Please enable JavaScript.
Coggle requires JavaScript to display documents.
🛡️ MITRE ATT&CK Enterprise Framework (Linux Enterprise Security…
🛡️ MITRE ATT&CK Enterprise Framework (Linux Enterprise Security Roadmap)
🛡️ MITRE ATT&CK Enterprise Framework (Linux Enterprise Security Roadmap)
1️⃣ Introduction to MITRE ATT&CK
📌 MITRE
Meaning:
MITRE = Massachusetts Institute of Technology Research and Engineering organization
A nonprofit organization that develops cybersecurity frameworks and research
📌 ATT&CK
Meaning:
ATT&CK = Adversarial Tactics, Techniques, and Common Knowledge
Purpose:
Document real-world attacker behaviors
Help defenders detect, investigate, and prevent attacks
📌 Enterprise ATT&CK
Covers:
Windows
Linux
macOS
Cloud
Network Devices
Containers
Industrial Systems
📌 Enterprise Security Usage:
SOC Operations
Threat Hunting
Detection Engineering
Incident Response
SIEM Rule Creation
Security Auditing
2️⃣ MITRE ATT&CK Structure
🎯 Tactics
Why attacker performs an action
⚙️ Techniques
How attacker performs an action
🔧 Sub-Techniques
More specific method
📚 Procedures
Real examples of attackers using techniques
3️⃣ MITRE ATT&CK Enterprise Tactics
🔍 Reconnaissance (TA0043)
Purpose:
Collect information before attack
Linux Defender View:
Monitor exposed information
Examples:
Network information gathering
User information gathering
Defensive Controls:
Reduce information exposure
Monitor external scanning
🛠️ Resource Development (TA0042)
Purpose:
Prepare infrastructure for attack
Examples:
Creating malware
Creating domains
Creating accounts
Defender Monitoring:
Threat intelligence
Domain monitoring
🚪 Initial Access (TA0001)
Purpose:
Gain first entry into Linux environment
Techniques:
🔹 T1190 Exploit Public-Facing Application
Meaning:
Exploit vulnerable internet-facing service
Linux Examples:
Apache:
/etc/apache2/
/var/log/apache2/
Nginx:
/etc/nginx/
/var/log/nginx/
Commands:
Check listening services:
ss -tulpn
netstat -tulpn
Detection:
Monitor:
/var/log/auth.log
/var/log/syslog
🔹 T1566 Phishing
Meaning:
Attacker tricks user to execute malicious content
Linux Detection:
Monitor:
User execution
Download activity
Commands:
history
last
auditctl
4️⃣ Execution (TA0002)
Purpose:
Run malicious code
🔹 T1059 Command and Scripting Interpreter
Linux Shell
Meaning:
Execute commands through shell
Common shells:
Bash:
/bin/bash
Sh:
/bin/sh
Zsh:
/bin/zsh
Attacker Examples:
bash script.sh
sh malware.sh
Detection:
Audit commands:
/var/log/audit/audit.log
Enable Audit:
systemctl enable auditd
systemctl start auditd
🔹 T1059.004 Unix Shell
Commands:
whoami
id
uname -a
hostname
ps aux
netstat
Detection:
auditctl -a always,exit \
-F arch=b64 \
-S execve
5️⃣ Persistence (TA0003)
Purpose:
Maintain access after reboot
🔹 T1053 Scheduled Task / Cron
Linux Cron Paths:
User cron:
/var/spool/cron/
System cron:
/etc/crontab
/etc/cron.d/
Commands:
View cron:
crontab -l
System cron:
cat /etc/crontab
Detection:
Monitor:
/etc/cron*
auditd
🔹 T1547 Boot or Logon Autostart
Linux Startup Locations:
Systemd:
/etc/systemd/system/
Services:
/usr/lib/systemd/system/
Commands:
List services:
systemctl list-unit-files
Check service:
systemctl status service_name
Detection:
Monitor new services
🔹 T1098 Account Manipulation
Meaning:
Modify accounts for persistence
Commands:
Create user:
useradd attacker
Modify user:
usermod
Check users:
cat /etc/passwd
Detection:
Monitor:
/etc/passwd
/etc/shadow
/etc/group
6️⃣ Privilege Escalation (TA0004)
Purpose:
Gain higher permissions
🔹 T1548 Abuse Elevation Control Mechanism
Linux sudo abuse
Important Files:
/etc/sudoers
/etc/sudoers.d/
Commands:
Check sudo:
sudo -l
Edit safely:
visudo
Dangerous Example:
attacker ALL=(ALL) ALL
Meaning:
Full root privilege
🔹 T1068 Exploitation for Privilege Escalation
Examples:
Kernel vulnerabilities
Check kernel:
uname -r
Installed packages:
dpkg -l
rpm -qa
7️⃣ Defense Evasion (TA0005)
Purpose:
Hide attacker activity
🔹 T1070 Indicator Removal
Linux Logs:
Authentication:
/var/log/auth.log
System:
/var/log/syslog
Kernel:
/var/log/kern.log
Commands:
history -c
rm logs
Detection:
File integrity monitoring:
AIDE
Tripwire
🔹 T1036 Masquerading
Meaning:
Rename malware to look legitimate
Example:
/tmp/systemd-update
Detection:
File hashes
Process monitoring
8️⃣ Credential Access (TA0006)
Purpose:
Steal passwords and authentication data
🔹 T1003 OS Credential Dumping
Linux Credential Files:
Password hashes:
/etc/shadow
User database:
/etc/passwd
Commands:
cat /etc/passwd
sudo cat /etc/shadow
Protection:
chmod 600 /etc/shadow
Strong password policy
🔹 T1552 Unsecured Credentials
Search locations:
~/.bash_history
~/.ssh/
config files
Commands:
find / -name "*.conf"
grep -r password /etc
9️⃣ Discovery (TA0007)
Purpose:
Learn environment information
🔹 System Information Discovery
Commands:
uname -a
hostnamectl
lscpu
free -m
🔹 Account Discovery
Commands:
cat /etc/passwd
getent passwd
🔹 Network Discovery
Commands:
ip addr
ip route
ss -tulpn
arp -a
🔹 Process Discovery
Commands:
ps aux
top
htop
🔟 Lateral Movement (TA0008)
Purpose:
Move between systems
🔹 T1021 Remote Services
SSH
Configuration:
/etc/ssh/sshd_config
Logs:
/var/log/auth.log
Commands:
ssh
user@server
Detection:
Failed login:
grep "Failed password" /var/log/auth.log
1️⃣1️⃣ Collection (TA0009)
Purpose:
Collect valuable information
Files:
/home/
/var/log/
databases
Commands:
find /home -type f
tar -czf data.tar.gz folder
1️⃣2️⃣ Command and Control (TA0011)
Purpose:
Communicate with attacker infrastructure
🔹 Application Layer Protocol
Examples:
HTTP
HTTPS
DNS
Linux Monitoring:
tcpdump
Wireshark
Zeek
Commands:
tcpdump -i eth0
ss -antp
1️⃣3️⃣ Exfiltration (TA0010)
Purpose:
Steal data
Methods:
SSH
HTTP Upload
DNS tunneling
Detection:
Monitor:
Network traffic
Large outbound connections
1️⃣4️⃣ Impact (TA0040)
Purpose:
Damage systems
Examples:
File encryption
Data destruction
Service shutdown
Linux Commands:
systemctl stop service
rm -rf files
1️⃣5️⃣ Enterprise Detection Architecture
🖥️ Linux Servers
|
↓
📥 Log Collection
rsyslog
auditd
journald
Paths:
/var/log/
|
↓
🔎 SIEM
Elasticsearch
Logstash
Kibana
Splunk
|
↓
🚨 Detection Rules
MITRE Technique Mapping
Example:
Failed SSH Login
Maps To:
T1110 Brute Force
1️⃣6️⃣ Linux Security Tools Mapping
🔐 Authentication Monitoring
auditd
OSSEC
Wazuh
🔍 Vulnerability Detection
Nessus
OpenVAS
Trivy
🕵️ Threat Hunting
Volatility
YARA
Sigma Rules
📊 SIEM
Elastic Security
Splunk
QRadar
1️⃣7️⃣ Enterprise SOC Workflow
Alert Generated
↓
Identify MITRE Technique
↓
Investigate Logs
↓
Validate Attack
↓
Containment
↓
Eradication
↓
Recovery
↓
Report
1️⃣8️⃣ Linux MITRE ATT&CK Learning Path
Linux Fundamentals
↓
System Administration
↓
Logging
↓
Auditd
↓
SIEM
↓
MITRE ATT&CK Mapping
↓
Threat Hunting
↓
Detection Engineering
↓
SOC Analyst Level