MITRE ATT&CK Mitigations

MITRE ATT&CK Mitigations Overview

MITRE ATT&CK mitigations represent the “what” of defense - the security controls and countermeasures that can prevent or limit the effectiveness of adversary techniques. This section provides detailed implementation guidance for each mitigation category.

Access Control Mitigations

M1026: Privileged Account Management

Description

Manage the creation, modification, use, and permissions associated with privileged accounts.

Implementation with AlertKick

User Account Monitoring

# eBPF security rule for privileged account changes
- rule: Privileged Account Changes
  desc: Detect changes to privileged accounts
  condition: >
    (proc.name = "usermod" or proc.name = "useradd" or proc.name = "passwd") and
    (proc.cmdline contains "root" or proc.cmdline contains "admin" or proc.cmdline contains "sudo")
  output: >
    Privileged account change detected
    (user=%user.name command=%proc.cmdline)

Permission Changes Monitoring

# eBPF security rule for permission changes
- rule: Permission Changes
  desc: Detect changes to user permissions
  condition: >
    (proc.name = "chmod" or proc.name = "chown" or proc.name = "usermod") and
    (proc.cmdline contains "777" or proc.cmdline contains "root" or proc.cmdline contains "admin")
  output: >
    Permission change detected
    (user=%user.name command=%proc.cmdline)

Required Controls

Account creation and modification monitoring
Permission changes tracking and alerting
Privileged access logging and auditing
User behavior analysis and monitoring
Account lifecycle management and monitoring

Implementation Steps

Configure user monitoring in AlertKick
Set up privilege escalation detection rules
Implement account lifecycle management
Enable privilege access logging and auditing
Configure user behavior analysis

M1027: Password Policies

Description

Set and enforce secure password policies throughout the organization.

Implementation with AlertKick

Password Policy Monitoring

# eBPF security rule for password policy violations
- rule: Password Policy Violation
  desc: Detect password policy violations
  condition: >
    (proc.name = "passwd" or proc.name = "chpasswd") and
    (proc.cmdline contains "weak" or proc.cmdline contains "simple" or proc.cmdline contains "default")
  output: >
    Password policy violation detected
    (user=%user.name command=%proc.cmdline)

Authentication Monitoring

# eBPF security rule for authentication failures
- rule: Authentication Failures
  desc: Detect multiple authentication failures
  condition: >
    (proc.name = "sshd" or proc.name = "login" or proc.name = "su") and
    (proc.cmdline contains "failed" or proc.cmdline contains "denied" or proc.cmdline contains "invalid")
  output: >
    Authentication failure detected
    (user=%user.name service=%proc.name)

Required Controls

Password complexity requirements and enforcement
Password history tracking and prevention
Account lockout policies and monitoring
Multi-factor authentication implementation
Password management system integration

Implementation Steps

Configure password policy monitoring in AlertKick
Set up authentication failure detection
Implement account lockout policies
Enable multi-factor authentication monitoring
Configure password management integration

M1028: Operating System Configuration

Description

Configure operating systems securely to reduce the attack surface.

Implementation with AlertKick

System Configuration Monitoring

# eBPF security rule for system configuration changes
- rule: System Configuration Changes
  desc: Detect system configuration changes
  condition: >
    (proc.name = "sysctl" or proc.name = "systemctl" or proc.name = "chkconfig") and
    (proc.cmdline contains "disable" or proc.cmdline contains "enable" or proc.cmdline contains "modify")
  output: >
    System configuration change detected
    (user=%user.name command=%proc.cmdline)

Service Management Monitoring

# eBPF security rule for service management
- rule: Service Management
  desc: Detect service management activities
  condition: >
    (proc.name = "systemctl" or proc.name = "service" or proc.name = "chkconfig") and
    (proc.cmdline contains "start" or proc.cmdline contains "stop" or proc.cmdline contains "restart")
  output: >
    Service management detected
    (user=%user.name command=%proc.cmdline)

Required Controls

System hardening and configuration management
Service management and monitoring
Configuration drift detection and alerting
System compliance monitoring and reporting
Change management and approval processes

Implementation Steps

Configure system hardening monitoring in AlertKick
Set up service management detection
Implement configuration drift detection
Enable system compliance monitoring
Configure change management processes

Application Control Mitigations

M1047: Audit

Description

Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc.

Implementation with AlertKick

Audit Monitoring

# eBPF security rule for audit activities
- rule: Audit Activities
  desc: Detect audit and scanning activities
  condition: >
    (proc.name = "auditctl" or proc.name = "ausearch" or proc.name = "aureport") and
    (proc.cmdline contains "audit" or proc.cmdline contains "scan" or proc.cmdline contains "check")
  output: >
    Audit activity detected
    (user=%user.name command=%proc.cmdline)

Security Scanning Monitoring

# eBPF security rule for security scanning
- rule: Security Scanning
  desc: Detect security scanning activities
  condition: >
    (proc.name = "nmap" or proc.name = "nessus" or proc.name = "openvas") and
    (proc.cmdline contains "scan" or proc.cmdline contains "audit" or proc.cmdline contains "check")
  output: >
    Security scanning detected
    (user=%user.name tool=%proc.name)

Required Controls

Regular security audits and assessments
Vulnerability scanning and management
Configuration compliance monitoring
Security posture assessment and reporting
Remediation tracking and management

Implementation Steps

Configure audit monitoring in AlertKick
Set up vulnerability scanning detection
Implement compliance monitoring and reporting
Enable security posture assessment
Configure remediation tracking and management

M1048: Application Isolation and Sandboxing

Description

Isolate applications from each other and from the underlying system.

Implementation with AlertKick

Container Monitoring

# eBPF security rule for container activities
- rule: Container Activities
  desc: Detect container creation and management
  condition: >
    (proc.name = "docker" or proc.name = "podman" or proc.name = "containerd") and
    (proc.cmdline contains "run" or proc.cmdline contains "create" or proc.cmdline contains "start")
  output: >
    Container activity detected
    (user=%user.name command=%proc.cmdline)

Sandbox Monitoring

# eBPF security rule for sandbox activities
- rule: Sandbox Activities
  desc: Detect sandbox creation and management
  condition: >
    (proc.name = "firejail" or proc.name = "bubblewrap" or proc.name = "sandbox") and
    (proc.cmdline contains "sandbox" or proc.cmdline contains "isolate" or proc.cmdline contains "jail")
  output: >
    Sandbox activity detected
    (user=%user.name command=%proc.cmdline)

Required Controls

Container security and monitoring
Sandbox isolation and management
Application whitelisting and blacklisting
Process isolation and monitoring
Resource limits and monitoring

Implementation Steps

Configure container monitoring in AlertKick
Set up sandbox isolation detection
Implement application whitelisting and blacklisting
Enable process isolation monitoring
Configure resource limits and monitoring

Data Protection Mitigations

M1049: Antivirus/Antimalware

Description

Use capabilities to prevent suspicious code from executing.

Implementation with AlertKick

Antivirus Monitoring

# eBPF security rule for antivirus activities
- rule: Antivirus Activities
  desc: Detect antivirus and antimalware activities
  condition: >
    (proc.name = "clamav" or proc.name = "sophos" or proc.name = "mcafee") and
    (proc.cmdline contains "scan" or proc.cmdline contains "quarantine" or proc.cmdline contains "remove")
  output: >
    Antivirus activity detected
    (user=%user.name tool=%proc.name)

Malware Detection

# eBPF security rule for malware detection
- rule: Malware Detection
  desc: Detect malware and suspicious activities
  condition: >
    (proc.name in (malware_processes)) and
    (proc.cmdline contains "malicious" or proc.cmdline contains "suspicious" or proc.cmdline contains "trojan")
  output: >
    Malware detected
    (user=%user.name process=%proc.name)

Required Controls

Real-time scanning and protection
Signature-based detection and updates
Behavioral analysis and monitoring
Quarantine management and isolation
Incident response and remediation

Implementation Steps

Configure antivirus monitoring in AlertKick
Set up malware detection and alerting
Implement behavioral analysis and monitoring
Enable quarantine management and isolation
Configure incident response and remediation

M1050: Data Backup

Description

Perform regular backups of data and test restoration procedures.

Implementation with AlertKick

Backup Monitoring

# eBPF security rule for backup activities
- rule: Backup Activities
  desc: Detect backup and restore activities
  condition: >
    (proc.name = "rsync" or proc.name = "tar" or proc.name = "dd") and
    (proc.cmdline contains "backup" or proc.cmdline contains "restore" or proc.cmdline contains "archive")
  output: >
    Backup activity detected
    (user=%user.name command=%proc.cmdline)

Data Recovery Monitoring

# eBPF security rule for data recovery
- rule: Data Recovery
  desc: Detect data recovery activities
  condition: >
    (proc.name = "testdisk" or proc.name = "photorec" or proc.name = "ddrescue") and
    (proc.cmdline contains "recover" or proc.cmdline contains "restore" or proc.cmdline contains "rescue")
  output: >
    Data recovery detected
    (user=%user.name tool=%proc.name)

Required Controls

Regular backup scheduling and monitoring
Backup integrity verification and testing
Restore procedure testing and validation
Backup storage security and encryption
Disaster recovery planning and testing

Implementation Steps

Configure backup monitoring in AlertKick
Set up backup integrity verification
Implement restore procedure testing
Enable backup storage security monitoring
Configure disaster recovery planning and testing

Network Security Mitigations

M1030: Network Segmentation

Description

Architect sections of the network to isolate critical systems, functions, or resources.

Implementation with AlertKick

Network Traffic Monitoring

# eBPF security rule for network traffic
- rule: Network Traffic
  desc: Detect network traffic and connections
  condition: >
    (fd.sport in (80, 443, 22, 21, 25, 53)) and
    (not fd.sip in (trusted_networks))
  output: >
    Network traffic detected
    (user=%user.name connection=%fd.name)

Network Segmentation Monitoring

# eBPF security rule for network segmentation
- rule: Network Segmentation
  desc: Detect network segmentation violations
  condition: >
    (proc.name = "iptables" or proc.name = "firewall" or proc.name = "ufw") and
    (proc.cmdline contains "block" or proc.cmdline contains "allow" or proc.cmdline contains "deny")
  output: >
    Network segmentation detected
    (user=%user.name command=%proc.cmdline)

Required Controls

Network segmentation and isolation
Traffic filtering and monitoring
Access control and authentication
Network monitoring and alerting
Security policy enforcement

Implementation Steps

Configure network monitoring in AlertKick
Set up traffic filtering and monitoring
Implement access control and authentication
Enable network monitoring and alerting
Configure security policy enforcement

M1031: Network Intrusion Prevention

Description

Use network intrusion prevention systems to identify and prevent malicious network activity.

Implementation with AlertKick

Intrusion Detection

# eBPF security rule for intrusion detection
- rule: Intrusion Detection
  desc: Detect network intrusion attempts
  condition: >
    (proc.name = "snort" or proc.name = "suricata" or proc.name = "zeek") and
    (proc.cmdline contains "intrusion" or proc.cmdline contains "attack" or proc.cmdline contains "threat")
  output: >
    Intrusion detection triggered
    (user=%user.name tool=%proc.name)

Threat Detection

# eBPF security rule for threat detection
- rule: Threat Detection
  desc: Detect network threats and attacks
  condition: >
    (proc.name = "threat" or proc.name = "attack" or proc.name = "malware") and
    (proc.cmdline contains "detect" or proc.cmdline contains "prevent" or proc.cmdline contains "block")
  output: >
    Threat detected
    (user=%user.name threat=%proc.name)

Required Controls

Network intrusion detection and prevention
Threat intelligence integration and monitoring
Real-time alerting and response
Network traffic analysis and monitoring
Incident response and remediation

Implementation Steps

Configure intrusion detection in AlertKick
Set up threat detection and monitoring
Implement real-time alerting and response
Enable network traffic analysis
Configure incident response and remediation

System Security Mitigations

M1032: Multi-factor Authentication

Description

Use multi-factor authentication for user and privileged accounts.

Implementation with AlertKick

MFA Monitoring

# eBPF security rule for MFA activities
- rule: MFA Activities
  desc: Detect multi-factor authentication activities
  condition: >
    (proc.name = "google-authenticator" or proc.name = "authy" or proc.name = "duo") and
    (proc.cmdline contains "authenticate" or proc.cmdline contains "verify" or proc.cmdline contains "token")
  output: >
    MFA activity detected
    (user=%user.name tool=%proc.name)

Authentication Monitoring

# eBPF security rule for authentication
- rule: Authentication
  desc: Detect authentication activities
  condition: >
    (proc.name = "sshd" or proc.name = "login" or proc.name = "su") and
    (proc.cmdline contains "authenticate" or proc.cmdline contains "login" or proc.cmdline contains "verify")
  output: >
    Authentication detected
    (user=%user.name service=%proc.name)

Required Controls

Multi-factor authentication implementation
Authentication monitoring and logging
User training and awareness
Authentication policy enforcement
Incident response and remediation

Implementation Steps

Configure MFA monitoring in AlertKick
Set up authentication monitoring and logging
Implement user training and awareness
Enable authentication policy enforcement
Configure incident response and remediation

M1033: Data Loss Prevention

Description

Use data loss prevention (DLP) solutions to monitor and prevent data exfiltration.

Implementation with AlertKick

DLP Monitoring

# eBPF security rule for DLP activities
- rule: DLP Activities
  desc: Detect data loss prevention activities
  condition: >
    (proc.name = "dlp" or proc.name = "data" or proc.name = "prevention") and
    (proc.cmdline contains "monitor" or proc.cmdline contains "prevent" or proc.cmdline contains "block")
  output: >
    DLP activity detected
    (user=%user.name tool=%proc.name)

Data Exfiltration Monitoring

# eBPF security rule for data exfiltration
- rule: Data Exfiltration
  desc: Detect data exfiltration activities
  condition: >
    (proc.name = "scp" or proc.name = "rsync" or proc.name = "ftp") and
    (proc.cmdline contains "upload" or proc.cmdline contains "send" or proc.cmdline contains "transfer")
  output: >
    Data exfiltration detected
    (user=%user.name command=%proc.cmdline)

Required Controls

Data classification and labeling
Data monitoring and protection
User training and awareness
Policy enforcement and monitoring
Incident response and remediation

Implementation Steps

Configure DLP monitoring in AlertKick
Set up data classification and labeling
Implement data monitoring and protection
Enable user training and awareness
Configure policy enforcement and monitoring

Monitoring and Detection Mitigations

M1034: Limit Software Installation

Description

Restrict software installation to authorized personnel and applications.

Implementation with AlertKick

Software Installation Monitoring

# eBPF security rule for software installation
- rule: Software Installation
  desc: Detect software installation activities
  condition: >
    (proc.name = "apt" or proc.name = "yum" or proc.name = "pip") and
    (proc.cmdline contains "install" or proc.cmdline contains "add" or proc.cmdline contains "upgrade")
  output: >
    Software installation detected
    (user=%user.name command=%proc.cmdline)

Package Management Monitoring

# eBPF security rule for package management
- rule: Package Management
  desc: Detect package management activities
  condition: >
    (proc.name = "dpkg" or proc.name = "rpm" or proc.name = "snap") and
    (proc.cmdline contains "install" or proc.cmdline contains "remove" or proc.cmdline contains "update")
  output: >
    Package management detected
    (user=%user.name command=%proc.cmdline)

Required Controls

Software whitelisting and blacklisting
Installation monitoring and logging
User permissions and access controls
Software inventory and management
Policy enforcement and monitoring

Implementation Steps

Configure software monitoring in AlertKick
Set up software whitelisting and blacklisting
Implement installation monitoring and logging
Enable user permissions and access controls
Configure software inventory and management

M1035: Limit Hardware Installation

Description

Restrict hardware installation to authorized personnel and devices.

Implementation with AlertKick

Hardware Installation Monitoring

# eBPF security rule for hardware installation
- rule: Hardware Installation
  desc: Detect hardware installation activities
  condition: >
    (proc.name = "modprobe" or proc.name = "insmod" or proc.name = "usb") and
    (proc.cmdline contains "install" or proc.cmdline contains "add" or proc.cmdline contains "connect")
  output: >
    Hardware installation detected
    (user=%user.name command=%proc.cmdline)

Device Management Monitoring

# eBPF security rule for device management
- rule: Device Management
  desc: Detect device management activities
  condition: >
    (proc.name = "udev" or proc.name = "systemd" or proc.name = "hal") and
    (proc.cmdline contains "device" or proc.cmdline contains "hardware" or proc.cmdline contains "peripheral")
  output: >
    Device management detected
    (user=%user.name command=%proc.cmdline)

Required Controls

Hardware whitelisting and blacklisting
Device monitoring and logging
User permissions and access controls
Hardware inventory and management
Policy enforcement and monitoring

Implementation Steps

Configure hardware monitoring in AlertKick
Set up hardware whitelisting and blacklisting
Implement device monitoring and logging
Enable user permissions and access controls
Configure hardware inventory and management

Incident Response Mitigations

M1036: Account Use Policies

Description

Configure policies and procedures for the appropriate use of organizational accounts.

Implementation with AlertKick

Account Policy Monitoring

# eBPF security rule for account policy
- rule: Account Policy
  desc: Detect account policy violations
  condition: >
    (proc.name = "useradd" or proc.name = "usermod" or proc.name = "passwd") and
    (proc.cmdline contains "policy" or proc.cmdline contains "violation" or proc.cmdline contains "breach")
  output: >
    Account policy violation detected
    (user=%user.name command=%proc.cmdline)

User Behavior Monitoring

# eBPF security rule for user behavior
- rule: User Behavior
  desc: Detect suspicious user behavior
  condition: >
    (proc.name = "su" or proc.name = "sudo" or proc.name = "login") and
    (proc.cmdline contains "suspicious" or proc.cmdline contains "anomalous" or proc.cmdline contains "unusual")
  output: >
    Suspicious user behavior detected
    (user=%user.name command=%proc.cmdline)

Required Controls

Account policy development and enforcement
User behavior monitoring and analysis
Policy violation detection and alerting
User training and awareness
Incident response and remediation

Implementation Steps

Configure account policy monitoring in AlertKick
Set up user behavior monitoring and analysis
Implement policy violation detection and alerting
Enable user training and awareness
Configure incident response and remediation

M1037: Filter Network Traffic

Description

Filter network traffic to prevent access to unauthorized services and resources.

Implementation with AlertKick

Network Filtering Monitoring

# eBPF security rule for network filtering
- rule: Network Filtering
  desc: Detect network filtering activities
  condition: >
    (proc.name = "iptables" or proc.name = "firewall" or proc.name = "ufw") and
    (proc.cmdline contains "filter" or proc.cmdline contains "block" or proc.cmdline contains "allow")
  output: >
    Network filtering detected
    (user=%user.name command=%proc.cmdline)

Traffic Analysis Monitoring

# eBPF security rule for traffic analysis
- rule: Traffic Analysis
  desc: Detect network traffic analysis
  condition: >
    (proc.name = "tcpdump" or proc.name = "wireshark" or proc.name = "tshark") and
    (proc.cmdline contains "capture" or proc.cmdline contains "analyze" or proc.cmdline contains "monitor")
  output: >
    Traffic analysis detected
    (user=%user.name tool=%proc.name)

Required Controls

Network filtering and access controls
Traffic monitoring and analysis
Policy enforcement and monitoring
User training and awareness
Incident response and remediation

Implementation Steps

Configure network filtering monitoring in AlertKick
Set up traffic monitoring and analysis
Implement policy enforcement and monitoring
Enable user training and awareness
Configure incident response and remediation

Next Steps

MITRE ATT&CK Overview - Understanding the MITRE framework
MITRE Tactics - Detailed tactic analysis
MITRE Techniques - Specific technique detection
Security Monitoring Setup - Configure AlertKick for MITRE detection