Bron metamodel: https://pubs.opengroup.org/architecture/archimate3-doc/chap15.html = MITRE ATT&CK - Techniques: https://attack.mitre.org/techniques/enterprise/ Notatie: [ID] - [Name] (= Threat) = MITRE ATT&CK - Groups: https://attack.mitre.org/groups/ Notatie: [ID] - [Name] Aliassen en land van herkomst in de properties, inclusief de indicatie of het een groep of individu is. Logboek: APT's overgenomen, rest aan te vullen op basis van noodzaak https://attack.mitre.org/techniques/T1003/ https://attack.mitre.org/techniques/T1003/ https://attack.mitre.org/techniques/T1003/ https://attack.mitre.org/techniques/T1003/ https://attack.mitre.org/techniques/T1003/ https://attack.mitre.org/techniques/T1003/ https://attack.mitre.org/techniques/T1003/ https://attack.mitre.org/techniques/T1003/ https://attack.mitre.org/techniques/T1003/ https://attack.mitre.org/techniques/T1021/ https://attack.mitre.org/techniques/T1021/ https://attack.mitre.org/techniques/T1021/ https://attack.mitre.org/techniques/T1021/ https://attack.mitre.org/techniques/T1021/ https://attack.mitre.org/techniques/T1021/ https://attack.mitre.org/techniques/T1021/ https://attack.mitre.org/versions/v8/techniques/T1027/005/ https://attack.mitre.org/techniques/T1046/ https://attack.mitre.org/versions/v8/techniques/T1059/001/ https://attack.mitre.org/versions/v8/techniques/T1068/ Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence. Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems or default factory/provider set accounts on other types of systems, software, or devices. Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services. Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services. Adversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. In some cases, cloud accounts may be federated with traditional identity management system, such as Window Active Directory. https://attack.mitre.org/techniques/T1082/ Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token. Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token. https://attack.mitre.org/versions/v8/techniques/T1204/ https://attack.mitre.org/versions/v8/techniques/T1210 https://attack.mitre.org/versions/v8/techniques/T1547/001/ https://attack.mitre.org/versions/v8/techniques/T1547/001/ https://attack.mitre.org/versions/v8/techniques/T1547/001/ https://attack.mitre.org/versions/v8/techniques/T1547/001/ https://attack.mitre.org/versions/v8/techniques/T1547/001/ https://attack.mitre.org/versions/v8/techniques/T1547/001/ https://attack.mitre.org/versions/v8/techniques/T1547/001/ https://attack.mitre.org/versions/v8/techniques/T1547/001/ https://attack.mitre.org/versions/v8/techniques/T1547/001/ https://attack.mitre.org/versions/v8/techniques/T1547/001/ https://attack.mitre.org/versions/v8/techniques/T1547/001/ https://attack.mitre.org/versions/v8/techniques/T1547/001/ https://attack.mitre.org/versions/v8/techniques/T1547/001/ https://attack.mitre.org/versions/v8/techniques/T1547/001/ https://attack.mitre.org/versions/v8/techniques/T1547/001/ https://attack.mitre.org/versions/v8/techniques/T1566/ https://attack.mitre.org/versions/v8/techniques/T1566/001/ https://attack.mitre.org/versions/v8/techniques/T1566/002/ https://attack.mitre.org/versions/v8/techniques/T1566/003/ Before compromising a victim, adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, etc.) as well as sensitive details such as credentials. Before compromising a victim, adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts Before compromising a victim, adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees. Before compromising a victim, adversaries may gather employee names that can be used during targeting. Employee names be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures. https://attack.mitre.org/versions/v8/techniques/T1546/ https://attack.mitre.org/versions/v8/techniques/T1546/ https://attack.mitre.org/versions/v8/techniques/T1546/ https://attack.mitre.org/versions/v8/techniques/T1546/ https://attack.mitre.org/versions/v8/techniques/T1546/ https://attack.mitre.org/versions/v8/techniques/T1546/ https://attack.mitre.org/versions/v8/techniques/T1546/ https://attack.mitre.org/versions/v8/techniques/T1546/ https://attack.mitre.org/versions/v8/techniques/T1546/ https://attack.mitre.org/versions/v8/techniques/T1546/ https://attack.mitre.org/versions/v8/techniques/T1546/ https://attack.mitre.org/versions/v8/techniques/T1546/ https://attack.mitre.org/versions/v8/techniques/T1546/ https://attack.mitre.org/versions/v8/techniques/T1546/ https://attack.mitre.org/versions/v8/techniques/T1546/ Bron: ArchiMate 2.1 Specification: paragraaf 10.2.3 Bron: https://pubs.opengroup.org/architecture/archimate3-doc/chap15.html Bron: https://support.bizzdesign.com/display/knowledge/Security+deployment Gebruiken voor principes zoals geformuleerd in beleid, bijvoorbeeld "Privacy by Design" of "Separation of Duties" Bron: https://pubs.opengroup.org/architecture/archimate3-doc/chap15.html = ISMS maatregel Notatie: [ID] - [Maatregel] Bron: CISSP: 4 Hoofdgroepen (Avoid, Control, Accept, Transfer), : vast te leggen in Properties Type Control uitwerken in mitigations van Mitre = MITRE ATT&CK - Mitigation: https://attack.mitre.org/mitigations/enterprise/ Notatie: [ID] - [Name] This mitigation describes any guidance or training given to developers of applications to avoid introducing security weaknesses that an adversary may be able to take advantage of. Configure Active Directory to prevent use of certain techniques; use SID Filtering, etc. Vulnerability scanning is used to find potentially exploitable software vulnerabilities to remediate them. Train users to be aware of access or manipulation attempts by an adversary to reduce the risk of successful spearphishing, social engineering, and other techniques that involve user interaction. Manage the creation, modification, use, and permissions associated to user accounts. A threat intelligence program helps an organization generate their own threat intelligence information and track trends to inform defensive priorities to mitigate risk. Break and inspect SSL/TLS sessions to look at encrypted web traffic for adversary activity. Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc. Restrict access by setting directory and file permissions that are not specific to users or privileged accounts. Restrict the ability to modify certain hives or keys in the Windows Registry. Protect processes with high privileges that can be used to interact with critical system components through use of protected process light, anti-process injection defenses, or other process integrity enforcement measures. Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root. Set and enforce secure password policies for accounts. Make configuration changes related to the operating system or a common feature of the operating system that result in system hardening against techniques. Use remote security log and sensitive file storage where access can be controlled better to prevent exposure of intrusion detection log data or sensitive information. Architect sections of the network to isolate critical systems, functions, or resources. Use physical and logical segmentation to prevent access to potentially sensitive systems and information. Use a DMZ to contain any internet-facing services that should not be exposed from the internal network. Configure separate virtual private cloud (VPC) instances to isolate critical cloud systems. Use intrusion detection signatures to block traffic at network boundaries. Use two or more pieces of evidence to authenticate to a system; such as username and password in addition to a token from a physical smart card or token generator. Block users or groups from installing unapproved software. Block users or groups from installing or using unapproved hardware on systems, including USB devices. Prevent access to file shares, remote access to systems, unnecessary services. Mechanisms to limit access may include use of network concentrators, RDP gateways, etc. Configure features related to account use like login attempt lockouts, specific login times, etc. Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic. Block execution of code on a system through application control, and/or script blocking. Prevent modification of environment variables by unauthorized users and groups. Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior. Protect sensitive information with strong encryption. Remove or deny access to unnecessary and potentially vulnerable software to prevent abuse by adversaries. Use capabilities to prevent successful credential access by adversaries; including blocking forms of credential dumping. Loading Prevent abuse of library loading mechanisms in the operating system and software to load untrusted code by configuring appropriate library loading mechanisms and investigating potential vulnerable software. Enforce binary and application integrity with digital signature verification to prevent untrusted code from executing. Use secure methods to boot a system and verify the integrity of the operating system and loading mechanisms. Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses. Restrict execution of code to a virtual environment on or in transit to an endpoint system. Use signatures or heuristics to detect malicious software. Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring. Perform regular software updates to mitigate exploitation risk. Configure Windows User Account Control to mitigate risk of adversaries obtaining elevated process access. Take and store data backups from end user systems and critical servers. Ensure backup and storage systems are hardened and kept separate from the corporate network to prevent compromise. Implement configuration changes to software (other than the operating system) to mitigate security risks associated to how the software operates. This category is to associate techniques that mitigation might increase risk of compromise and therefore mitigation is not recommended. This category is used for any applicable mitigation activities that apply to techniques occurring before an adversary gains Initial Access, such as Reconnaissance and Resource Development techniques. Use a data loss prevention (DLP) strategy to categorize sensitive data, identify data formats indicative of personal identifiable information (PII), and restrict exfiltration of sensitive data. Relatie tussen M1032 en T1204 zit niet in het framework zelf, wel in de navigoter (AK)