中圖分類號： TP309.1
文獻標識碼： A
DOI： 10.19358/j.issn.2096-5133.2021.12.003
引用格式： 何樹果，袁瑗，朱震，等. 基于ATT&CK框架的域威脅檢測[J].信息技術與網絡安全，2021，40(12)：15-18，25.

Domain threat detection based on ATT&CK framework

Abstract： It has always been one of the challenges faced by security researchers about how to ensure the security of sensitive information and data in the enterprise domain environment. In response to this problem, it is proposed to combine the attack behavior knowledge base provided by the ATT&CK framework with the domain security defense to fully cover the domain security-related tactics and technologies involved in ATT&CK. Real-time log data generated in a simulated environment is analyzed, and sensitive log events and continuous abnormal log events are monitored and captured. Finally, technical personnel in the security field are organized to conduct a red-blue exercise. The results of the exercise show that under the guidance of the ATT&CK framework, the domain attack posture can be well detected.

Key words : ATT&CK framework；domain penetration；domain security；threat intelligence