![Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VIDEO]](https://assets.crowdstrike.com/is/image/crowdstrikeinc/video-ATTCK2-1)
![Qatar’s Commercial Bank Chooses CrowdStrike Falcon®: A Partnership Based on Trust [VIDEO]](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Edward-Gonam-Qatar-Blog2-1)
![Endpoint Protection and Threat Intelligence: The Way Forward [VIDEO]](https://assets.crowdstrike.com/is/image/crowdstrikeinc/GK-Blog_Images-1)
- The CrowdStrike Falcon® platform delivers 100% prevention across all nine steps in the MITRE Engenuity ATT&CK® Enterprise Evaluation
- CrowdStrike extends endpoint and workload protection by fully integrating threat intelligence into the Falcon platform — CrowdStrike Falcon® Intelligence enables CrowdStrike users to pivot seamlessly from detections to the latest intelligence on today’s adversaries, including their motivation and tradecraft
- Falcon Intelligence helps organizations save time by automatically analyzing potential malware with built-in sandbox technology, finding and analyzing related malware samples, and enriching the results with industry-leading threat insights
- Falcon Intelligence provided enriched detections throughout eight MITRE Engenuity ATT&CK Evaluation tactics and 18 techniques
Scoring 96% percent visibility of substeps across all 19 steps and 109 substeps, the Falcon platform leveraged the intelligence automation capabilities of FalconIntelligence
to deliver additional enriched detections and indicators of compromise on 8 tactics and 18 techniques used by the two persistent adversaries. Security doesn’t stop at the first alert. Falcon Intelligence offers new context on the who, what, why and how behind a security alert. It gives meaning to each alert an analyst works on, helping them prioritize which alerts to handle first and understand detailed insights into the attacker, motivation and methods — like the two emulated by MITRE Engenuity. Falcon Intelligence helps protect against future attacks by providing context, attribution and information on how to stop the next actor or malware campaign. Falcon Intelligence does this by exposing known attack vectors, identifying related malware and malware techniques that have been seen in the past, or predicted for the future, and sharing this information with your security team and across your security devices. All of this investigation and analysis happens without you having to do anything except review the results. You save time, you know your priorities and you can trust your responses to be error-free. Most importantly, you are provided with detailed information on how to protect against future attacks from these adversaries.
Outpace the Adversary with Ready-to-Go Integration and Automation
Throughout the MITRE Engenuity ATT&CK Enterprise Evaluation, the Falcon platform leveraged its native automation capabilities. Typically, when a file-based attack is blocked on the endpoint by CrowdStrike Falcon® Prevent next-generation antivirus, it is automatically sent to Falcon Intelligence for malware analysis and detonated in a safe environment. In this case, since MITRE Engenuity prohibits blocking in the detection portion of the test, we used custom indicator of attack (IOA) detection monitoring that triggered an automated workflow in CrowdStrike Falcon® Fusion, the Falcon platform’s natively integrated security orchestration, automation and response (SOAR) framework.
Figure 1. Falcon Fusion workflow (Click to enlarge)Falcon Intelligence Delivers Key Intelligence to Identify the Attack and Understand Attacker Tactics
Detonating binaries in Falcon Intelligence helps uncover the behavior of suspicious files and extract more information than is possible on the endpoint. This enables users to identify additional IOCs and known adversarial tactics, and hunt for secondary payloads, making it difficult for adversaries to bypass detection by changing the file used for initial access. Figure 2 shows the Falcon Intelligence file analysis report for a file used in substep 1.A.2 (part of the WIZARD SPIDER Initial Compromise emulation scenario). The ChristmasCard.docm file is malicious, with a threat score of 100/100. At the same time, Falcon Intelligence also detected that the file had macro execution triggered on opening. Along with this information, Falcon Intelligence has successfully identified and mapped the dynamic behavior of the file to MITRE tactics, techniques and procedures (TTPs). With this enriched information, analysts can search for processes exhibiting similar technique IDs (TIDs).
Figure 2. Falcon Intelligence report for WIZARD SPIDER malicious payload in the Initial Compromise emulation scenario (Click to enlarge)
Figure 3. Falcon Intelligence detonation report highlighting process details and extracted strings (Click to enlarge)Stop Breaches with the Right Tools and the Right Information at the Right Time
Security analysts are not short on data or tools. Threat intelligence must be integrated directly into their daily workflow and, more importantly, be available when new evidence is discovered. Security teams often use the term “pivot to intelligence,” which illustrates this process of understanding the full context of a newly discovered threat alert. Having the latest intelligence such as adversary motivation and known attack methods at your fingertips reduces time and complexity of the remediation effort. Falcon Intelligence enriches the events and incidents detected by the Falcon platform, automating intelligence so security operations teams can make better, faster decisions. All security teams, regardless of size or sophistication, can learn from the attacks in their environment, and can apply that knowledge to proactively prevent future attacks. CrowdStrike shuts down attacks before they can start by delivering powerful capabilities like identity-based security, comprehensive indicators of attack (IOAs), machine learning, automated orchestration and Falcon Intelligence threat intelligence through a unified, cloud-native platform. This integrated approach provides analysts with the right tools and threat intelligence to understand and defend against future attacks — and demonstrated excellent value throughout the MITRE Engenuity ATT&CK Enterprise Evaluation.Additional Resources
- Read more about CrowdStrike’s evaluation results in this blog: CrowdStrike Achieves 100% Prevention in Recent MITRE Engenuity ATT&CK Evaluation Emulating Russia-based Threat Groups
- To find out more about how to incorporate intelligence on threat actors into your security strategy, visit the CrowdStrike Falcon® Intelligence page.
- Download the white paper: Supercharge Your SOC by Extending Endpoint Protection with Threat Intelligence
- Check out the CrowdStrike Falcon® Intelligence demo in our Tech Center.
- Get a full-featured free trial of CrowdStrike Falcon® Intelligence and learn how to get ahead of your attackers next move.
