Lecture 09

[Music] so for the next three class I'll be taking the class and we'll be discussing attack Navigator and how we can extract TTP tactics techniques procedure from the raw data and along with that how we can store and analyze those extracted ttps and how it is being done in the real world we'll be seeing in the next three class along with that we'll be also seeing the how analyst can make a defensive recommendation to the organization for which they are performing an extracting threat Intel data so in this class as some a few of the slides has already covered so I'll be going quickly with those slides to make a revision that how we can extract attack ttps from raw data so so far we were working with Intel where with the activities were already listed in the threat reports finished threat reports which we did in the last class so how those ttps were being made by the like the threat reports must be written by someone like some engineer or some analyst who must have extracted this ttps from the raw data like the windows events logs and the commands and other things as evidence we extract from the attacked infrastructure so rather than extrating ttps from the a finished already written and already extracted ttps we'll be looking into how investigator and how an analyst see the raw data in terms of log files or commands and how they process that information and map that information to the TTP in the attack Navigator so this data mostly come from the various data sources which is present in the victim infrastructure and the analyzing those behaviors and mapping to the ttps May likely to be focused more towards processor level like the logs the place in the logs where something is happening uh related to the malicious or the malys behavior or if there is something uh in the commands it is performing some action which something like collecting the datas or sending data to somewhere else or communicating on some another IP so such kind of behaviors and the procedures we first analist extract what all such kind of mini processes available in the source data and then we Pro access the information also whatever we doing from the Finish report that were already processed and analyzed by analyst and presented in front of us but uh here in that case this TTP is kind of biased like the people who is interpreting the data based on their understanding their expertise sometimes it add on the Biers in such case we are supposed to do this analysis all together with multiple uh cyber threat analyst so till now we were not doing not interpreting the datas from the multiple uh perspective rather than there was a report was all perspective clubbed all together as a conclusion and we were expecting data so in raw data there is a need to collaborate between the analyst in which they will be uh extracting TTP based on their perspection perspective and the expertise and then they'll collaborate and they'll discuss and then they can finalize to some set of ttps which they have observed commonly observed also to do these things there is a great knowledge required with respect to how we interpret the tactics the intent so one command may represent uh encryption or the sending data to some another C2 server so that can be interpreted with the if there is some a people who is from the uh other not exactly the network security guy and there is a packet capture and there is a packet Behavior where where people are analysts are supposed to exct the ttps from the packet capture so a malware guy on network guy or a cyber R guy they may have a different way to look into it and there's a high chance that if there is a less expertise then they can miss some of the key information which network guy can do uh can get the details so all these things we need to take care of while doing while mapping ttps from raw to uh threat Intel so there is uh to see where to look into the data there is a broad set of possible data which can contain the behavior some of the examples are cell commands malw and the forensic dis images which analyst usually investigate and the network prods so as we discuss in the last class the steps to map the ttps from any data either it's a threat report or raw data there are some six set of steps uh first step is understanding the attack which we already did all the steps we followed for the threat report uh and now we'll follow the same way uh to extract TPS from raw data so we'll look for the behavior in the Raw data where the Behavior lies and then we can research about the behavior because the analy may have may not have the all broad information so one can do research on it and then once we understand what exactly that Behavior Uh contain present in that behavior do and then we can translate that behavior into the tactics like which tactic is mapped to and then uh once we finalize the tactic within that tactics which techniques it is being applied in that behavior and Then followed by we can compare result with our other colleagues or other analyst so this set of commands sir has discussed in the last class so it starts with ip config all First Command where one may trying to see the I Network details like IP and all then the next command is St command which is used to create and operate with the services window Services then there is a unknown very uh uh unknown command which you are not may not be much familiar with what exactly this recycle since recycle to that vsdx this long command this one so this this is by just seeing this there is a very less sense we are getting what exactly it might be doing so we'll be investigating these commands to see how and what is being done while running this command so these commands were captured uh from this s small so uh this information we'll be using to map to the ttps followed by that there is a behavior captured while performing Mal analysis from the sandbox like this is uh kind of Ip communicating to some uh different IP and the communication is being written from the same uh on the another side and following to that there is a new registry key introduction in the Run registry and net such which will be seeing how we can leverage this set of raw data to the TTP so this is just for the demonstration that the IP config all it lists the details about the windows uh the IP configuration and the ethernet details so one can see the details to the IP subnet mask and other details related to the network so this is the uh help Bas for the SC SC command uh which is used to create the service or you can see there are different syntax example where one can enumerate display and the other activities uh one can perform with the services Windows services so after seeing that uh this SC exe ion uh this PC create so this is bying seeing by seeing this we can understand that there is some Services being created with this name so on This Server so you can see uh example of this so this is kind of uh not a Correct server address so it defaulted as a as error but it says that it is used to create the service in the registry or service database so one can do such type of research on the Run command and one can understand that what exactly this uh extracted behavior is doing so this researching the behavior we were doing same in the threat while mapping to the threat report to the TTP we were doing the same like we were once we understand where that any uh any process once we understand any sentence or any paragraph or something is being done is being represented then we were researching about that if you're not aware of so it is bit similar uh to the previously we did and then uh one may require to understand the terminology and understand and to help you in researching the behavior one may require expertise in the specific kind of data data types which can be network analysis or forensic or malware and other like CMD line tools also one one may need to Club all datas collected from the data sources and to get the more context like uh what exactly how data collected from the multiple sources are correlated so that you can you can understand the flow and understand the how attack was flowed during the attack so to research the behavior once you have ip config all one may go directly to the uh this MIT miter web page and there is a search bar where one can search and see the things but sometimes the things cannot be such a straightforward so for for the First Command this is a too easy one can go search and there is a technique named as system network configuration Discovery and this all these techniques has a unique ID so you can see for this technique there is a t1016 so for some of the uh you can say uh for some of the commands or some of the raw data you can get straightforward results of mapping to the technique and you can map the technique and go ahead but for few of the raw data one need to do research and understand break the whole information collected in the piece wise to understand what exactly it is so this is more likely the the third command which we saw that recycler one so after seeing this the whole command we can only see that there is something is being there is a two input and output output is being given to this commander. exe but what exactly it is doing we have no idea right now at least so we can we we have to make some of the educated guess but it's still we are not getting much context of the behavior so we can run this recycle. exe in the sandbox environment to see what exactly it does if you run this recycle. exe this is just assumption case so if you run we can see uh we are seeing that this some output like this which is which is representing that this is something related to the rare okay like com compression so we can guess an idea that there is something compressing or some off or encryption is being done which is not clear yet but once we have we can see here there is one more uh switch uh there is a flag and the a which might be representing as argument for this recycler and then this flag might be might be uh representing what exactly we're supposed to do and this can be uh this can be output this can be input this is mostly a general Behavior we give a command so after seeing this this HP in a flag it it it represents the completion or encryption Behavior so one can guess that this recycl been recycl been old uh this is the uh destination path where this file this vdk file is being encrypted or compressed and being placed here so which is we are not sure but we are just we just guessed it but when we go forward what is this vs decare look we resolve this this this we guess this is the destination and the source uh source and destination path but what exactly this vsdx so one can one can do research on this vsdx on the internet and we got to know that this vs DX is used uh uh to it's a viso diagram which is being used as a input in this command so there is a kind of more contextual guess now that this there is some Visio diagram file which is being complexed or being encrypted and probably when it is being done like why attacker will encrypt or compress the file on the victim system this is kind of used out so this is mostly done while the data so that data size can and cannot get can get evaded in the network phase while communicating to the CNC server so there is now we have a little bit more educated guest that this is this is a kind of stage where your attacker collects the data and do encryption or compress it to send it to the CNC server so now we'll club together whatever uh we analyzed for the all three commands which we saw so IP IP config all this this is this is be mapped directly to the system network configuration Discovery so the tactics which is being used here is Discovery and technique is this also we noticed that this command all three commands were extracted from the Sison so this cismon is also represents the execution Behavior like these commands are being executed in the victim machine so there is two tactics which we discovered from this command Discovery and the execution further this recycl command After figuring out this DK is being in compressed using this recycler we can we can connect it with the exfiltration phase which is uh which is a kind of a strong evidence that exploitation is might be being done and also uh the cison as we extracted from the ismon events so this is this is related to the execution tactic okay so the fourth stage is now figure out what techniques applies we for some of them we already saw that so this is also similar to the like threat reports mapping we have to go to the attack database knowledge base and once we understand the tactics or the behavior we have to look into the techniques which techniques it has been used which is kind of Str forward again for the IP config all plus this all this commands is being run on the command line so there is one more technique named as command line interface if things is being run on the command line using the command line so this is a technique represents to that behavior so this technique and this techniques finally got mapped to this and this command line interface comes under the execution tactic further the next this recycler command uh as we figure out that this this SP and command a is representing to send the argument and the uh denoted as to perform the compression or encryption uh this is appearing to be a data compressed pH this is a technique is present in the collection uh tactic and or it can be data inced which is not cleared yet and uh further this is again aligned with the command line interface t159 okay so now we understand that there is we extracted some of the techniques for for the first few of the commands which we saw now we have to see this techniques now how this techniques is being uh like happening to understand that we have to uh thech Technics can occur concurrently so it's like we saw that execution and the like if ip config all so execution and discoveries have similarly the comparation if they are performing two techniques together something like you can see one can receive the spear fizzing attachment once once user executed that or click double click or open that so that will comes under the two uh tactics initial access and execution and there will be two techniques spear phing attachment and the user execution so the two Tech techniques can occur all together so once we understand the to look look into the other aspect of the behavior whether we can extract multiple techniques from the single Behavior or not so there can be a chances that two multiple techniques can exist in a single Behavior similarly uh data from local system can be uh collected and the email can be collected all together which comes into the collection phase and uh as we saw in the no we didn't saw but process Discovery and command line interface both both of these can occur all together with the two different tactics Discovery and the execution okay so now in the MIT attack uh knowledge base we have total approximately if I remember correctly 190 plus techniques divided over all over the tactics which you saw but all techniques and what all ttps are not equally um not uh they don't have equal V is in any attack phases so there are some of the techniques like the command line interface which saw that is mostly being used by all adversaries so that is being mostly used ttps out of out of all ttps we have also the ttps can be directly as a straightforward like there are some TTP if run DL is being used to execute any DL file so they are directly mapping to technical run dll there's also net such if any D is uh deal is trying to trying to do something within network uh details then this net SS helper D being executed so this two uh is the example of straight forward mapping if you seeing anywhere run DL in the your behavior that can be directly mapped to the technique run DL and the similar goes for the netsh uh DL but some techniques can have a broader uh aspect like scripting scripting can be in the scripting uh technique one can do anything like one can use power one can use other scripting like python or to develop the executable or payload so scripting kind of a broad where which is which is again breaked into the sub techniques which we which we'll saw in which we'll see in the knowledge based detail probably in the tomorrow's class or today's class so is uh name offed file for or information so what it is representing is file or information is being offer sketched but how and what is being done exactly is not clear so this techniques like one can do compression one can do encrypt one can hide that in some another in some hidden folder or as a hidden item in the window machine so this is still uh it is not cleared not exactly specific detail how ofation is being done so there are some techniques which are having a specific detail and some are very broad also there are some techniques which help us to understand how this Behavior occurs so one can masquerade the uh one mostly malicious files mascate themselves as a Bening or legitimate process name so mostly SBC host in the window so one can one can masquerade themsel and this is showing how attackers is masquerading like behaving the behavior comes there is nothing like any procedure is being happen being happening there than it is just a masting them with the their name so we need to see also how any beh there is some techniques which represents that not exactly something is being done rather than how it is being done so this data trans transfer size limit and the automated collection all these things comes into this uh category now as we uh discussed this earlier that the the way to look into the data set and translate it research it and map it to the TTP can have different uh results for the different analyst having different different perspective different expert so one a threat analyst needs to get collaborated with each each other and do collaboration to understand others perspective and finalize the set of ttps or model seend observed during the attack so in one example analyst may have more expertise related to the analyzing the packets or doing reverse engineering or more friendly with the Windows command line rather than the other analyst may have what is related to the Windows Event analysis or foren or that analyst may be more comfortable with the Mac OS or Linux so in such cases if you have a machine with the window High chances that this handlist one can get more contextual and Broad information of the behaviors and he may have more understanding of the mapping the behaviors to the TP rather than if there is something related to the forensic analyst two may have better insights rather than analyst one but also we cannot go with the one because there any attack may have a clubbed information of all these things needs to be analyzed so this is a general way which we follow in the real world where uh multiple analysts to coll collaborate together to discuss and finaly the uh ttps so why we do this so basically there is a term of profiling the adver so this TTP majorly represents the model oferty of the attacker like how attackers usually behave to achieve some Target so assume there is attacker A and B and attacker a is mostly trying to get initial access into the victim machine B at the same time is trying to get the access of the U victim machine so the behavior of the attacker a is can be if we have profiled in the by analyzing the past attacks so this can be seen that the attacker a is trying to most do send this spear fizzing email to the victim and they try to get in get into the victim infrastructure either user clicked on the sent spear fist email so why we are doing why we extracting this ttps from the raw data how it is going to helpful in the real world so um we we we took a case for attacker A and B where attacker a generally follows the spear fizzing uh techniques to Fe the user or the victim get into their Network or system where the attacker B is more sophisticated and they develop a zero day vulnerability or they exploit any public facing applications of the uh victim and they get into invade that and then they get into the network or system so this can be two different Behavior which is being used by two different adversaries based on their expertise and their knowledge this help us to uh segregate the behavior or the mody of the groups or the thread groups where one we can we can see a set of ttps which one attacker group follows usually and what other attacker group is being followed uh in since last in the past years but obviously this can be changed this can be changed one can follow one can remic the behavior of others because this ttps and behavior is all publicly available one can follow other groups Behavior to masquerading them their identity uh this is mainly helping in profiling the thread groups uh Identity or the profiling their behavior so let's understand what is the pros and cons of uh mapping uh ttps from the raw data and the finished threat report okay so the first stage was finding the behavior for raw data we were uh nearly exactly to the uh Behavior which is being demonstrated in the attack uh victim infrastructure but in the finished report it may be bued amongst pros and iosis so attackers um in the three reports we directly having a list of ioc which is being uh which is being listed in the threat reports generally and things are directly already analyzed and placed in front of us in the uh research Behavior stays for the raw data mapping case one need to collect the data from the all multiple data sources and different data types also uh this can be helping to First understand the procedure before going to the tactics or techniques whereas in the finished threat reports we may have more information and the context as is already been analyzed and uh and described after the analysis threat analysis more information and the contextual information the threat report rather than the raw data okay but this uh information whatever is present in the threat report is totally based on the understanding of the analyst who has created the who has written the report and the analysis so there are chances that there may be a loss of data while writing the threat report rather than in raw data we will be having all possible Behavior and the evidence in front of us and we can perform analysis based on our expertise while for translating the behavior into the tactics uh we have to map to the adversary intent and for that one needs to have a domain knowledge or expertise rather than for finished threat reports often this intent has been already processed and postulated and by the report author and has been placed directly in front of us now while figuring out the techniques which techniques has been used in the attack for the raw data we may have a procedure which directly straightforward as we saw for IP config or one may require a deep understanding of the uh domain uh Knowledge from where we are mapping the dtps and understand how it is being accomplished so for this one need to have a deep understanding of the domain rather than infin report if you want to map to the TTP there is a domain with the help of the NLP natural language processing one may process the text understand what exactly being explained in the sentences of the threat reports or the description and one can one can one can let an LP model to understand the behavior and the from the sentences of the threat report C and one can develop a model which where we can map directly from the sentences threat report sentences to the TTP so but this this can also be a kind kind of complex thing which one need to understand uh which one need to train a model on NLP model where one need to let the model understand the context information contextual information of the sentences and the paragraphs and then this text match also uh may help in the mapping to the uh sentences to the TTP now for comparing results with the another analyst uh one may need to multiple analyst to cover all kind of different data sources present at the victims in the finished threat report case it is more likely in the form of that other analy already needed the for the coverage to hedge against the bias means to restrict the Biers and analyst are need to having a more uh kind of diverse coverage and understanding of the domain so that they can understand the sentences and written in the threat report and map it to the uh attack Navigator so now there is a exercise where we will be directly uh we'll be seeing in the further slides but it it is it is expected that student can go to this link and access the exercise and do it after the class so there is exercise at this link under the exercise three where there are two tickets 473 at2 and 473 at 45 which has a series of commands and piece of malware analysis primarily a remote access troen and you have to see the series of commands present in the sticket and you have to map those commands to the ttps present in the MIT attack knowledge base so uh these commands are mostly uh executed by cmd.exe which is uh kind of pre assumable and the other other piece ticket that 4738 45 is a piece of malware analysis of a remote access troan which is being used in some pass attack so we have to go to this website access the store tickets and analyze and map the commands to the TTP and the uh pieces of whatever malary information we there is listed in that ticket map that to the uh MIT attack TTP now okay you have to record your results and download and edit then you have to identify as many Behavior as possible from the commands on the malware analysis behavior and you have to annotate those behavior on the MIT ATT attack techniques on that document further we'll also once we have this set of TTP how we we are going to store and analyze in the next few slides okay while performing this exercise you have to uh uh understand that on if you are analyst what you're supposed to ask uh what has been asked to the incident responder to get that dat behaviors whatever behaviors is being present in the ticket you have to uh understand that then what was easier or harder for work if you are working with the raw data and you're working with the finished threat reports you can feel difference between how easy and how hard it is to be to map TTP from raw data and the finished thre reports then you can also look into that what are the type of data which you commonly encounter with the behaviors so once we do this exercise multiple times we can have a TTP on that fingertip we can understand which kind of TTP is being used mostly by the attackers or which which thread group also while exercising did you notice any behavior that you could not find for technique for so there can be some behavior for which there is no tactic listed in the MIT attack knowledge base so it is kind of interesting to see can we find some Behavior which is being not mapped to any TTP okay so this mitro technology is beinged continuously since last few years so there each year they add different techniques and they add they Club multiple techniques in one category so some behaviors present in the current situation for which there is no TTP at all if one can find such TTP such Behavior one can the MIT miter has a one channel to report such techniques or behavior to them and they may list out list list that if they analyze that and if it is found a true Behavior which they have they might be missing till now so they may add that to the attack Navigator or knowledge base and by giving credit to you obviously okay so we'll directly see the result of the tiit uh for 47 382 Which con which contains the set of commands of those so this is exercise you are supposed to do after the class but I'll just demonstrate and explain the things to you having a bit better understanding of mapping so as we did in earlier ip config all it is directly Tech uh having a technique t1016 next arpa so this can send to translate the uh IP and the finding the finding the system in the network so this can be a system uh uh system network configuration Discovery so uh then further there is uh Eco user domain and username so probably it is trying to print the user domain and username of the machine so this can map to the system owner or user discovery which having a technic ID t103 then task list minus V which is mostly being listing the running process in the machine so that's this is kind of map to the process Discovery t157 then there is one more command SC query this says uh kind of querying the service state or their uh they what exactly they're doing so this can be uh listing out the uh this can come under the class of TTP system service Discovery having id17 victim may run this command system info which has been listed in this this system info gives the output about system information so that can be mapped directly information Discovery t182 then there is one more command net group domain add domains which is uh which can be used to see the groups permission whatever groups present on the victim machine so this can be map to the uh permission groups discovery which is t169 then there is one more command net user domain which can be used to see what all accounts present on the machine that can be mapped directly towards the account Discovery also uh there is one command related to net group domain controller which can be used to see all the groups present on the uh remote D controller where one can map that with the remote system Discovery further netsh ad firewall so all is represents to list out the what call kinds of uh firewall related details available uh implemented on the machine so this also again again is related to the network configuration and it is being mapped to the system network configuration Discovery okay then the final one is net start AO which list out the all network connection is actively communicating to with the victim machine so this can be uh listing out uh this can be mapped to directly to system network connection Discovery so you must have seen a common pattern that we are understanding what exactly this command is doing and based on our knowledge of attack knowledge base we are finding where this lies in and we are directly mapping it and also if you see all these techniques present in this tactics are related to Discovery stage or Discovery tactics in which adversary is trying to list and collect uh see information related to the victim machine and which is being mapped towards the discovery performing discovery on the victim machine also as this all commands is being uh will be either using a power shell or the CMD on the victim machine so that will comes under the SE tactics of execution and mostly it's a command L okay so in the execution it will go get mapped to the t159 which is used for uh running the commands line interface or the power cell commands similarly the other the next ticket 47 3845 for this we have this set of uh inform behaviors present in the ticket we'll first see this C2 protocol this uh C2 protocol is base 64 so so here this C2 represents the command uh control where base 64 is a standard protocol is used to incode for data encoding so attackers sometimes they encode the uh data or to off escate their real information so in this the we can map that data encoding present in the command and control uh tactics directly also as this is the standard application layer protocol one can use this one can map this to the 1071 further there is information related to uploading the file from server to client like from victim machine to C2 server so this can come under the remote file copy where t105 or this can also happen from victim server to uh uh sorry attacker server to victim machine that is client uh that comes under this downloading the file when uh victim adversity downloads the file or malici payloads hosted on the attack C2 server then there is shell command where some shell command is being run in the environment so this can be mapped to the command line interface again then there is a pshell and which can be again uh which runs the command via power shell so this pshell command can get mapped towards the Powershell 1086 execution phase further there is um exit path which represents the path of any P executable and which is being used to using the API so so because of that this can map execution through API technique present in the execution tactics now we can see this IP is being communicated to this and there's a reverse communication but we may not get much detail from this communication rather only we have this uh port number 443 okay so this is the standard port for the sttp communication and this is kind of non-standard Port so this port number can hand gate map there is a one more technique if attacker is using some commonly used port number so that that presents under the command and control to if they're using any commonly used port to communicate with the command and control server so there is a technique so we can directly map t143 for this kind of behavior okay now there is copy command where even spool is being renamed with some another things which has been hidden here so if this one sometimes attackers masquerade and they rename their file with something else with some another extension so you may not be realizing that the extension with dopdf file is actually executable file so such kind of behavior is representing masquerading and there's a technique for that in the dev defense evasion tactics so this is t136 further there is a registry information if you can see the modification is being done in this uh registry named as run where where this winds poool which they have renamed just now they added that into the Run registry so run registry mostly contains the list of item which is supposed to run which is supposed to get executed or pointed out once machine is getting uh once we are rebooting the machine so uh this represents that they are trying to make a persistant connection where they are modifying the registry run key and there is a specific techniques for X which is present in the persistance persistent tactics okay so you can see this regist is given paths to see window this this path which they have uh just now they renamed it okay so till now we talked about comenting the reports with the attack how we can uh understand and map the ttps from the threat report also we discussed till now that one can uh use the raw data analyzing data that tag to mapping the TTP things can be done in parallel so this this uh mapping from information to the uh ttps uh it allows the um other analyst to examine the mapping for themselves also it allows the easily capturing the how techniques are done which we uh while mapping the things okay so in the most of the threat if you see uh some of the reports from the prominent company already list the behavior in the threat report so rather they they wrote the whole threat report explaining the behavior in the last they can give some appendix or list of techniques which has been seen in the whole attack so this I if they have written uh some sentence like this during operation tanging yellow the actors used piple rat to execute this ip config via Windows command C so directly it is representing these two command these two Tech next which you already discussed so instead of writing this set of things to if I want to communicate with the another one so one can list this set of techniques like there is a network configuration Discovery is being done in the attack there is a command line interface technique is being done and there's some uh if there is a hardware addition they can do so this enables the communication between the analyst so rather than explaining the whole story in the sentences one can give a set of pce has been used in the attack which can summarize the other analyst or other expert to understand how attack flow okay any doubt okay so this is the end of the module so now we'll see a clse of the Navigator tool which list out all these techniques and we see how once we have a set of techniques how we can use that to storing and Analysis purpose so to uh as I as I as I told that this is used to uh do the profiling threat profiling so the set of ttps which we extracted from the raw data or from the threat reports one need to uh process that to get a understanding and visualization of the ttps or the attack scenarios okay so we'll see the attack Navigator now so this is just a uh kind of basic introduction of attack Navigator we'll we will do the whole analysis of the ttps in the next class if anyone has any doubt you can ask no doubt so you can go to attack miter.org there's a metric section so they have we s already discussed this that we have three kind of metrices for interprise mobile and IC industrial control system so on the enterprise metrix we are more interested towards it uh system so so we'll go with the Enterprise metrix and there is a tab named as view attack Navigator this is a navigator which is it is openly available one can use it for their own purpose so we have a different section here we'll discuss all these layers different uh in the next class tomorrow for now I'll just show you a quick Domo so this is the whole Navigator you can see where uh this is kind these are the T tactics listed uh one by one all 14 tactics and these are the techniques within each of the tactic so we will see how extracted techniques we will be mapping here we'll be mapping multiple attacks tactics all together Tech ttps all together and perform analysis to understand what what kind of all common techniques has been used and what all kind of different techniques has been used by two thread groups or even a single thread group of two different attacks so that will give us understanding of how attackers is either the are changing their behavior and how they're distinguishing from the other thread groups okay so these all tactics list kind of uh Recon has the 10 techniques and the others also the sub techniques which I saw which I this command and script interpreter we saw this t159 multiple times so so this has a different sub techniques so one can use the scripting and the command uh command cell to perform the attack and within this there are multiple ways one can achieve one can do one can perform these techniques so these are kind of sub you can see Power Cell is T10 59.1 similarly this Python and the other command cell having 003 sub techniques okay so this is the interface so we'll we'll wrap up now and if someone has any doubt you can ask otherwise in the next class we'll see this navigation to navigator tool how we can store analyze and how we can list out the defensive recommendation for the uh victim so the next class will be crucial because the second assignment we'll be releasing second assignment today and the second assignment has in the second assignments you are expected to you'll be giving a report for each group and you expected to extract the ttps from the reports by understand by reading the report based on your group's understanding and once you have a a list of TTP you can map that to the Navigator you can give a contextual information how you come up with that TTP and then you are supposed to give the defensive recommendation for each of the attack methods which we have seen in the threat report so we'll discuss this how to how to give this defensive recommendation and how to map and perform analysis on the Navigator tool Navigator tool and how to add contextual information in this tool in the next class okay [Music] [Music] [Music]