Build Your Zombie Survival Kit: Threat-Informed Defence for Real-World Attacks

Build Your Zombie Survival Kit: Threat-Informed Defence for Real-World Attacks

Speakers: Kade, Founder, Arachnne Digital

Conference: CHCon

YouTube: https://www.youtube.com/watch?v=Mblhv-O2T3U

Overview

In an engaging and highly relevant talk titled "Build Your Zombie Survival Kit: Threat-Informed Defence for Real-World Attacks," Kade, Founder of Arachnne Digital, challenged conventional cybersecurity wisdom, drawing a compelling analogy between evolving zombie threats and the rapidly changing cyber threat landscape. Kade argued that just as zombies evolved from slow, shambling creatures to fast, relentless predators, so too have cyber adversaries become more sophisticated and dynamic, rendering static, outdated defense strategies ineffective.

The core message of the presentation is the critical need for a Threat-Informed Defense strategy. Kade highlighted that many organizations continue to rely on "best practices" established decades ago, akin to preparing for slow zombies when fast ones are already at the gates. This complacency leaves organizations vulnerable to modern attack techniques that are often overlooked or poorly understood. The talk provided a systematic, cyclical approach to building resilient defenses, emphasizing continuous intelligence gathering, proactive defense building, and rigorous testing against real-world adversary tactics, techniques, and procedures (TTPs).

This talk is particularly significant for security professionals who find themselves constantly reacting to new threats rather than proactively preparing for them. By demystifying threat intelligence and providing a practical framework centered around MITRE ATT&CK, Kade empowered the audience to move beyond reactive security measures. The presentation served as a call to action for organizations to re-evaluate their security posture, understand their specific threat actors, and adopt a dynamic defense strategy capable of adapting to the "fast zombies" of today's cyber world.

Background

▶ Watch: Introduction: The Zombie Apocalypse Analogy (0:00)

The premise of Kade’s talk is rooted in a fundamental shift in the cyber threat landscape, paralleled with the evolution of zombies in popular culture. Traditionally, cybersecurity best practices were developed assuming "slow zombies"—predictable, easily detectable threats that could be mitigated with standard, often static, security controls. This era, Kade noted, is epitomized by the 1968 film Night of the Living Dead, where zombies were slow and defenses focused on basic perimeter security. However, just as zombies in films like Return of the Living Dead (1995), 28 Days Later, and World War Z became fast and intelligent, so too have cyber threats accelerated, taking many organizations by surprise.

This analogy underscores a critical problem: many organizations operate with an outdated understanding of adversary capabilities and motivations. They often focus on blocking Indicators of Compromise (IOCs) like malicious IP addresses or file hashes, which Kade argued are merely symptoms, not the underlying TTPs. While IOCs have their place in immediate incident response, they offer little value for strategic or operational planning. The actual problem, Kade explained, is the lack of a systematic approach to understanding and defending against the methods adversaries use to achieve their objectives.

As a stark illustration of this evolving threat, Kade revealed a key finding from Arachnne Digital's analysis of approximately 3,000 real-world attacks: the fastest-growing form of credential theft is the extraction of credentials from web browsers. This trend is driven by a burgeoning info stealer ecosystem. Attackers leverage readily available info stealer malware that has native functionality to exfiltrate saved credentials from popular browsers. This method is highly attractive to adversaries because browsers are ubiquitous, users frequently save credentials for convenience, and, crucially, detection rates for browser credential theft are significantly lower compared to more traditional techniques like using Mimikatz, which often trigger immediate alerts in environments with mature detection capabilities. This example perfectly encapsulates the "fast zombie" problem: a prevalent, effective attack vector that often bypasses traditional defenses due to a lack of awareness and specific detection mechanisms.

Key Findings

▶ Watch: The Continuous Threat-Informed Defense Cycle (4:00)

The central finding presented by Kade is not just a specific technical vulnerability but a broader, foundational insight into the state of cybersecurity and the urgent need for a paradigm shift. The talk effectively highlighted two critical findings:

1. The Rise of Browser Credential Theft: Based on an analysis of roughly 3,000 real-world attacks, Arachnne Digital identified that stealing credentials from web browsers is the fastest-growing form of credential theft. While not necessarily the most prevalent overall, its rapid increase signals a significant shift in adversary preferences. This trend is fueled by the widespread use of info stealer malware, which is designed to automatically extract saved credentials from common web browsers. Attackers favor this method because browsers are almost universally present on target systems, users often save credentials for convenience, and current security defenses frequently lack specific detection capabilities for this type of exfiltration, making it a "no-brainer" for attackers seeking plentiful, easily accessible credentials with low risk of detection.

1. The Imperative for Threat-Informed Defense: The dynamic and evolving nature of threats, exemplified by the browser credential theft trend, underscores the critical inadequacy of static, traditional security practices. Kade argues that assuming "we know what the threats are" is a dangerous fallacy. Instead, organizations must adopt a Threat-Informed Defense strategy, which is defined as "the systematic application of an understanding of adversary tactics, techniques, and procedures (TTPs) to strengthen defenses." This isn't just about patching vulnerabilities or blocking known bad IPs; it's about understanding how adversaries operate and building defenses specifically tailored to mitigate their methods. This systematic approach ensures that defenses are continuously updated, tested, and aligned with the current, real-world threat landscape, moving organizations from a reactive stance to a proactive, adaptive one.

These findings collectively emphasize that effective cybersecurity in the modern era requires a continuous, intelligence-driven cycle that moves beyond atomic indicators and embraces a deep understanding of adversary tradecraft.

Technical Deep Dive

▶ Watch: Gathering Actionable Threat Intelligence (5:35)

Kade's technical deep dive focused on the systematic application of Threat-Informed Defense, outlining a continuous cycle designed to counter evolving threats. This cycle comprises three main phases: Intelligence, Building Defenses, and Testing Defenses, all underpinned by the MITRE ATT&CK framework.

1. Intelligence

Intelligence, often perceived as a "scary dark art," is demystified as "information about the real world that helps a decision maker make a better decision." For cybersecurity, this means understanding:

• Who targets you: Identify threat actors targeting your specific industry and geography (e.g., banks in New Zealand).
• Why they target you: Leverage historical data. As Kade explained, "the way you predict the future is you look at the past." If a hospital was targeted due to sensitive patient data, under-budgeted security, and sensitivity to uptime, these factors are unlikely to change overnight, making it a continuous target.
• How to gather it: Intelligence gathering can range from simple, scheduled news article reviews (e.g., spending a day every six months reviewing industry-specific attacks) to bespoke reports from specialized vendors.

Crucially, intelligence should operate at three levels:

• Strategic: Broad trends in threat actor sophistication and targeting, informing business strategy and security budgeting.
• Operational: Continuous targeting by specific threat actors, guiding Security Operations Center (SOC) managers to ensure coverage for relevant TTPs.
• Tactical: Specific TTP sequences being used, informing threat hunting activities.

Kade strongly differentiated this from mere Indicators of Compromise (IOCs) (IP addresses, file hashes, domains). While IOCs can trigger blocks, they are atomic and don't allow for broader planning or understanding of adversary tradecraft. True intelligence focuses on TTPs.

2. MITRE ATT&CK Framework

The cornerstone of understanding TTPs is the MITRE ATT&CK framework. Kade described it as "a big list of hacking techniques," with the key differentiator being its grounding in real-world attacks. Nothing is added to ATT&CK unless it has been observed in actual incidents. This provides a common language for security professionals to discuss and understand adversary actions.

For each TTP, ATT&CK provides:

• Name and Sub-techniques: Detailed categorization of adversary actions.
• Real-world Grounding: Examples of how the TTP has been used by specific threat groups, providing context.
• Mitigations: Recommended controls to prevent or deter the TTP (e.g., Conditional Access for "Valid Accounts").
• Detections: Specific logging requirements and log fields needed to identify the TTP's occurrence (e.g., logging account login activity for "Valid Accounts").

This framework directly maps observed adversary behavior to actionable defensive measures, making it an invaluable tool for threat-informed defense.

3. Building Defenses

Based on the intelligence and ATT&CK mappings, organizations then build their defenses. This is not solely about technology; it encompasses people, processes, and technology. A critical aspect highlighted by Kade is ensuring that the SOC (whether in-house or outsourced) has the necessary visibility and logs to detect the identified TTPs. Without adequate logging, even the most sophisticated SOC will be blind to relevant threats.

4. Testing Defenses

The cycle's integrity relies on robust testing. This involves red teaming, purple teaming, or adversary emulation. The key here is targeted testing: explicitly validating the defenses built against the specific TTPs identified as relevant from the intelligence phase. Kade emphasized using tools like MITRE Caldera to emulate particular TTPs. The pitfall to avoid is generic "I know how to hack" testing, which may not validate the specific controls put in place to counter known threats. Testing will inevitably uncover issues, leading back to the "Build Defenses" phase, fueled by new intelligence, thus ensuring a continuous improvement loop.

MITRE ATT&CK Flows

Kade also touched upon a recent evolution in the MITRE ATT&CK framework: ATT&CK Flows, released in July. This advancement moves beyond analyzing individual TTPs in isolation to understanding them as chains or sequences of actions. For example, an attacker might "exploit a publicly facing web application," then "scan your network," and subsequently "use SSH to move laterally" to discovered devices. By analyzing these complete attack flows, organizations can build more comprehensive defenses that account for the entire adversary kill chain, rather than just isolated steps. This represents the next frontier in adopting a truly threat-informed defense posture.

Demo / Proof of Concept

▶ Watch: Building and Emulating Defenses Effectively (10:00)

The talk did not feature a live demonstration or proof of concept in the traditional sense, such as a live hack or a technical walkthrough of a specific tool being used to exploit a vulnerability. Instead, Kade used interactive audience engagement, posing a question about the fastest-growing form of credential theft to illustrate the talk's core premise regarding evolving threats. While tools like MITRE Caldera were mentioned as effective for adversary emulation, they were referenced as examples of what can be done, rather than being demonstrated during the presentation. The focus was on the overarching methodology and strategic shift towards Threat-Informed Defense rather than specific technical exploits.

Defensive Implications

▶ Watch: Q&A: MITRE ATT&CK's Public Nature (17:28)

Kade's talk provides crucial, actionable insights for defenders striving to enhance their security posture against modern threats. The defensive implications are clear and demand a shift from reactive, static defenses to a proactive, adaptive Threat-Informed Defense strategy:

1. Prioritize and Systematize Threat Intelligence: Organizations must move beyond generic threat feeds and actively gather intelligence tailored to their specific industry and geographic location. This intelligence should be structured at strategic, operational, and tactical levels, providing actionable insights into relevant adversary TTPs, not just atomic IOCs. Regular reviews (e.g., every six months) of recent attacks in their sector are essential.

1. Embrace MITRE ATT&CK as a Core Framework: The MITRE ATT&CK framework should be adopted as the foundational common language for understanding, mapping, and defending against adversary TTPs. Defenders should leverage its detailed entries for mitigations and detections, ensuring their controls directly address real-world attack techniques. This includes mapping existing security controls to ATT&CK TTPs to identify coverage gaps.

1. Secure Web Browsers and Credentials: Given that credentials from web browsers are the fastest-growing form of credential theft, organizations must implement robust controls. The primary recommendation is to discourage or prohibit saving credentials directly in web browsers. Instead, advocate for and provide secure, dedicated password managers that operate independently of browsers. Furthermore, enforce strong authentication mechanisms like Multi-Factor Authentication (MFA) and Conditional Access policies across all critical systems to mitigate the impact of stolen credentials.

1. Enhance Logging and SOC Visibility: Effective detection of TTPs hinges on comprehensive logging. Defenders must ensure their Security Operations Center (SOC), whether internal or outsourced, has the necessary visibility by collecting the right logs from relevant systems. This includes logging specific fields identified by MITRE ATT&CK for detecting particular TTPs, ensuring that the data required for effective threat detection is available.

1. Implement Targeted Adversary Emulation: Generic penetration testing is insufficient. Defenders need to implement adversary emulation or purple teaming exercises that specifically test their defenses against the known TTPs and attack flows relevant to their organization, as identified through threat intelligence. Tools like MITRE Caldera can facilitate this. The goal is to validate that the built defenses actually function as intended against real-world adversary tradecraft.

1. Adopt a Continuous Improvement Cycle: Cybersecurity is not a one-time project but a continuous process. Organizations must integrate the Threat-Informed Defense cycle—intelligence, build, test, repeat—into their security operations. This iterative approach ensures that defenses are constantly updated, refined, and resilient against an ever-evolving threat landscape, much like continuously updating a "zombie survival kit."

1. Consider MITRE ATT&CK Flows: As a forward-looking step, defenders should begin to incorporate MITRE ATT&CK Flows into their planning. Moving beyond individual TTPs, understanding and defending against entire chains of adversary actions will provide a more holistic and robust defense strategy against complex attacks.

By adopting these implications, defenders can transition from a reactive, "whack-a-mole" approach to a systematic, intelligence-driven defense that is truly prepared for the "fast zombies" of today's cyber threats.

Key Takeaways

• The Threat Landscape is Dynamic: Traditional, static security practices ("slow zombie" defenses) are no longer sufficient against rapidly evolving and sophisticated cyber adversaries ("fast zombies"). Continuous adaptation is paramount.
• Threat-Informed Defense is Essential: Organizations must adopt a systematic, continuous cycle of gathering intelligence on adversary TTPs, building targeted defenses, and rigorously testing those defenses against real-world attack techniques.
• MITRE ATT&CK is the Core Framework: The MITRE ATT&CK framework provides a critical common language and mapping of real-world adversary TTPs to specific mitigations and detections, enabling focused and effective defense strategies.
• Browser Credential Theft is a Growing Threat: Stealing credentials from web browsers is a rapidly increasing and often undetected attack vector, driven by info stealer malware. Organizations must prioritize securing browser-stored credentials and promote secure password management.
• Move Beyond Atomic IOCs: Relying solely on blocking Indicators of Compromise (IOCs) is insufficient for strategic defense planning. Focus on understanding and defending against adversary TTPs for long-term resilience.
• Targeted Testing is Crucial: Generic security testing falls short. Implement adversary emulation (e.g., with MITRE Caldera) to specifically validate that defenses are effective against the TTPs most relevant to your organization.

About the Speaker(s)

Kade is the founder of Arachnne Digital, a threat intelligence firm dedicated to helping organizations understand and defend against real-world cyber threats. With approximately eight years of experience in cybersecurity, Kade is a passionate advocate for Threat-Informed Defense, actively working to evangelize its principles through initiatives like the Threat Informed Defense Alliance. Known for his engaging and accessible communication style, Kade uses relatable analogies, such as the "zombie apocalypse," to highlight critical security concepts. He identifies himself as a "survivor of the zombie apocalypse," underscoring his deep understanding of evolving threats and the practical strategies needed to counter them.