Listen to this Post
Introduction:
The cybersecurity landscape has a new, indispensable report card. MITRE has released its 2025 ATT&CK Evaluations, marking a watershed moment by introducing the first-ever cloud adversary emulation and testing defenses against the ruthless Scattered Spider gang and the stealthy Mustang Panda espionage group. This year’s results are more than a vendor scoreboard; they are a blueprint for defending against modern, cross-domain attacks that seamlessly traverse from on-premises endpoints to cloud control planes, challenging the very architecture of traditional security.
Learning Objectives:
- Understand the two advanced adversary scenarios (Scattered Spider & Mustang Panda) and the new cloud & reconnaissance techniques tested in the 2025 evaluations.
- Learn how to map AWS native security services and logs to MITRE ATT&CK techniques for practical threat detection.
- Develop strategies to implement high-fidelity detection and automate response, reducing alert fatigue in Security Operations Centers (SOCs).
You Should Know:
- The New Battlefield: Cloud Control Plane & Early Reconnaissance
For the first time, MITRE’s evaluation forced vendors to defend the cloud control plane—the web consoles and APIs where infrastructure is managed—simulating Scattered Spider’s theft of AWS credentials and lateral movement through an environment. Additionally, the new inclusion of the Reconnaissance tactic tests the ability to catch adversaries as they map your digital assets, providing a critical early warning.
Step‑by‑step guide to monitoring for initial access in AWS:
The first step of any attack, including those emulated by MITRE, is Initial Access. In AWS, this often involves compromised credentials or exploiting public-facing services. You must monitor the following logs to establish a baseline and detect anomalies.
Primary Log Source: AWS CloudTrail
CloudTrail is your audit trail for all API calls. To capture critical login events, ensure your trail is configured to log management events across all regions. Key events to alert on include:
ConsoleLogin: Especially those with `”responseElements”: {“ConsoleLogin”: “Failure”}` followed by a success from the same IP.
AssumeRole: This API call is used to obtain temporary credentials for an IAM role. Monitor for `AssumeRole` calls from unfamiliar geographic locations or at unusual times.
Automated Threat Detection: Amazon GuardDuty
Enable GuardDuty across all accounts and regions. It automatically analyzes CloudTrail logs, VPC Flow Logs, and DNS logs. It will generate findings for techniques like:
UnauthorizedAccess:IAMUser/AnomalousIPCaller: An API call from an IP address not previously observed for the user.
InitialAccess:IAMUser/AnomalousBehavior: For anomalous credential use indicative of a compromise.
Recon:EC2/PortScan: For detection of early-stage reconnaissance activity against your EC2 instances.
- Mapping Your Defenses: Aligning AWS Services to the MITRE Framework
MITRE ATT&CK provides a common language for threats; your defense requires a mapped response. AWS and MITRE’s Center for Threat-Informed Defense have collaborated on projects to map native AWS security controls to specific ATT&CK techniques, empowering you to make threat-informed decisions.
Step‑by‑step guide to building a MITRE-informed AWS security posture:
Use a structured approach to align your cloud security lifecycle with the MITRE frameworks—ATT&CK for detection, D3FEND for prevention, and Engage for deception.
- Prevention (D3FEND): Start by implementing preventive, least-privilege controls. Use AWS IAM policies and Service Control Policies (SCPs) in AWS Organizations to create an identity perimeter, preventing actions like creating new admin users from a compromised account. Implement AWS WAF to protect web applications.
- Detection (ATT&CK): Centralize your logs for ATT&CK-based analytics. Use Amazon Security Lake to aggregate logs from AWS services, on-premises systems, and third-party applications into a purpose-built data lake in your account. This data can then be queried by Amazon Athena or analyzed by Amazon Detective to map activities to ATT&CK techniques during an investigation.
- Deception & Response (Engage): Consider proactive engagement strategies. Use AWS Secrets Manager to store “honey tokens”—decoy credentials that trigger alerts when accessed. Automate response to confirmed threats using AWS Lambda and Step Functions to execute containment playbooks, such as automatically isolating a compromised EC2 instance.
-
The Identity Battle: Detecting Lateral Movement and MFA Bypass
A core technique of Scattered Spider, emulated in the evaluations, is abusing compromised valid accounts and bypassing Multi-Factor Authentication (MFA) to move laterally. This activity is designed to look like normal user behavior, making signature-based detection useless.
Step‑by‑step guide to detecting anomalous identity behavior:
You need behavioral analytics that correlate identity events with endpoint and cloud activity.
Monitor Authentication Patterns: Use your identity provider (like AWS IAM Identity Center or Azure AD) logs or a security solution to baseline normal login times, locations, and devices for each user. Alert on impossible travel scenarios (logins from two geographically distant locations in an implausibly short time).
Correlate Identity with Cloud Actions: A user logging in is normal. That same user suddenly making a rare `RunInstances` API call in AWS five minutes later is not. Use a SIEM or XDR platform to create correlation rules that link authentication events from CloudTrail (ConsoleLogin) with high-privilege management API calls.
Leverage Specialized Tools: Solutions like CrowdStrike Falcon Next-Gen Identity Security, highlighted in the evaluations, are designed to profile normal user access patterns and detect the anomalous lateral movement from managed and unmanaged devices that traditional tools miss.
4. From Noise to Signal: Achieving High-Fidelity Detection
A major advancement in the 2025 evaluation framework was its rebalanced emphasis on protection and high-fidelity alerts to reduce alert fatigue. The goal is not just to detect every technique, but to provide contextual, actionable alerts that a SOC analyst can act upon immediately.
Step‑by‑step guide to tuning for high-fidelity alerts:
Move beyond isolated alerts to a narrative of the attack.
- Prioritize Technique-Level Detections: As outlined in the evaluations, a “Technique” level detection identifies activity at the specific ATT&CK sub-technique level (e.g.,
T1110.003 - Password Spraying), providing the “how” and “why” context that is critical for fast response. Configure your tools to achieve this level of specificity. - Implement Cross-Domain Correlation: A failed login (identity), a subsequent suspicious PowerShell execution (endpoint), and an unusual outbound connection to a new IP (network) are weak signals alone but form a clear attack chain when correlated. Use a platform that can unify these telemetry sources into a single timeline or case.
- Leverage AI for Behavioral Analysis: To detect living-off-the-land (LOLBin) attacks and legitimate tool abuse, as used by Mustang Panda, you need AI-driven behavioral analysis that understands the intent behind an action, not just the binary being run. This is key to preventing false positives on legitimate administrative activity.
-
The Linux & Cloud Instance Playbook: Critical Commands for Hunters
The Scattered Spider scenario explicitly involved Linux devices and AWS exploitation. Security hunters and cloud engineers need to know what to look for on a potentially compromised instance.
Step‑by‑step guide for investigating a suspicious Linux/EC2 instance:
When alerted to a potentially compromised cloud instance, follow this investigative sequence.
Step 1: Preserve & Isolate. Before logging in, capture a snapshot of the instance’s EBS volume for forensics. If your security tool supports it (as CrowdStrike Falcon Cloud Security demonstrated in the evaluation), deploy a lightweight sensor to the instance for runtime visibility and containment. Network-isolate the instance by placing it in a security group that allows no inbound traffic and only necessary outbound traffic to your SIEM or logging destination.
Step 2: Investigate User & Process Activity.
Check for anomalous users: `cat /etc/passwd | grep -E “/bin/(bash|sh)”`
Review command history for all users: `for user in $(ls /home); do echo ” $user “; sudo -u $user -i — cat ~/.bash_history 2>/dev/null; done`
List all running processes in a tree format to see parent-child relationships: `ps auxf`
Look for hidden processes by comparing `ps` output with the `/proc` directory: `ls -la /proc/[0-9]/exe 2>/dev/null | grep deleted`
Step 3: Check Network Connections & Persistence.
List all network connections: `ss -tulpan`
Check for unauthorized cron jobs: `sudo ls -la /etc/cron`
Examine systemd services for suspicious ones: `systemctl list-unit-files –state=enabled`
Look for unauthorized SSH keys: `cat ~/.ssh/authorized_keys`
What Undercode Say:
The Bar Has Been Raised, Not Just Tested: The 2025 evaluations are not a simple repeat of past tests. By integrating cloud, identity, and reconnaissance into a seamless cross-domain attack chain, MITRE has fundamentally updated the minimum standard for what constitutes an enterprise-grade security platform. Vendors who treat this as a checkbox exercise will be left behind.
Beware the 100% Mirage: While vendors like CrowdStrike, Trend Micro, and Sophos proudly announced 100% detection or protection rates, independent experts like Forrester’s Allie Mellen caution that such claims can be misleading. They may result from unrealistic product configurations or selective interpretation of results. The true value lies not in the headline percentage, but in the detailed, technique-level context and the real-world operational efficiency demonstrated in the public MITRE data.
The 2025 MITRE results underscore a pivotal shift from point-in-time detection to continuous, cross-domain protection. The future of security operations lies in platforms that can autonomously correlate weak signals across identity, endpoint, and cloud to form a definitive attack story, and then automate a significant portion of the response. This will evolve SOC analysts from alert triagers to orchestration commanders. Furthermore, the explicit mapping of cloud provider native controls (like AWS services) to the ATT&CK framework will become a standard part of cloud security postures, closing the gap between cloud infrastructure and security teams. The vendors that withdrew this year will face increasing pressure to demonstrate equivalent real-world efficacy, as the industry increasingly uses these evaluations as a critical, transparent benchmark for capability, not just marketing.
▶️ Related Video:
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Adan %C3%A1lvarez – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
