Shield Active Defense

MITRE | SHIELD Per the website, "Shield is an active defense knowledge base MITRE is developing to capture and organize what we are learning about active defense and adversary engagement. Derived from over 10 years of adversary engagement experience, it spans the range from high level, CISO ready considerations of opportunities and objectives, to practitioner friendly discussions of the TTPs available to defenders."

The U.S. Department of Defense defines active defense as “The employment of limited offensive action and counterattacks to deny a contested area or position to the enemy.”

Shield Active Defense is similar to the ATT&CK® Matrix, but the tactics and techniques provided to us enable us to trap and/or engage (with) an adversary active within the network. For example, we can plant decoy credentials on a resource and monitor if/when the account's credentials are used elsewhere within the network. By doing this, we are alerted to the adversary's presence and provides the opportunity to learn about their tools and tactics. The information that is gathered can be classified as threat intelligence. If you haven't done so, navigate to the Shield website. Across the Shield (Active Defense Matrix) top are the tactics, similar to the ATT&CK® Matrix.

Each column will list the techniques associated with each tactic (again, as the ATT&CK® Matrix). By clicking on any column headers, we will be redirected to a page providing more information.

Let's click on Collect. At this point, we should already be familiar with how MITRE displays the information to us. Here we see a brief definition of tactic, Collect, and associated ID along with the list of techniques, each with a brief description.

Click on DTE0012 - Decoy Credentials.

Aside from the summary, we are provided with Opportunities, Use Cases, and Procedures to perform this technique. Also, note that this technique maps to other Shield tactics (yes, I will repeat it - this is also the case with the ATT&CK® Matrix). Finally, at the bottom is listed the ATT&CK® Techniques associated with this Shield Technique.

Exploring the navigation options across the top links are provided to us to view the Shield Tactics and Techniques as individual pages. This view is good if you want a summary of each at a glance.

Under ATT&CK® Mapping Overview (in our case) for Initial Access [TA0001], the table lists the ATT&CK® Techniques and hints (opportunities) on how to use the suggestive Active Defense Technique in our environment.

That should be enough of an overview. Now to practice using this tool by answering the questions below.

Which Shield tactic has the most techniques?

Is the technique 'Decoy Credentials' listed under the tactic from question #1? (Yay/Nay)

Explore DTE0011, what is the ID for the use case where a defender can plant artifacts on a system to make it look like a virtual machine to the adversary?

Based on the above use case, what is its ATT&CK® Technique mapping?

Continuing from the previous question, look at the information for this ATT&CK® Technique, what 2 programs are listed that adversary's will check for?