Ç°ÑØ°²È«ÂÛØ­ATT&CK¿ò¼ÜÔÚ°²È«ÔËÓªÖеÄÀûÓÃ

°ä²¼¹¦·ò 2021-11-30

Íþвµý±¨ÊǹØÓÚIT»òÐÅÏ¢×ʲúËùÃæ¶ÔµÄÏÖÓлòDZÔÚÍþвµÄѭ֤֪ʶ £¬Ô̺¬Çé¾³¡¢»úÔì¡¢Ö¸±ê¡¢ÍÆÂÛÓë¿ÉÐн¨Òé £¬ÕâЩ֪ʶ¿ÉΪÍþвÏìÓ¦Ìṩ¾ö²ßƾ¾Ý¡£¡ª¡ªGartnerÔÚ2014Äê°ä·¢µÄ¡¶°²È«Íþвµý±¨·þÎñÊг¡Ö¸ÄÏ¡·£¨Market Guide for Security Threat Intelligence Service£©ÖÐÌá³öµÄ½ç˵¡£


ƾ¾ÝDavid J. BiancoÔÚ¡¶The Pyramid of Pain¡·Ò»ÎÄÖÐÌá³öµÄÍþвµý±¨ÓйØÖ¸±êµÄ½ð×ÖËþÄ£ÐÍ £¬Äܹ»Æ¾¾ÝÊý¾Ý×ÔÉí½«Íþвµý±¨·ÖΪHASHÖµ¡¢IPµØÖ·¡¢ÓòÃû¡¢ÍøÂç»òÖ÷»úÌØµã¡¢TTPs£¨Tactics¡¢Techniques & Procedures£©¡£×ó²àÊÇ¿ÉÄÜÀûÓõĵý±¨ £¬ÓÒ²àÊÇÕâЩµý±¨µÄ¼ÛÖµºÍ°ÑÎÕºó¸øÈëÇÖÕßÔì³ÉµÄ¼²¿àˮƽ¡£


ATT&CK¿ò¼ÜÓÃÓÚÍþвµý±¨µÄʵ¼Ê.png


Íþвµý±¨ÖмÛÖµ×îµÍµÄÊÇHashÖµ¡¢IPµØÖ·ºÍÓòÃû£¨Ò²¾ÍÊdz£ËµµÄÌØµã¿â£© £¬Æä´ÎÊÇÍøÂç/Ö÷»úÌØµã¡¢ÈëÇÖ¹¤¾ßÌØµã £¬¶ÔÈëÇÖÕßÓ°Ïì×î´óµÄÊÇTTPs£¨Õ½Êõ¡¢¼¼ÊõºÍÐÐΪģʽ£©ÀàÐ͵ÄÍþвµý±¨¡£¶øÄ¿Ç°°²È«ÔËÓªÖдóÁ¿Ê¹ÓõÄÒÀÈ»ÊÇ»ùÓÚHASH£¨Ìصã¿â£©¡¢IP£¨»¤ÍøÐж¯ÖÐÀ¶¶ÓµÄͨÀýµÄ¡°·âIP¡±ÐÐΪ£©¡¢ÓòÃû¡¢URLΪ»ù´¡Æ¾¾ÝµÄÍþвµý±¨ £¬ÕâЩµý±¨ÔÚÓ¦¶Ô×Ô¶¯º£Á¿ÎÞ×ÔÖ÷¼ûʶµÄ²¡¶¾½ÏΪÓÐЧ £¬¶øÔÚÓ¦¶Ô¸ß¼¶¿É³ÖÐøÍþвÈëÇÖ·½ÃæµÄ±ÈÁ¦·¦Á¦ £¬µÈÏб»ÈëÇÖÕßÈÆ¹ý¡£¶øATT&CK¿ò¼ÜµÄÖ÷ÌâÕýÊÇTTP £¬Óó߶È˵»°ÃèÊöµÐÊÖÈëÇÖÐÐΪ £¬ÌìÈ»µÄΪÍþвµý±¨ÌṩÁ˸߽ױêÇ© £¬ÔÚ°²È«ÔËÓªÖÐ £¬·ÀÓùÕßÄܹ»Æ¾¾ÝÒÑÖªÈëÇÖÕß¼¼ÊõºÍÕ½ÊõÀ´¸ú×ÙÈëÇÖÖ÷Ìå £¬Ô¤¾¯ÉõÖÁÔ¤ÅпÉÄܵÄÈëÇÖÐÐΪºÍģʽ¡£


Ê·ý£ºÄ³¾­µäµÄÓã²æÊ½´¹µö³¡¾°µÄÍþвµý±¨¹¹½¨


ÈëÇÖÍŶÓÀûÓÃ΢ÈíOfficeºêÎļþµÄVBSript¹¹½¨¹¥»÷´úÂë £¬¶øºóͨ¹ýµç×ÓÓʼþ½øÐÐÓã²æ´¹µö¹¥»÷ £¬Êܺ¦ÕßÖ´ÐдúÂëºó £¬Ö÷»ú±»ÈëÇÖ½ÚÔì £¬²¢ÓÃ×÷Ìø°å»ú½øÒ»²½ÈëÇÖÄÚÍø¡£¸ß½×Íþвµý±¨µÄÖ÷ÌâÊǼø±ð²¢±êʶ¹¥»÷Õߵļ¼Õ½·¨£¨TTP£© £¬Òò¶øÑ¡È¡ATT&CK¿ò¼ÜÀ´¼ø±ðºÍ¹¹½¨ÈëÇÖµÄTTPÐÐΪÁ´Ìõ¡£ÈçÏ £¬·ÖÁгöÈëÇÖÕßʹÓõÄÕ½Êõ¡¢¼¼ÊõÒÔ¼°¶ÔÓ¦µÄ±êÇ©¡¢»º½â´ëÊ©ºÍ¼ì²â¼¿Á©¡£


1¡¢ÐÅÏ¢ÍøÂ磺ÈëÇÖÕßÍøÂçÖ¸±êÓйØÐÅÏ¢


2¡¢³õʼ½Ó¼û£ºÈëÇÖÕß·¢ËÍÓã²æÊ½ÓʼþÓÕµ¼Ö´ÐÐ


3¡¢´úÂëÖ´ÐУºÊܺ¦Ö÷»úÆôÓÃOfficeºêÖ´ÐжñÒâ´úÂë


4¡¢Óƾû¯£º´´½¨·þÎñ¹ý³Ì¡¢Ôö³¤´òË㹤×÷


5¡¢·ÀÓù¶ã±Ü£¨¼Ù×°£©£ºRTLO×Ö·û´ÓÓÒÍù×󸲸ǼÙ×°Õý³£ÎļþÃû


6¡¢ºÅÁîÓë½ÚÔ죺³ÉÁ¢Òñ±ÎËí·¡¢´î½¨ÄÚÍø´úÀí


7¡¢Êý¾ÝÉøÂ©£º³ÉÁ¢C2Ëí·½ÚÔìÓëÊý¾ÝÇÔÈ¡


8¡¢Ó°Ï죺´æ´¢Êý¾Ý²Ù×÷ £¬´Û¸ÄÄÚÈÝ


×îÖÕÐγÉÈëÇÖÁ´ÌõÈçÏ £¬°ÑÎÈATT&CK¿ò¼ÜÖеÄÕ½Êõ³¤¶ÌÏßÐԵġ£ÓÉÉÏÀý¿É¼û £¬ÒÀÕÕATT&CK¿ò¼ÜÄ£ÐͽøÐÐÍþв½¨Ä£ £¬¼«´óµÄ·½±ãÁ˹¹½¨°²È«ÔËÓªÖи߽×Íþвµý±¨ÖªÊ¶¿â £¬ÆëÈ«µÄÊáÀí³öÍþвÐÐΪµÄTTP¡¢¼ì²âÊý¾ÝÔ´ÒÔ¼°·ÀÓù´ëÊ© £¬¼ò»¯ÁËËÝÔ´µÄÁ÷³ÌºÍÍþвµý±¨µÄ´´½¨¹ý³Ì £¬Îª°²È«ÔËÓªÖй¹½¨×Ô¶¯·ÀÓùϵͳÌṩÁËÓÐÁ¦µÄÖ§³Ö¡£


ATT&CKÓÃÓÚ°²È«ÔËÓªÄÜÁ¦³ÉÊìÆÀ¹Àʵ¼Ê


ÔÚÏÖʵ°²È«ÔËÓªÖÐ £¬ºÃ¶à°²È«Ö÷¹Ü¶¼´æÔÚÄÑÒԻظ²µÄÁ¿»¯À§¾³ £¬ÀýÈ磺µ±Ç°µÄ°²È«·ÀÓùϵͳÓÐЧÐÔÈôºÎ £¿°²È«Í¶×ʺͽ¨ÉèµÄÓÅÏȼ¶ÈôºÎ £¿ÊµÕ½ÑÝϰÊÇ·ñÍÆ¶¯ÁËÄÜÁ¦µÄÌáÉý £¿


ͬÑù¶ÔÓÚ°²È«ÔËάÈËÔ± £¬Ò²´æÔÚÄÑÒԻظ²µÄÎÊÌ⣺


ÊÇ·ñ¿ÉÄÜÆ¥µÐµ±Ç°Ê¢ÐеÄAPT¹¥»÷ÐÐΪ £¿º£Á¿µÄ¸æ¾¯Êý¾ÝÓ¦¸ÃÈôºÎ·ÖÎöÈ·¶¨·¨¹æ £¿ÈôºÎÑéÖ¤ÔËάÍŶӵļ¼Êõ¹¤×÷ÄÜÁ¦µÄÓÐЧÐÔ £¿


ʵ¼ÊÊǼìÑéÕæÚеÄΨһ³ß¶È £¬ËùÓа²È«ÎÊÌâµÄÓÐЧÐÔÓ¦¸ÃÓÃʵ¼ÊµÄ·½Ê½À´¼ìÑé¡£Òò¶øATT&CK¿ò¼ÜÕýÊǼìÑé·ÀÓùÄÜÁ¦µÄÓÐЧ¼¿Á©¡£


£¨Ò»£©ÈëÇÖÕß·ÂÕÕ´òËã


»ùÓÚATT&CKµÄÈëÇÖÕß·ÂÕÕ´òËã £¬Äܹ»Ñ¡È¡Á½ÖÖ·½Ê½£º


1¡¢ÊµÕ½ÈëÇÖ £¬ÒÀÕÕATT&CKµÄ¿ò¼Ü³ß¶È £¬×éÖ¯ºì¶Ó´òË㷢չһϵÁлùÓÚÍþвµÄ°²È«²âÊÔ £¬·ÂÕÕÕæÊµÈëÇÖÕßµÄÕ½Êõ¼¼ÊõºÍ¹ý³Ì £¬ÓÃʵս¼ìÑé·ÀÓùϵͳµÄÕæÊµ·ÀÓùÄÜÁ¦¡£


2¡¢É³ÅÌÍÆÑÝ £¬ÈÃÆóÒµµÄºìÀ¶ÍŶÓÑ¡Ôñ·ÖÆçµÄ½ÇÉ« £¬»áÉ̺ì¶ÓÈôºÎʹÓÃ·ÖÆç²½ÖèÀ´Ö´Ðй¥»÷ÐÐΪµÄ £¬»áÉÌÍþвµý±¨·ÖÎöÈËÔ±ÊÇÈôºÎËÝÔ´·ÖÎö £¬°²È«ÔËÓªÈËÔ±ÊÇÈôºÎÆ¥µÐ´ëÖõÄ £¬½«ATT&CK×÷ΪͨÓÃ˵»°½øÐйµÍ¨ºÍÍÆÑÝ¡£


ÕâºÍͨ³£µÄÉøÈë²âÊÔÓÐʲô·ÖÆçÄØ £¿


ÉøÈë²âÊÔÖØÒªÊǵ¥Ò»ÍŶӵÄÈëÇÖ²âÊÔ £¬¶ø»ùÓÚATT&CKµÄÈëÇÖÕß·ÂÕÕ´òËãÖØÒªÔÚÓÚÄܹ»·ÂÕÕ¶à¸öAPT×éÖ¯µÄÈëÇÖÐÐΪ £¬¶ø·Çµ¥Ò»×éÖ¯µÄ¼¿Á©ºÍ´ó¾Ö £¬Ô½·¢È«ÃæºÍÓÐЧ¡£


²¢ÇÒ £¬MITREÒ²´´½¨ÓÐÈëÇÖÕß·ÂÕÕ´òËã £¬Ö÷ÕÅÊÇÈúì¶Ó¿ÉÄÜÔ½·¢ÕýÈ·¸ßЧµØ·ÂÕÕÈëÇÖÐÐΪ £¬´Ó¶øÊ¹µÃ·ÀÊØ·½¿ÉÄÜÔ½·¢ÓÐЧµØ²âÊÔ×Ô¼ºµÄÍøÂç·ÀÓùÄÜÁ¦¡£ÀýÈç»ùÓÚAPT3´´½¨µÄÈëÇÖÕß·ÂÕչ滮 £¬¹æ»®ÖÐÆëÈ«µÄ¸´ÏÖÁËAPT3ÈëÇÖµÄËùÓÐÁ÷³Ì¡£´Ó¶øÊ¹µÃ°²È«ÔËÓª·½¿ÉÄÜÔ½·¢ÓÐЧµØ²âÊÔ×Ô¼ºµÄ±£ÏÕϵͳӦ¶Ô¸÷ÀàAPT×éÖ¯ÈëÇÖʱµÄ·ÀÓùÄÜÁ¦¡£


£¨¶þ£©°²È«ÔËÓªÄÜÁ¦³ÉÊì¶ÈÆÀ¹À


ATT&CK¿ò¼ÜͬÑù¿ÉÀûÓÃÓÚ°²È«ÔËÓªÖÐÐĵķÀÓùÄÜÁ¦³ÉÊì¶ÈÆÀ¹À £¬ÆÀ¹À×éÖ¯ÏÖÓеķÀÓùϵͳ £¬ÊÇ·ñ¿ÉÄܸ²¸Çµ½ËùÓÐÒÑÖªÈëÇÖ¼¿Á© £¬¸¨Öú·¢ÏÖ·ÀÓùÄÜÁ¦¶Ì°å £¬ÍƽøÃÀÂú·ÀÓùϵͳ¿ò¼Ü¡£¾ßÌåÀ´ËµÄܹ»ÊµÏÖÈçÏ£º


1¡¢ÆÀ¹ÀÍøÂ簲ȫ·ÀÓù¿ò¼ÜÄÜÁ¦ £¬µäÐͳ¡¾°Êǰ²È«ÄÜÁ¦¸²¸Ç¶ÈÆÀ¹À £¬Ñ¡È¡É«¿é±ê¼Û·¨ £¬Äܹ»ÁËÈçÖ¸ÕÆ°²È«µÄ²î¾àÔÚÄÄÀï £¬»¹±ØÒª¸Ä½øÄÄЩ £¿


2¡¢µ±°²È«ÄÜÁ¦ÒѾ­ÊµÏÖÁËÈ«¸²¸Ç £¬½ÓÏÂÀ´ÊDZØÒªÆÀ¹À°²È«ÄÜÁ¦µÄ³ÉÊì¶È £¬½«³ÉÊì¶ÈÒÀÕÕ·ÖÆçµÄˮƽ´ò·Ö¡£ÀýÈç¶à¿î²úÆ·¾ù¸²¸Çµ½Á˸ÃÄÜÁ¦ £¬Åú×¢·ÀÓù³ÉÊì¶È½Ï¸ß £¬¿É½øÐÐÉîÉ«¸³Öµ £¬Ïà·´Ôò½øÐе­É«¸³Öµ £¬×îÖÕÐγɿÉÊÓ»¯Ë®Æ½½Ï¸ßµÄ°²È«ÄÜÁ¦³ÉÊì¶ÈÄ£ÐÍ¡£


3¡¢Ö÷Á÷ÈëÇÖ¼¼ÊõÈÈ¶ÈÆÀ¹À¡£¶ÔÓÚ×éÖ¯À´Ëµ £¬ÏàʶÈëÇÖÕßʱʱʹÓÃÈëÇÖ¼¼ÊõÒ²¼«¶È³ÁÒª¡£Òò¶øÄܹ»Æ¾¾ÝATT£¦CK֪ʶ¿âÖдæÔÚµÄ122¸öAPT×éÖ¯µÄTTP£¨Õ½Êõ¡¢¼¼Êõ¡¢¹ý³Ì£©´´½¨ÈëÇÖ¼¼ÊõÈÈÁ¦Õù¡£


´ËʱÎÒÃÇÄܹ»ÉèÏëÿһ¸öAPT×é֯ʹÓõÄTTP¶¼ÊÇÔÚÒ»¿é²£Á§ÉÏͿɫ £¬µ±ËùÓÐAPT×é֯ʵÏÖͿɫºó £¬°ÑÕâЩ²£Á§µþ¼ÓÆðÀ´¾ÍÐγÉÁËGA»Æ½ð¼×Íþв×éÖ¯Êý¾ÝµÄÈÈÁ¦Õù £¬ÈÈÁ¦ÕùÖеÄÉ«²ÊÔ½Éî £¬Ôò°µÊ¾ÈëÇÖ×é֯ʹÓøü¼ÊõµÄƵÂʾÍÔ½¸ß¡£×ÛÉÏ £¬½«ATT&CK¿ò¼ÜÀûÓÃÓÚ°²È«ÔËÓªÖÐÐÄ £¬¿ÉÄÜÕæÊµ·´Ó³°²È«ÔËÓªÖÐÐÄÔÚÃæ¶ÔAPT×éÖ¯ÍþвʱµÄ°²È«·ÀÓùÄÜÁ¦ £¬Í¬Ê±Äܹ»ÑéÖ¤°²È«ÔËÓªÖÐÐÄÔÚ¼ì²â¡¢·ÖÎöºÍÏìÓ¦·½ÃæµÄÄÜÁ¦³ÉÊì¶È £¬²¢½èÖúÓÚÍþвµý±¨¡¢ËÝÔ´·´Ôì¹¹½¨°²È«ÔËÓªÖÐÐĵÄ×Ô¶¯·ÀÓùϵͳ¡£


2017Äê £¬GA»Æ½ð¼×¼¯ÍűãÔÚÐÐÒµÂÊÏÈ¿ª´´ÐÔµØÌá³ö¡°¶ÀÁ¢µÚÈý·½°²È«ÔËÓª¡±¸ÅÏë £¬Îª³ÇÊе±¾Ö»ú¹¹¡¢ÆóÒµ¼°Öǻ۳ÇÊн¨Éè £¬ÌṩÍйÜʽ¡¢±í°üʽµÄ7x24Ó×ʱרҵ°²È«ÔËÓª·þÎñ £¬Îª³ÇÊдòÔìרְµÄÍøÂç¿Õ¼ä°²È«Ó¦¼±ÏìÓ¦ÖÐÐÄ £¬Ìá¸ßÕë¶Ôµ±¾Ö»ú¹¹¡¢ÆóÒµ¼°ÍøÂç¿Õ¼ä·çÏÕÊÂÎñµÄ·¢ÏÖÓëÏìÓ¦ÄÜÁ¦¡¢¼ÓÇ¿¶ÔDZÔÚÈëÇֵļà²âºÍµ÷²éÄÜÁ¦,ÓÉÇøÓòÐÔµÚÈý·½°²È«ÔËÓªÖÐÐÄΪ³ÇÊÐÌṩרҵµÄÍйÜʽ°²È«·þÎñ £¬ÊÇÓÐЧÌáÉý³ÇÊÐÍøÂ簲ȫÄÜÁ¦µÄ·½Ê½ £¬Êǽâ¾ö°²È«ÄÜÁ¦½»¸¶¡°×îºóÒ»¹«ÀµÄ×î¼ÑÑ¡Ôñ £¬½üÄêÀ´Öð²½³ÉΪ¹úÄÚ±íÍøÂ簲ȫ²úÒµ·¢Õ¹µÄ³ÁÒª·½Ïò¡£


GA»Æ½ð¼×¼¯ÍŰ²È«ÔËÓªÖÐÐÄÔÚʵ¼ÊÖÐÒýÈëATT&CKÄ£ÐÍ £¬²»ÐÝ»ã×ܺÍÊä³ö·ÖÆçµÄ°²È«ÄÜÁ¦ £¬²¢ÔÚÂ䵨µÄ¹ý³ÌÖÐÉî¶È½áºÏÈËΪÖÇÄܼ¼ÊõºÍ°²È«·ÖÎö¼¼Êõ £¬²»ÐÝÌáÉý°²È«ÔËÓªµÄÖÎÀíˮƽ £¬Í¨¹ýÐÐÒµ³ß¶ÈÀ´¹æ·¶»¯Êä³ö°²È«ÔËÓªÖÐÐÄÔËÓª¾ç±¾¡¢ATT&CKÈëÇÖÄ£Ðͺ͸߽×Íþвµý±¨ £¬¾«×¼¶¨Î»°²È«ÊÂÎñ £¬ÌáÉý°²È«ÊÂÎñÏìÓ¦ºÍ´ëÖÿìÂÊ¡£