Listen to this Post
MITRE ATT&CK has released ATT&CK v17, introducing significant updates, including the addition of ESXi as a new platform, renamed Network Devices, and enhanced defensive measures.
🔗 Key Resources:
- Blog Post: https://medium.com/mitre-attack/attack-v17-dfb59eae2204
- ESXi Techniques: https://attack.mitre.org/techniques/
- Network Devices Update: https://attack.mitre.org/platforms/network/
- Enterprise Mitigations: https://attack.mitre.org/mitigations/
- Full Change Log: https://attack.mitre.org/resources/updates/
You Should Know:
1. ESXi Security Commands & Checks
Since ESXi is now part of ATT&CK, hardening your VMware environment is crucial.
🔹 Check ESXi Version:
vmware -v
🔹 List Running VMs:
esxcli vm process list
🔹 Disable Unnecessary Services:
esxcli system service list List services esxcli system service set --enable=false --service=<ServiceName> Disable a service
🔹 Enable Lockdown Mode (Prevents Direct Root Access):
vim-cmd hostsvc/admin/lockdown_mode_enable
2. Network Device Hardening (Routers/Switches)
Since the Network platform is now Network Devices, focus on embedded appliances.
🔹 Cisco IOS (Check Vulnerable Services):
show running-config | include enable|http|snmp|telnet
🔹 Disable Telnet (Use SSH):
configure terminal no enable service telnet line vty 0 4 transport input ssh exit
3. Logging & Threat Hunting with ATT&CK
🔹 Sysmon for Windows (Detect Lateral Movement):
<EventFiltering> <RuleGroup name="ATT&CK Tactic" groupRelation="or"> <ProcessCreate onmatch="include"> <CommandLine condition="contains">psexec</CommandLine> </ProcessCreate> </RuleGroup> </EventFiltering>
🔹 Linux Auditd Rules (Detect File Modifications):
auditctl -w /etc/passwd -p wa -k user_account_changes
4. Mitigation Techniques
🔹 Restrict PowerShell Execution (Windows):
Set-ExecutionPolicy Restricted
🔹 Enable UFW on Linux (Firewall):
sudo ufw enable sudo ufw deny 22/tcp Block SSH if unused
What Undercode Say:
MITRE ATT&CK v17’s inclusion of ESXi highlights the growing need for hypervisor security. Defenders should:
– Monitor VM escape techniques (e.g., CVE-2021-21974).
– Use `esxcli` for ESXi hardening.
– Apply network segmentation to limit lateral movement.
– Leverage ATT&CK’s new mitigations for better defense.
🔹 Expected Output:
- A hardened ESXi environment with disabled unnecessary services.
- Network devices configured to block legacy protocols (Telnet/SNMP).
- Sysmon & Auditd logs aligned with ATT&CK techniques.
Stay updated with MITRE’s latest changes: https://attack.mitre.org/.
References:
Reported By: Mitre Att%26ck – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
