Decider User Guide

Version 3.0.0 - Loginless ‘Kiosk’
(use version 2.x.y for content authoring)

Introduction

About

Decider is a web application that assists network defenders, analysts, and researchers in the process of mapping adversary behaviors to the MITRE ATT&CK® framework.

Produced For
Department of Homeland Security
Department of Homeland Security Seal

Produced By
Homeland Security Systems Engineering and Development Institute (HSSEDI™)
Homeland Security Systems Engineering and Development Institute Logo

Code: Decider’s GitHub Repo

Notice: This project makes use of MITRE ATT&CK® - ATT&CK Terms of Use

What is the ‘Kiosk’?

Decider Kiosk is a loginless version of Decider meant to be hosted as a publicly-accessible website.
User accounts, database-saved carts, and content authoring have all been removed from the application.
The frontend was also cleaned up - to improve accessibility and responsiveness.
The UI works on phones without issue.

Key Features

Decider has 3 key features:

  • Question Tree
  • Full Technique Search
  • Shopping Cart
Question Tree Summary

(structured progression through ATT&CK)

Decider’s homepage is the root of a question tree (matrix level).
The answer cards on this page are Tactics (adversary goals).
Clicking one progresses you along.

You descend down the hierarchy as such:
Matrix > Tactic > Technique > SubTechnique

Once you reach a (Sub)Technique, you can view a detailed page about it.
Should the description align with the adversary behavior you observed - you can add the Technique to your shopping cart.

Answer cards can be:

  • filtered by relevant Platforms / Data Sources
    • knowing what systems a behavior occurred against / what data sources the behavior can be detected from reduces the amount of options to deal with
  • re-ordered by a keyword search
    • providing key terms allows progressing through cards in a more optimal order
Full Technique Search Summary

(ability to search and filter all Techniques at once)

Search Technique IDs / names / descriptions using:

  • prefix matching
  • boolean expressions
  • phrase matching

Filter Techniques by relevant:

  • Tactics
  • Platforms
  • Data Sources
Shopping Cart Summary

(a place to store your mappings, add context, and export to files)

The ‘CTI Shopping Cart’ is a place where your mappings are stored.

  • Cart entries have a text box where you can place mapping content / rationale / evidence
  • Carts can be saved-to and loaded-from JSON files
  • Carts can be exported to a(n)
    • ATT&CK Navigator layer
      • (to visualize the attack heatmap in relation to defenses / existing adversary heatmaps)
    • Microsoft Word Doc
      • (creates a table of mapped Techniques + mapping context that can be embedded in a report)

Support / Troubleshooting

Please create an issue / discussion on Decider’s GitHub.

Does Decider Compete with the ATT&CK Website?

No, Decider complements the ATT&CK website.

Decider does not contain all of the information that is available on the ATT&CK website.
It primarily contains information on Tactics, Techniques, and the Platforms / Data Sources related to Techniques.

The goal of Decider is to aid in mapping threat reporting / adversary behaviors.
Once one has mappings - they can leverage the ATT&CK website for further insights / next steps (i.e. detections, mitigations).

Proposed Workflow

  1. Go to the question tree homepage (click Decider (Tree Home) in the top left)
  2. Identify the goal of the adversary’s actions (Tactic) - click this card
  3. Identify what Platform(s) the adversary’s actions occurred on/against and set these filters
    • (optionally set Data Sources their behavior could be detected by)
  4. Follow the remaining prompts to end up on a (Sub)Technique Success Page
  5. Read the Technique’s description
    • A. if it matches the observed behavior, then add it to your cart
      • Before adding to your cart
        • If the Mismappings section is present
          • double check that the Other Potential Technique(s) do not apply instead
      • After adding to your cart
        • If the Frequently Appears With section is present
          • skim the suggested Techniques, as the adversary may have leveraged them too
    • B. if it does not match the observed behavior, backtrack
      • a different SubTechnique may apply
      • (or) the ‘Base’ Technique may apply instead of one of its SubTechniques
      • (or) a different Technique may apply
      • (or) a different Tactic may apply even

CISA Best Practices for MITRE ATT&CK Mapping

The mapping steps below follow those identified in CISA’s ATT&CK Mapping Guide. Analysts may choose their own starting point based on their familiarity with ATT&CK and the technical details / context available in the report.

  1. Identify Tactics – Comb through the report to identify the adversary’s tactics and the flow of the attack. To identify the tactics (the adversary’s goals), focus on what the adversary was trying to accomplish and why. Review the tactic definitions to determine how the identified behaviors might translate into a specific tactic. Each tactic includes a finite number of actions an adversary can take to implement their goal. Understanding the flow of the attack can help identify the techniques or sub-techniques that an adversary may have employed.

  2. Identify Techniques – After identifying the tactics, review the technical details associated with how the adversary tried to achieve their goals. Note: if you have insufficient detail to identify an applicable technique, you will be limited to mapping to the tactic level, which alone is not actionable information for detection purposes. Compare the behavior in the report with the description of the ATT&CK techniques listed under the identified tactic. If one of them matches, then it may be an appropriate technique. Be aware that multiple techniques may apply concurrently to the same behavior.

  3. Identify Sub-Techniques – Review sub-technique descriptions to see if they match the information in the report. A match here may be an appropriate sub-technique. Read sub-technique descriptions carefully to understand the differences between them. In cases where the parent of a sub-technique aligns to multiple tactics, make sure to choose the appropriate tactic. Note: map solely to the parent technique only if there is not enough context to identify a sub-technique.

Consider techniques and sub-techniques as elements of an adversary’s playbook, rather than as isolated activities. Adversaries often use information they obtain from each activity in an operation to determine what additional techniques they will use next in the attack cycle. Because of this, techniques and sub-techniques are often linked in the attack chain.