Identifying and Mitigating Threats

The MITRE ATT&CK® framework has mapped data sources and mitigations, where applicable, to each of the techniques detailed in the ATT&CK for Enterprise knowledge base. These have been validated in terms of external actors, but the Center research team behind the Insider Threat Knowledge Base is validating these for their applicability to insider threats as well. The Center team is working under the assumption that many or most of the mitigations and data sources listed will help both efforts, but that there will likely be some differences or additional data sources and mitigations for insider threat.

Mitigations

Mitigations have been identified through their mappings to ATT&CK® TTPs and through validation by Center participants. Currently all insider threat TTPs within the Knowledge Base are also TTPs in ATT&CK, therefore the team has reviewed all corresponding mitigations defined in ATT&CK. All mitigations for ATT&CK for enterprise are relevant to insider threats. Through discussion with project participants, further mitigations may be identified in the future. The table below details the tactic, technique, and mitigation mappings specific to insider threat.

Techniques and Mitigations

Technique ID	Mitigation IDs
T1595	M1056
T1595.001	M1056
T1585	M1056
T1078	M1027, M1018, M1026, M1013, M1017, M1015, M1036
T1078.002	M1032, M1026, M1017
T1106	M1038, M1040
T1136	M1030, M1028, M1032, M1026
T1136.001	M1032, M1026
T1546
T1546.003	M1018, M1026, M1040
T1133	M1030, M1042, M1035, M1032
T1078	M1027, M1018, M1026, M1013, M1017, M1015, M1036
T1078.004	M1027, M1015, M1026, M1032, M1036, M1017, M1018
T1078.002	M1032, M1026, M1017
T1548	M1038, M1028, M1052, M1026, M1018, M1047, M1022
T1562	M1054, M1018, M1038, M1022, M1024, M1047
T1562.001	M1038, M1024, M1018, M1022
T1070	M1041, M1029, M1022
T1070.001	M1022, M1029, M1041
T1070.004
T1036	M1017, M1045, M1040, M1022, M1049, M1038
T1027	M1047, M1040, M1017, M1049
T1078	M1027, M1018, M1026, M1013, M1017, M1015, M1036
T1078.002	M1032, M1026, M1017
T1555	M1026, M1027
T1555.005	M1051, M1054, M1027
T1046	M1042, M1031, M1030
T1135	M1028
T1210	M1042, M1016, M1050, M1030, M1019, M1048, M1026, M1051
T1021	M1018, M1042, M1032
T1021.001	M1047, M1035, M1030, M1028, M1042, M1018, M1032, M1026
T1021.004	M1042, M1032, M1018
T1560	M1047
T1560.001	M1047
T1119	M1029, M1041
T1213	M1017, M1018, M1047
T1213.003	M1017, M1047, M1018, M1032
T1213.002	M1047, M1018, M1017
T1005	M1057
T1074
T1074.001
T1114	M1032, M1041, M1047
T1114.001	M1041
T1219	M1038, M1037, M1031
T1048	M1030, M1057, M1037, M1031, M1022, M1018
T1048.001	M1037, M1031, M1030
T1011	M1042, M1028
T1011.001	M1042, M1028
T1052	M1057, M1034, M1042
T1052.001	M1042, M1034, M1057
T1567	M1021, M1057
T1567.002	M1021
T1485	M1053
T1529
T1589	M1056
T1650	M1056
T1588	M1056
T1588.002	M1056
T1199	M1032, M1018, M1030
T1098	M1030, M1018, M1032, M1026, M1028
T1098.005	M1032
T1070	M1041, M1029, M1022
T1078.001	M1027
T1552	M1041, M1051, M1017, M1015, M1027, M1028, M1037, M1022, M1035, M1047, M1026
T1552.008	M1047, M1017
T1046	M1042, M1031, M1030
T1016
T1016.001
T1039
T1113
T1565	M1041, M1029, M1030, M1022
T1565.001	M1022, M1029, M1041
T1561	M1053
T1561.001	M1053
T1657	M1017, M1018
T1496

Download Table CSV

Data Sources

Data sources that are useful for providing relevant information for insider threat identification have been detailed. Identifying the most common data sources to detect insider threat will enhance the community’s ability to mitigate insider threats. The data sources have been identified first through mappings from ATT&CK, like the mitigations, with follow-on confirmation from project participants. The table below details the tactic, technique, and data source mappings specific to insider threat.

Techniques and Data Sources

Technique ID	Datasource IDs
T1595	DS0029
T1595.001	DS0029
T1585	DS0029, DS0021
T1078	DS0028, DS0002
T1078.002	DS0002, DS0028
T1106	DS0009, DS0011
T1136	DS0009, DS0017, DS0002
T1136.001	DS0002, DS0009, DS0017
T1546	DS0011, DS0005, DS0022, DS0024, DS0017, DS0025, DS0009
T1546.003	DS0009, DS0017, DS0005
T1133	DS0029, DS0028, DS0015
T1078	DS0028, DS0002
T1078.004	DS0002, DS0028
T1078.002	DS0002, DS0028
T1548	DS0009, DS0002, DS0017, DS0022, DS0024
T1562	DS0022, DS0025, DS0018, DS0017, DS0012, DS0009, DS0024, DS0019, DS0002, DS0013, DS0027
T1562.001	DS0013, DS0009, DS0019, DS0024, DS0017, DS0027
T1070	DS0003, DS0022, DS0018, DS0002, DS0009, DS0015, DS0017, DS0024, DS0029
T1070.001	DS0017, DS0022, DS0009
T1070.004	DS0017, DS0022
T1036	DS0022, DS0009, DS0019, DS0007, DS0003, DS0017
T1027	DS0005, DS0012, DS0022, DS0011, DS0017, DS0009, DS0024
T1078	DS0028, DS0002
T1078.002	DS0002, DS0028
T1555	DS0022, DS0017, DS0009, DS0025
T1555.005	DS0009, DS0022, DS0017
T1046	DS0029, DS0017, DS0025
T1135	DS0009, DS0017
T1210	DS0029, DS0015
T1021	DS0011, DS0029, DS0017, DS0033, DS0005, DS0028, DS0009
T1021.001	DS0029, DS0028, DS0009
T1021.004	DS0028, DS0009, DS0029
T1560	DS0017, DS0012, DS0009, DS0022
T1560.001	DS0009, DS0017, DS0022
T1119	DS0017, DS0022, DS0012
T1213	DS0028, DS0015
T1213.003	DS0015, DS0028
T1213.002	DS0028, DS0015
T1005	DS0009, DS0012, DS0017, DS0022
T1074	DS0022, DS0024, DS0017
T1074.001	DS0022, DS0024, DS0017
T1114	DS0028, DS0015, DS0029, DS0022, DS0017
T1114.001	DS0022, DS0017
T1219	DS0009, DS0029
T1048	DS0010, DS0029, DS0017, DS0015, DS0022
T1048.001	DS0029, DS0017, DS0022
T1011	DS0029, DS0022, DS0017
T1011.001	DS0029, DS0017, DS0022
T1052	DS0022, DS0016, DS0009, DS0017
T1052.001	DS0009, DS0016, DS0022, DS0017
T1567	DS0029, DS0017, DS0022, DS0015
T1567.002	DS0029, DS0022, DS0017
T1485	DS0020, DS0009, DS0022, DS0007, DS0030, DS0034, DS0010, DS0017
T1529	DS0009, DS0013, DS0017
T1589	DS0029
T1650
T1588	DS0037, DS0004, DS0035
T1588.002	DS0004
T1199	DS0028, DS0029, DS0015
T1098	DS0017, DS0009, DS0026, DS0022, DS0036, DS0002
T1098.005	DS0015, DS0026, DS0002
T1070	DS0003, DS0022, DS0018, DS0002, DS0009, DS0015, DS0017, DS0024, DS0029
T1078.001	DS0028, DS0002
T1552	DS0024, DS0015, DS0017, DS0009, DS0022, DS0002
T1552.008	DS0015
T1046	DS0029, DS0017, DS0025
T1016	DS0017, DS0012, DS0009
T1016.001	DS0009, DS0017
T1039	DS0033, DS0017, DS0029, DS0022
T1113	DS0017, DS0009
T1565	DS0009, DS0029, DS0022
T1565.001	DS0022
T1561	DS0027, DS0016, DS0017, DS0009
T1561.001	DS0016, DS0027, DS0017, DS0009
T1657	DS0015
T1496	DS0029, DS0022, DS0013, DS0009, DS0017

Download Table as CSV