How best MITRE ATT&CK be used for SIEM usecase built?

Debs — Tue, 01 Jun 2021 13:06:48 GMT

I'm interested to hear the practical usage of MITRE framework on building the SIEM usecase?

Re: How best MITRE ATT&CK be used for SIEM usecase built?

tmekelburg1 — Tue, 01 Jun 2021 13:56:42 GMT

Research what threat actors are targeting your specific industry
APT 29 Cozy Bear, just as an example
Look at the 'Techniques Used' section within APT29 APT29
Start at the top within the field 'ID' with T1548 Abuse Elevation Control Mechanism
Use the 'Detection' section to look at what events need to be monitored and sent to the SIEM
Repeat until all techniques are able to be monitored by the SIEM

Some techniques overlap with other APT groups so I wouldn't use it for attribution necessarily.