MITRE — Writeup

This is a short writeup for the TryHackMe room — MITRE

Note:

• The questions are shortened for a cleaner view
• Questions that are straightforward will only have answers attached. Such questions can be easily answered by reading the documentation given in the room.

Task 1 — Introduction

No answer needed

Task 2 — ATT&CK® Framework

1) What Tactic does the Hide Artifacts technique belong to in the ATT&CK Matrix?

The matrix is available here. I just used the search box to search for the technique and used the left column view to identify the Tactic.

Ans: Defense Evasion

2) Which ID is associated with the Create Account technique?

Search for the Create Account Technique.

Ans: T1136

Task 3 — ATT&CK in Operation

1) In which country is Mustang Panda based?

A simple google search should suffice.

Ans: China

2) Which ATT&CK technique ID maps to Mustang Panda’s Reconnaissance tactics?

Since they primarily use Phishing , I looked at the Phishing for Information tactic

Ans: T1598

3) Which software is Mustang Panda known to use for Access Token Manipulation?

This is hard to find through the navigator so I ended up searching for it here](https://attack.mitre.org/groups/G0129/)

Ans: Cobalt Strike

Task 4 — ATT&CK for Threat Intelligence

1) Which APT group has targeted the aviation sector…?

I searched for aviation on the webpage.

Ans: APT33

2) Which ATT&CK sub-technique used by this group is a key area of concern…?

I clicked on the group to find more details and searched for 365

Ans: Cloud Accounts

3) According to ATT&CK, what tool is linked to the APT group…?

Ans: Ruler

4) Which mitigation strategy advises removing inactive or unused accounts to…?

I clicked on Cloud Accounts for the detailed view and headed over to Mitigation Techniques.

Ans: User Account Management

5) What Detection Strategy ID would you implement to detect abused…?

I looked at the Detection Strategies for Cloud Accounts.

Ans: DET0546

Task 5 — Cyber Analytics Repository (CAR)

1) Which ATT&CK Tactic is associated with CAR-2019–07–001?

This is under the Tactics(s) field.

Ans: Defense Evasion

2) What is the Analytic Type for Access Permission Modification?

This is available in the small information box on the top-right.

Ans: Situational Awareness

Task 6 — MITRE D3FEND Framework

1) Which sub-technique of User Behavior Analysis would you use to analyze…?

Searching for geolocation highlights the sub-tactic

Ans: User Geolocation Logon Pattern Analysis

2) Which digital artifact does this sub-technique rely on analyzing?

I checked the Artifact Relationships section.

Ans: Network Traffic

Task 7 — Other MITRE Projects

Its on the right of the webpage where there is an overview of the techniques.

1) What technique ID is associated with Scrape Blockchain Data…?

Ans: ADT3025

2) Which tactic does LLM Prompt Obfuscation belong…?

Ans: Defense Evasion