Making Defensive Recommendations Unguided Exercise

Techniques identified from the previous exercise:

• Spearphishing Attachment
• Spearphishing Link
• Scheduled Task
• Scripting
• User Execution
• Registry Run Keys/Startup Folder
• Credential Dumping
• Network Service Scanning
• System Network Configuration Discovery
• Connection Proxy

Useful links:

ATT&CK:
–https://attack.mitre.org
Cyber Analytics Repository:
–https://car.mitre.org/
Threat Hunter Playbook
–https://github.com/Cyb3rWard0g/ThreatHunter-Playbook
Windows ATT&CK Logging Cheatsheet
–https://www.malwarearchaeology.com/cheat-sheets

0. Pick a technique to focus on from the above list

1. What defensive options can you identify for dealing with the chosen
technique?

2. Using either your own organization or a notional one, what are your
organizations capabilities and constraints that may impact the identified
defensive options?

3. Given your organization’s capabilities and constraints, what are the

tradeoffs for each of the defensive options?

4. What are your final recommendations? Are they technical, policy, or

risk acceptance?

©2019 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public
release. Distribution unlimited 18-1528-44.