beautiful and sexy Call Girl...Top Rated Call Girls Vashi : 9920725232 We offer Beautiful and sexy Call Girl...
Top Rated Call Girls Vashi : 9920725232 We offer Beautiful and sexy Call Girl...amitlee9823
 
Why Does My Porsche Cayenne's Exhaust Sound So Loud
Why Does My Porsche Cayenne's Exhaust Sound So LoudWhy Does My Porsche Cayenne's Exhaust Sound So Loud
Why Does My Porsche Cayenne's Exhaust Sound So LoudRoyalty Auto Service
 
Vip Mumbai Call Girls Mumbai Call On 9920725232 With Body to body massage wit...
Vip Mumbai Call Girls Mumbai Call On 9920725232 With Body to body massage wit...Vip Mumbai Call Girls Mumbai Call On 9920725232 With Body to body massage wit...
Vip Mumbai Call Girls Mumbai Call On 9920725232 With Body to body massage wit...amitlee9823
 
Marathi Call Girls Santacruz WhatsApp +91-9930687706, Best Service
Marathi Call Girls Santacruz WhatsApp +91-9930687706, Best ServiceMarathi Call Girls Santacruz WhatsApp +91-9930687706, Best Service
Marathi Call Girls Santacruz WhatsApp +91-9930687706, Best Servicemeghakumariji156
 
➥🔝 7737669865 🔝▻ Moradabad Call-girls in Women Seeking Men 🔝Moradabad🔝 Esc...
➥🔝 7737669865 🔝▻ Moradabad Call-girls in Women Seeking Men 🔝Moradabad🔝 Esc...➥🔝 7737669865 🔝▻ Moradabad Call-girls in Women Seeking Men 🔝Moradabad🔝 Esc...
➥🔝 7737669865 🔝▻ Moradabad Call-girls in Women Seeking Men 🔝Moradabad🔝 Esc...amitlee9823
 
Sanjay Nagar Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalor...
Sanjay Nagar Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalor...Sanjay Nagar Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalor...
Sanjay Nagar Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalor...amitlee9823
 
Call Girls Kadugodi Just Call 👗 7737669865 👗 Top Class Call Girl Service Bang...
Call Girls Kadugodi Just Call 👗 7737669865 👗 Top Class Call Girl Service Bang...Call Girls Kadugodi Just Call 👗 7737669865 👗 Top Class Call Girl Service Bang...
Call Girls Kadugodi Just Call 👗 7737669865 👗 Top Class Call Girl Service Bang...amitlee9823
 
Rekha Agarkar Escorts Service Kollam ❣️ 7014168258 ❣️ High Cost Unlimited Har...
Rekha Agarkar Escorts Service Kollam ❣️ 7014168258 ❣️ High Cost Unlimited Har...Rekha Agarkar Escorts Service Kollam ❣️ 7014168258 ❣️ High Cost Unlimited Har...
Rekha Agarkar Escorts Service Kollam ❣️ 7014168258 ❣️ High Cost Unlimited Har...nirzagarg
 
➥🔝 7737669865 🔝▻ narsinghpur Call-girls in Women Seeking Men 🔝narsinghpur🔝 ...
➥🔝 7737669865 🔝▻ narsinghpur Call-girls in Women Seeking Men 🔝narsinghpur🔝 ...➥🔝 7737669865 🔝▻ narsinghpur Call-girls in Women Seeking Men 🔝narsinghpur🔝 ...
➥🔝 7737669865 🔝▻ narsinghpur Call-girls in Women Seeking Men 🔝narsinghpur🔝 ...nirzagarg
 
West Bengal Factories Rules, 1958.bfpptx
West Bengal Factories Rules, 1958.bfpptxWest Bengal Factories Rules, 1958.bfpptx
West Bengal Factories Rules, 1958.bfpptxPankajBhagat45
 
如何办理(NCL毕业证书）纽卡斯尔大学毕业证毕业证成绩单原版一比一
如何办理(NCL毕业证书）纽卡斯尔大学毕业证毕业证成绩单原版一比一如何办理(NCL毕业证书）纽卡斯尔大学毕业证毕业证成绩单原版一比一
如何办理(NCL毕业证书）纽卡斯尔大学毕业证毕业证成绩单原版一比一avy6anjnd
 

Último (20)

VVIP Mumbai Call Girls Mumbai Central Call On 9920725232 With Elite Staff And...
VVIP Mumbai Call Girls Mumbai Central Call On 9920725232 With Elite Staff And...VVIP Mumbai Call Girls Mumbai Central Call On 9920725232 With Elite Staff And...
VVIP Mumbai Call Girls Mumbai Central Call On 9920725232 With Elite Staff And...
 
Is Your Volvo XC90 Displaying Anti-Skid Service Required Alert Here's Why
Is Your Volvo XC90 Displaying Anti-Skid Service Required Alert Here's WhyIs Your Volvo XC90 Displaying Anti-Skid Service Required Alert Here's Why
Is Your Volvo XC90 Displaying Anti-Skid Service Required Alert Here's Why
 
Just Call Vip call girls Kovalam Escorts ☎️9352988975 Two shot with one girl ...
Just Call Vip call girls Kovalam Escorts ☎️9352988975 Two shot with one girl ...Just Call Vip call girls Kovalam Escorts ☎️9352988975 Two shot with one girl ...
Just Call Vip call girls Kovalam Escorts ☎️9352988975 Two shot with one girl ...
 
FARIDABAD CALL GIRL Anal shot #8168257667 BOOK Shilpa 7999/-
FARIDABAD CALL GIRL Anal shot #8168257667 BOOK Shilpa 7999/-FARIDABAD CALL GIRL Anal shot #8168257667 BOOK Shilpa 7999/-
FARIDABAD CALL GIRL Anal shot #8168257667 BOOK Shilpa 7999/-
 
FULL NIGHT — 9999894380 Call Girls In Jagat Puri | Delhi
FULL NIGHT — 9999894380 Call Girls In Jagat Puri | DelhiFULL NIGHT — 9999894380 Call Girls In Jagat Puri | Delhi
FULL NIGHT — 9999894380 Call Girls In Jagat Puri | Delhi
 
Just Call Vip call girls Amroha Escorts ☎️9352988975 Two shot with one girl (...
Just Call Vip call girls Amroha Escorts ☎️9352988975 Two shot with one girl (...Just Call Vip call girls Amroha Escorts ☎️9352988975 Two shot with one girl (...
Just Call Vip call girls Amroha Escorts ☎️9352988975 Two shot with one girl (...
 
+97470301568>>buy vape oil,thc oil weed,hash and cannabis oil in qatar doha}}
+97470301568>>buy vape oil,thc oil weed,hash and cannabis oil in qatar doha}}+97470301568>>buy vape oil,thc oil weed,hash and cannabis oil in qatar doha}}
+97470301568>>buy vape oil,thc oil weed,hash and cannabis oil in qatar doha}}
 
Top Rated Call Girls Vashi : 9920725232 We offer Beautiful and sexy Call Girl...
Top Rated Call Girls Vashi : 9920725232 We offer Beautiful and sexy Call Girl...Top Rated Call Girls Vashi : 9920725232 We offer Beautiful and sexy Call Girl...
Top Rated Call Girls Vashi : 9920725232 We offer Beautiful and sexy Call Girl...
 
Why Does My Porsche Cayenne's Exhaust Sound So Loud
Why Does My Porsche Cayenne's Exhaust Sound So LoudWhy Does My Porsche Cayenne's Exhaust Sound So Loud
Why Does My Porsche Cayenne's Exhaust Sound So Loud
 
Vip Mumbai Call Girls Mumbai Call On 9920725232 With Body to body massage wit...
Vip Mumbai Call Girls Mumbai Call On 9920725232 With Body to body massage wit...Vip Mumbai Call Girls Mumbai Call On 9920725232 With Body to body massage wit...
Vip Mumbai Call Girls Mumbai Call On 9920725232 With Body to body massage wit...
 
Marathi Call Girls Santacruz WhatsApp +91-9930687706, Best Service
Marathi Call Girls Santacruz WhatsApp +91-9930687706, Best ServiceMarathi Call Girls Santacruz WhatsApp +91-9930687706, Best Service
Marathi Call Girls Santacruz WhatsApp +91-9930687706, Best Service
 
➥🔝 7737669865 🔝▻ Moradabad Call-girls in Women Seeking Men 🔝Moradabad🔝 Esc...
➥🔝 7737669865 🔝▻ Moradabad Call-girls in Women Seeking Men 🔝Moradabad🔝 Esc...➥🔝 7737669865 🔝▻ Moradabad Call-girls in Women Seeking Men 🔝Moradabad🔝 Esc...
➥🔝 7737669865 🔝▻ Moradabad Call-girls in Women Seeking Men 🔝Moradabad🔝 Esc...
 
Sanjay Nagar Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalor...
Sanjay Nagar Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalor...Sanjay Nagar Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalor...
Sanjay Nagar Call Girls: 🍓 7737669865 🍓 High Profile Model Escorts | Bangalor...
 
Call Girls Kadugodi Just Call 👗 7737669865 👗 Top Class Call Girl Service Bang...
Call Girls Kadugodi Just Call 👗 7737669865 👗 Top Class Call Girl Service Bang...Call Girls Kadugodi Just Call 👗 7737669865 👗 Top Class Call Girl Service Bang...
Call Girls Kadugodi Just Call 👗 7737669865 👗 Top Class Call Girl Service Bang...
 
Rekha Agarkar Escorts Service Kollam ❣️ 7014168258 ❣️ High Cost Unlimited Har...
Rekha Agarkar Escorts Service Kollam ❣️ 7014168258 ❣️ High Cost Unlimited Har...Rekha Agarkar Escorts Service Kollam ❣️ 7014168258 ❣️ High Cost Unlimited Har...
Rekha Agarkar Escorts Service Kollam ❣️ 7014168258 ❣️ High Cost Unlimited Har...
 
Call Girls in Patel Nagar, Delhi 💯 Call Us 🔝9953056974 🔝 Escort Service
Call Girls in Patel Nagar, Delhi 💯 Call Us 🔝9953056974 🔝 Escort ServiceCall Girls in Patel Nagar, Delhi 💯 Call Us 🔝9953056974 🔝 Escort Service
Call Girls in Patel Nagar, Delhi 💯 Call Us 🔝9953056974 🔝 Escort Service
 
(ISHITA) Call Girls Service Jammu Call Now 8617697112 Jammu Escorts 24x7
(ISHITA) Call Girls Service Jammu Call Now 8617697112 Jammu Escorts 24x7(ISHITA) Call Girls Service Jammu Call Now 8617697112 Jammu Escorts 24x7
(ISHITA) Call Girls Service Jammu Call Now 8617697112 Jammu Escorts 24x7
 
➥🔝 7737669865 🔝▻ narsinghpur Call-girls in Women Seeking Men 🔝narsinghpur🔝 ...
➥🔝 7737669865 🔝▻ narsinghpur Call-girls in Women Seeking Men 🔝narsinghpur🔝 ...➥🔝 7737669865 🔝▻ narsinghpur Call-girls in Women Seeking Men 🔝narsinghpur🔝 ...
➥🔝 7737669865 🔝▻ narsinghpur Call-girls in Women Seeking Men 🔝narsinghpur🔝 ...
 
West Bengal Factories Rules, 1958.bfpptx
West Bengal Factories Rules, 1958.bfpptxWest Bengal Factories Rules, 1958.bfpptx
West Bengal Factories Rules, 1958.bfpptx
 
如何办理(NCL毕业证书）纽卡斯尔大学毕业证毕业证成绩单原版一比一
如何办理(NCL毕业证书）纽卡斯尔大学毕业证毕业证成绩单原版一比一如何办理(NCL毕业证书）纽卡斯尔大学毕业证毕业证成绩单原版一比一
如何办理(NCL毕业证书）纽卡斯尔大学毕业证毕业证成绩单原版一比一
 

Attack eu 2021 attack4cvc

  • 1. MITRE ATT&CK and Sigma improvements for Connected Cars MITRE ATT&CK EU Community #8, 2021 ~by Andrii Bezverkhyi, SOC Prime twitter @andriinb
  • 2. _whoami NotPetya attribution using ATT&CK < 5 days, July 2, 2017 Tagging Sigma w ATT&CK since 2017 -> 2018 uncoder.io and tdm.socprime.com and cti.uncoder.io THANK YOU MITRE, EU ATT&CK & Sigma community & SOC Prime team, for making this possible.
  • 3. How I got into hacking my own car
  • 4.
  • 5.
  • 7.
  • 8. GPS randomly wakes up Head Unit, which in turn starts draining car battery
  • 10.
  • 11. Initial reads, if you’re a car hacking noob like me and want to get into car cyber security safety: Hacking Connected Cars: Tactics, Techniques, and Procedures by Alyssa Knight RSAC 2020 “SESSION ID: STR-F03 Mercedes-Benz and 360 Group: Defending a Luxury Fleet with the Community Keen Security Lab blog at https://keenlab.tencent.com/
  • 12. ATT&CK for Connected Vehicles concept codename ‘attack4cvc’
  • 13.
  • 14. Let’s make it simple “New” Digital stuff Good Ol’ CAN Bus & new car network Real World Head Unit Telematics Box BLE, WiFi, 4/5G OBD-II, USB Gets diagnostics and issues commands to ECU and any digitalized car parts Lights Engine Doors ABS / ESP / ADAS / LIDAR Roof, Airbags
  • 17. Tactics: lateral movement Technique: CAN bus Tactics: Persistence: Infotainment System / Head Unit Telematics system (T-Box) Sub-techniques will include firmware, OS, apps, drivers
  • 20. Sigma for VSOC, we get to be Proactive Using sigma rules to describe Detections for known Techniques & Tools on connected vehicles based on red team reports and observations Easy translation to VSOC backend platforms like Google Chronicle, Azure Sentinel, ELK stack, Splunk, Humio etc. Exchange the early signals without sharing CTI (sigma is not CTI) Use ATT&CK for Linux + experimental attack4cvc tags How can I help: Sigma training, uncoder, attack4cvc as open-source project, getting Threat Bounty researchers aligned behind it.
  • 21. One Rule to improve all your Sigma rules Status Stable: the rule is considered as stable and may be used in production systems or dashboards. Test: an almost stable rule that possibly could require some fine tuning. Experimental: an experimental rule that could lead to false results or be noisy, but could also identify interesting events. Severity (Level in Sigma) Critical: Highly relevant event that indicates an incident. Critical events should be reviewed immediately. High: Relevant event that should trigger an internal alert and requires a prompt review. Medium: Relevant event that should be reviewed manually on a more frequent basis. Low: Notable event but rarely an incident. Low rated events can be relevant in high numbers or combination with others. Immediate reaction shouldn't be necessary, but a regular review is recommended.
  • 22. Do not connect aftermarket Head Unit to CAN bus Use Sigma Level and Status Stay safe Thank you