Monitoring - Detecting Attacks with MITRE ATT&amp;CK

Name: Monitoring - Detecting Attacks with MITRE ATT&CK
Creator: Schneider, Michael
Keywords: Exploit, Windows, Microsoft, Research, Framework, Firewall, Detect, Basel, Mimikatz, GitHub

Schneider, Michael

Found an issue? Give us feedback

ZENODOarrow_drop_down

ZENODO

Article . 2019

License: CC BY

Data sources: Datacite

ZENODO

Article . 2019

License: CC BY

Data sources: Datacite

Monitoring - Detecting Attacks with MITRE ATT&CK

descriptionPublicationkeyboard_double_arrow_right Article 11 Jul 2019 English Publisher:Zenodo

Authors: Schneider, Michael;

doi: 10.5281/zenodo.3522009 , 10.5281/zenodo.3522010

Monitoring - Detecting Attacks with MITRE ATT&CK

- Summary
- Subjects
- Metrics

Abstract

This paper was written in 2019 as part of a research project at scip AG, Switzerland. It was initially published online at https://www.scip.ch/en/?labs.20190711 and is available in English and German. Providing our clients with innovative research for the information technology of the future is an essential part of our company culture.

Understanding the techniques used in attacks helps in detecting them. MITRE ATT&CK Enterprise Matrix includes actual attack statistics and techniques. Running it requires configuration of additional Windows audit settings. Correlations between events can be used to identify attacks.

Keywords

Exploit, Windows, Microsoft, Research, Framework, Firewall, Detect, Basel, Mimikatz, GitHub, Password, Policy, Hardening, Tool, Windows 10, Powershell, Request

Impact byBIP!

	selected citations These citations are derived from selected sources. This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).	0
	popularity This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network.	Average
	influence This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).	Average
	impulse This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network.	Average