Apply MITRE’s ‘ATT&CK’ Model to Check Your Defenses

ARCHIVED STORY Apply MITRE’s ‘ATT&CK’ Model to Check Your Defenses By Trellix · June 18, 2018 Every week we read about adversaries attacking their targets as part of online criminal campaigns. Information gathering, strategic advantage, and theft of intellectual property are some of the...

Attackintel - Tool To Query The MITRE ATT&CK API For Tactics, Techniques, Mitigations, & Detection Methods For Specific Threat Groups

A simple python script to query the MITRE ATT&CK API for tactics, techniques, mitigations, & detection methods for specific threat groups. Goals Quickly align updated tactics, techniques, mitigation, and detection information from MITRE ATT&CK API for a specific threat Brush up on my python skill...

Invoke-ATTACKAPI - A PowerShell Script To Interact With The MITRE ATT& CK Framework Via Its Own API

A PowerShell script to interact with the MITRE ATT&CK Framework via its own API in order to gather information about techniques, tactics, groups, software and references provided by the MITRE ATT&CK Team @MITREattack. Goals Provide an easy way to interact with the MITRE ATT&CK Framework via its o...

RTA - Framework Designed To Test The Detection Capabilities Against Malicious Tradecraft

RTA provides a framework of scripts designed to allow blue teams to test their detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK. RTA is composed of python scripts that generate evidence of over 50 different ATT&CK tactics, as well as a compiled binary application th...

Metta - An Information Security Preparedness Tool To Do Adversarial Simulation

Metta is an information security preparedness tool. This project uses Redis/Celery, python, and vagrant with virtualbox to do adversarial simulation. This allows you to test mostly your host based instrumentation but may also allow you to test any network based detection and controls depending on...

List of Adversary Emulation Tools

PenTestIT RSS Feed Every once in a while, the security industry brings forth a new buzz word and introduces terminologies that sound über cool and generate lot's of interest. One such word going around now-a-days is automated "adversary emulation". Let's first understand what this really means...

UBUNTU-CVE-2018-8741

A directory traversal flaw in SquirrelMail 1.4.22 allows an authenticated attacker to exfiltrate or potentially delete files from the hosting server, related to ../ in the attlocalname field in Deliver.class.php...

CVE-2017-15192

In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by considering a case where not all of the BTATT packets have the same encapsulation level...

Partner Perspectives: Red Canary ATT&CKs (Part 1): Why We’re Using ATT&CK Across Red Canary

Editor's Note: This blog originally appeared on RedCanary.com Information security is grounded in risk management. And, because what gets measured gets managed, we rely on a variety of frameworks and key performance indicators to tell us whether we’re moving in the right direction. Frameworks lik...

CALDERA - Automated Adversary Emulation System

CALDERA is an automated adversary emulation system that performs post-compromise adversarial behavior within enterprise networks. It generates plans during operation using a planning system and a pre-configured adversary model based on the Adversarial Tactics, Techniques & Common Knowledge ATT&CK...

Automated Adversary Emulation System: CALDERA

CALDERA is an automated adversary emulation system that performs post-compromise adversarial behavior within enterprise networks. It generates plans during operation using a planning system and a pre-configured adversary model based on the Adversarial Tactics, Techniques & Common Knowledge ATT&CK...

SUSE SLED12 / SLES12 Security Update : wireshark (SUSE-SU-2017:2860-1)

This update for wireshark fixes the following issues: Wireshark was updated to 2.2.10, fixing security issues and bugs : - CVE-2017-15191: DMP dissector crash wnpa-sec-2017-44 - CVE-2017-15192: BT ATT dissector crash wnpa-sec-2017-42 - CVE-2017-15193: MBIM dissector crash wnpa-sec-2017-43 Note th...

openSUSE Security Update : wireshark (openSUSE-2017-1158)

This update for wireshark to version 2.2.10 fixes multiple minor security issues. These vulnerabilities that could be used to trigger dissector crashes or infinite loops by making Wireshark read specially crafted packages from the network or a capture file : - CVE-2017-15192: BT ATT dissector cra...

Wireshark 2.2.x < 2.2.10 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 2.2.10. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-2.2.10 advisory. - In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the MBIM dissector could crash or exhaust system...

MGASA-2017-0374 Updated wireshark packages fix security vulnerability

DMP dissector crash CVE-2017-15191. BT ATT dissector crash CVE-2017-15192. MBIM dissector crash CVE-2017-15193...

Updated wireshark packages fix security vulnerability

DMP dissector crash CVE-2017-15191. BT ATT dissector crash CVE-2017-15192. MBIM dissector crash CVE-2017-15193...

Security fix for the ALT Linux 9 package wireshark version 2.4.2-alt1

Oct. 15, 2017 Anton Farygin 2.4.2-alt1 - 2.4.2 - fixes: wnpa-sec-2017-42 BT ATT dissector crash CVE-2017-15192 wnpa-sec-2017-43 MBIM dissector crash CVE-2017-15193 wnpa-sec-2017-44 DMP dissector crash CVE-2017-15191 wnpa-sec-2017-45 RTSP dissector crash CVE-2017-15190 wnpa-sec-2017-46 DOCSIS...

CVE-2017-15192

In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by considering a case where not all of the BTATT packets have the same encapsulation level...

Code injection

In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by considering a case where not all of the BTATT packets have the same encapsulation level...

CVE-2017-15192

In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by considering a case where not all of the BTATT packets have the same encapsulation level...