DeTTECT

Detect Tactics, Techniques & Combat Threats

Latest version: 2.2.0

To get started with DeTT&CT, check out one of these resources:

• This page on the Wiki.
• This blog written by Renaud Frère from NVISO has a comprehensive and recent description on the capabilities of DeTT&CT.
• Blog: mbsecure.nl/blog/2019/5/dettact-mapping-your-blue-team-to-mitre-attack or
• Blog: siriussecurity.nl/blog/2019/5/8/mapping-your-blue-team-to-mitre-attack.

Videos

• Our talk at hack.lu 2019.
• The video from Justin Henderson on data source visibility and mapping.

DeTT&CT aims to assist blue teams in using ATT&CK to score and compare data log source quality, visibility coverage, detection coverage and threat actor behaviours. All of which can help, in different ways, to get more resilient against attacks targeting your organisation. The DeTT&CT framework consists of a Python tool (DeTT&CT CLI), YAML administration files, the DeTT&CT Editor (to create and edit the YAML administration files) and scoring tables for detections, data sources and visibility.

DeTT&CT provides the following functionality for the ATT&CK domains Enterprise, ICS and Mobile:

• Administrate and score the quality of your data sources.
• Get insight on the visibility you have on for example endpoints.
• Map your detection coverage.
• Map threat actor behaviours.
• Compare visibility, detection coverage and threat actor behaviours to uncover possible improvements in detection and visibility (which is based on your available data sources). This can help you to prioritise your blue teaming efforts.
• Get statistics (per platform) on the number of techniques covered per data source.

The coloured visualisations are created with the help of MITRE's ATT&CK™ Navigator. For layer files created by DeTT&CT, we recommend using this URL to the Navigator as it will make sure metadata in the layer file does not have a yellow underline: https://mitre-attack.github.io/attack-navigator/#comment_underline=false&metadata_underline=false

Authors and contributions

This project is developed and maintained by Marcus Bakker (Twitter: @Bakk3rM) and Ruben Bouman (Twitter: @rubinatorz). Feel free to contact, DMs are open. We do appreciate if you ask any question on how to use DeTT&CT by making a GitHub issue. Having the questions and answers over there will greatly help others having similar questions and challenges.

We welcome contributions! Contributions can be both in code and in ideas you might have for further development, usability improvements, etc.

Sponsors

The following parties have supported the development of DeTT&CT in time or financially.

• Rabobank - Dutch multinational banking and financial services company. Food and agribusiness constitute the primary international focus of the Rabobank.

  Significant parts of DeTT&CT have been developed in the time that we worked as contractors at Rabobank.

• Cyber Security Sharing & Analytics (CSSA) - Founded in November 2014 by seven major German companies as an alliance for jointly facing cyber security challenges in a proactive, fast and effective manner. Currently, CSSA has 13 member companies.

  With the financial sponsorship of the CSSA, we added support for ATT&CK ICS to DeTT&CT.

• Dutch National Police. With the financial sponsorship of the Dutch National Police, we added support for ATT&CK Mobile to DeTT&CT.

Work of others

The work of others inspired some functionality within DeTT&CT:

• Roberto Rodriguez's work on data quality and scoring of MITRE ATT&CK™ techniques (How Hot Is Your Hunt Team?, Ready to hunt? First, Show me your data!).
• The MITRE ATT&CK Mapping project on GitHub: https://github.com/siriussecurity/mitre-attack-mapping.

Third party tool: Dettectinator

The Python library to your DeTT&CT YAML files.

Dettectinator is built to be included in your SOC automation tooling. It can be included as a Python library or it can be used via the command line.

Dettectinator provides plugins to read detections from your SIEM or EDR and create/update the DeTT&CT YAML file, so that you can use it to visualize your ATT&CK detection coverage in the ATT&CK Navigator.

More information can be found on Github: Dettectinator.

Example

YAML files are used for administrating scores and relevant properties. All of which can be visualised by loading JSON layer files into the ATT&CK Navigator (some types of scores and properties can also be exported to Excel).

See below an example of mapping your data sources to ATT&CK, which gives you a rough overview of your visibility coverage:

Using the command python dettect.py generic -ds, you can determine which data sources within ATT&CK cover the most techniques. This can, for example, be useful to guide you in identifying which data sources will provide you with a lot of visibility and are hence a good candidate to have available in a SIEM (like) solution.