Carbon Black Delivers Zero Delayed Detections And Zero Tainted Detections In The MITRE Assessment

Carbon Black, a provider of next-generation endpoint security delivered via the cloud, announces that it delivered zero delayed detections and zero tainted detections in the MITRE Corporation’s Adversarial Tactics, Techniques and Common Knowledge (ATT&CK) assessment. The MITRE assessment tests the ability to quickly detect specific adversary tactics and techniques as captured in the ATT&CK knowledgebase.

The evaluations for this initial testing period used a MITRE-developed APT3 emulation plan on behavior detection, telemetry and enrichment, among other elements. In the assessment, CB Response demonstrated it could automatically detect and display adversarial behaviours without humans-in-the-loop across the entire MITRE ATT&CK Matrix, which includes: initial access, execution, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, exfiltration, and command and control.

Real-World Attacks

MITRE has set an excellent standard for how testing should be conducted in an open, rigorous, and sophisticated way"

“We’re proud to be among the initial vendors evaluated by MITRE and we’re extremely proud of these results. We attribute our very strong showing to our philosophy of building products the right way for the long haul,” said Scott Lundgren, Carbon Black’s Chief Technology Officer.

“Objective, transparent and open testing is critical as a means of driving the industry forward, and the MITRE ATT&CK framework offers a critical look at how real-world attacks play out. We believe MITRE has set an excellent standard for how testing should be conducted in an open, rigorous, and sophisticated way. We thank MITRE for its leadership.” “We’re very pleased with the participation in our first round of ATT&CK-based evaluations,” said Frank Duff, MITRE lead engineer for the evaluations program.

Endpoint Data Collection

“Effective cybersecurity can’t be done alone. We look forward to continued collaboration with the industry to help vendors understand their capabilities against known adversary behaviors and empower customers to more effectively buy and deploy these security solutions.”

Carbon Black’s MITRE ATT&CK feeds combine the power of Carbon Black’s unfiltered endpoint data collection and a robust collection of adversary techniques

In conjunction with the assessment results, Carbon Black announced it has added MITRE ATT&CK threat intelligence feeds to CB Response and CB ThreatHunter to deliver new behavior-based threat intelligence to customers. Carbon Black’s MITRE ATT&CK feeds combine the power of Carbon Black’s unfiltered endpoint data collection and a robust collection of adversary techniques to simplify threat detection and threat hunting.

Unfiltered view

The new threat feeds map directly to the various attack tactics outlined by MITRE. “By adding ATT&CK threat intelligence feeds to Cb Response and Cb ThreatHunter, organizations now have an unfiltered view into all endpoint activity viewed through the lens of attack building blocks and behaviours noted by MITRE. We believe this results in more comprehensive and advanced threat hunting capabilities for security professionals,” said Lundgren.

“The ATT&CK threat intelligence feeds directly integrate detection of ATT&CK tactics and techniques into the CB Response and CB ThreatHunter products, underscoring Carbon Black’s commitment to ATT&CK and other open standards and frameworks.”