Summiting the Pyramid

Project Summary

Published : Sep 13, 2023

Many analytics are dependent on specific tools or artifacts. Adversaries can easily evade these with low-cost changes that exploit the dependencies. This project developed a method to evaluate analytics relative to the adversary’s cost to evade. We further created approaches and tips for defenders to make their analytics less evadable. We demonstrated the methodology with a core set of analytics.

Problem

Adversaries can easily evade cyber analytics that are dependent on specific tools or artifacts.

SOLUTION

Create and apply a methodology to evaluate the dependencies inside analytics and make them more robust by focusing on adversary behaviors.

IMPACT

Shift the advantage towards defenders with improved analytics that catch adversaries even as they evolve and detect future campaigns.

Project Resources:

funding Research Participants

A red square on a black background.

Share This Project

Explore More of Our Work

two yellow cable cars at station

Center For Threat-Informed Defense Project

THREAT REPORT ATT&CK MAPPER (TRAM)

August 28, 2023

A group of people collaborating on an ATT&CK Workbench whiteboard.

Center For Threat-Informed Defense Project

ATT&CK Workbench

August 15, 2023

Blueprints

Center For Threat-Informed Defense Project

CTI Blueprints

Stay Informed

Stay informed about new releases of R&D projects and other exciting updates from the Center for Threat-Informed Defense.