Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

PSC: How to get more information on MITRE TTPs

PSC: How to get more information on MITRE TTPs

Environment

  • Predictive Security Cloud (PSC): February 18, 2020 Release (0.52.1 backend)
    • Cloud Endpoint Standard (fka CB Defense)
    • Cloud Enterprise EDR (fka CB ThreatHunter)
    • CB ThreatSight 

Objective

Provide steps to view details on MITRE ATT&CK framework TTPs on the Alerts page

Resolution

  1. Go to Alerts page
  2. Click into Search bar
  3. Begin typing MITRE to view list of related TTPs
  4. Select desired MITRE TTP and press Enter to search
    Example
    TTP:MITRE_T1075_PASS_THE_HASH
  5. Expand items displayed to view full list of TTPs linked to selected AlertID
  6. Click on the pill/button with desired MITRE TTP listed
  7. New tab opens in browser with information on MITRE technique or tactic
    Example
    https://attack.mitre.org/techniques/T1075/

Additional Notes

Repeat as desired for other MITRE TTPs or use the MITRE site (MITRE ATT&CK®) to look for information on other Tactics, Techniques, and Procedures (TTPs)

Related Content


Was this article helpful? Yes No
100% helpful (2/2)
Article Information
Author:
Creation Date:
‎09-09-2020
Views:
1073
Contributors