Here are just some ways you can leverage our CTI effectively:
Evidence-Based Security Investments
Arachne Digital data enables you to allocate your security budget based on real threats targeting your industry and geography, rather than general threat perceptions. This ensures smarter, cost-efficient security decisions.
Our CTI shows that M1057 Data Loss Prevention mitigates the top TTP seen in attacks on Western Europe, T1005 Data from Local System. The data shows this should be one of your top investments.
Optimise SIEM Performance
Effective Security Information and Event Management (SIEM) relies on ingesting relevant logs. Our intelligence helps you:
- Identify necessary logs for detecting key Tactics, Techniques, and Procedures (TTPs).
- Remove irrelevant logs, significantly reducing SIEM ingestion costs.
For the fourth most common TTP seen in recent attacks on the public sector in Western Europe, T1059.001 PowerShell, here are some of the logs that should be ingested into your security tooling:
- DS0017 logs covering commands run in the environment, specifically capturing command execution.
- DS0011 logs covering modules (portable executable (PE) format binaries, dynamic link libraries (DLL) and others) in the environment, specifically capturing modules being loaded
Enhanced Incident Response and Threat Hunting
Indicators of Compromise (IoCs) without context hinder SOC efficiency. Arachne Digital enriches IoCs by providing:
- Clear IoC validity date ranges.
- Attribution to specific CTAs.
- Associated TTPs, enabling precise threat hunting.
- Direct links to original data sources for full transparency.
This enriched information empowers analysts to swiftly understand and respond to threats.
Realistic Adversary Emulation
Unlike generic red team exercises, Arachne Digital facilitates true adversary emulation by leveraging real-world CTA behaviours, specific TTPs, and malware. This precision ensures your defenses are tested against realistic attack scenarios.
For the public sector in Western Europe, you would want to see the CTAs mentioned in the threat model being emulated.
Quantitative Cyber Risk Management
Shift from qualitative assessments to robust quantitative risk analysis. Using MITRE ATT&CK’s tailored matrices for different technology stacks (Windows, macOS, Linux, Cloud, Network Devices, Containers, and now ESXi), you can accurately assess risk exposure and compromise likelihood based on factual threat occurrence data.
It will vary from device to device and tech stack to tech stack, but risks stemming from the below TTPs seen targeting the public sector in Western Europe should be assessed:
