Saturday #blueteam pondering -

Are lateral movement and privilege escalation two distinct concepts?

What is lateral movement really?
Have access here.
Want access over there.
Do things to exploit weakness.
Get access over there.
Lateral movement has happened.

This story is access centric.

Except, in common parlance:
. lateral movement is network centric.
. privilege escalation is access centric.

Gestalt for me: trouble comes when:
user account scope-of-access =
network-reach scope-of-access

Trying to illustrate -
What onwards value is domain admin on a member host without effective interactive network-reach to a DC? i.e. effective onwards network-reach scope-of-access is unavailable to other hosts.

In other words, achieving privilege escalation on a member host is little, when onwards network-reach scope-of-access does not include other hosts on the private network.

Scope-of-access is the key conceptual distinction for both account-level and network-level access.

Account scope-of-access is a long used concept, perhaps a little out of favour.

There are degrees of onwards network-reach. Necessary network connections between member hosts and DCs does not immediately equate to material scope-of-access.

I reckon ‘network-reach scope-of-access’ is a handy phrase. Perhaps it explicitly surfaces a concept in common use with graph theory modeling of attack paths?

Thoughts?

#blueteam
#lateralmovement #privelege_escalation
#mitre #mitreattack #mitreattck
#activedirectory
#infosec #cybersecurity

I'm trying to document a DoS that happened yesterday... I get a CVSS3 score but am having trouble using MITRE ATT&CK, anybody wanna chime in here?

CVSSv3 : 5.3 (AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)

Attacker hits the cable with a big chunk of iron (anchor)... 🤔😉🚢⚓

🤪

#mitreattackframework #mitreattck #mitreattck

@fugueish Yes, but I think your CSIRP and related processes would need to reference MITRE ATT&CK and require it before it would be widely used.
It can get you started on mapping out any possible threat, risk, or attack you can think of and help you come up with mitigations. But if everybody isn't using it, you'll have references and language that only some teams understand.
In real life, it is nice when our security tools link to MITRE ATT&CK because we can quickly understand what a particular alert is about. But we don't put that on a report that goes to anybody else, because, as of right now, they would have no idea what T1548.002 means.

#mitre #mitreattack #mitreattck #csirp #csirt #infosec

Great way of adding MITRE ATT&Ck analytics to your SIEM for threat hunting. They even added an intelligence component that resembles MITRE's Software/Groups tabs so your references are in one place.
#ThreatIntel #ThreatHunting #mitreattck

https://thehackernews.com/2022/11/threat-hunting-with-mitre-att-and-wazuh.html