Becoming a Dark Knight: Adversary Emulation Demonstration for ATT&CK Evaluations

Presented at BSidesLV 2023, Aug. 8, 2023, 6 p.m. (45 minutes)

Batman once said, "you either die a hero or live long enough to see yourself become the villain." What if there was a way to become a cyber villain for the greater good? For the last 5 years, the MITRE ATT&CK Evaluations team has been improving the industry by "becoming the villain." Using a Latin American APT as our real-world villain, this talk will showcase how to merge CTI and red development capabilities for adversary emulation.

Presenters:

• Kate Esprit
  Kate Esprit is a Senior Cyber Threat Intelligence Analyst at MITRE and is the author of the Phishing for Answers cybersecurity blog. With over 7 years of experience in information security, Kate's career highlights include: combatting misinformation at Facebook/Meta, dispatching aircrafts for emergency evacuations during Hurricane Maria, and working for Amnesty International in Argentina. She specializes in Latin American affairs and speaks Spanish and Portuguese. Outside of work, Kate is usually practicing her salsa dancing moves or baking delicious treats.
• Cat Self
  Cat Self is an Adversary Emulation Engineer for MITRE ATT&CK® Evaluations, macOS/Linux Lead for ATT&CK® and serves as a leader of people at MITRE. Cat started her cyber security career at Target and has worked as a developer, internal red team engineer, and threat hunter. Cat is a former military intelligence veteran and pays it forward through mentorship, blogging, and public speaking. Outside of work, she is often planning an epic adventure, climbing mountains in foreign lands, or learning Chinese.

Links:

• https://www.bsideslv.org/talks#VRJDEC

Similar Presentations:

• CHCon '20 (2020) / ATT&CK'ing it wrong - how to use ATT&CK effectively at an NZ scale
• BSidesDC 2019 / Keeping CTI on Track: An Easier Way to Map to MITRE ATT&CK
• Objective by the Sea version 4.0 (2021) / Becoming a Yogi on Mac ATT&CK with OceanLotus Postures