Hello, welcome to the Thursday, April 28, 2020 edition of the Sandsenet Storm Center's Stormcast. My name is Johannes Ulrich,

and today I'm recording from Jacksonville, Florida. Jan today took a look at a change made in the

version 11 of the Mider Attack Framework was released earlier this week.

And one of the changes here is that we now have an updated list of data sources that are relevant to detect a particular technique.

Of course, one way how the attack framework is often used is that you're looking at a particular technique being used by an adversary.

And then you try to figure out how to detect a use of this particular technique in your environment.

That's exactly where sort of these data sources come in, makes it now a little bit more straightforward to map a particular

technique to certain detection techniques that you may want to apply in order to detect

exploitation. Talking about TTPs, Microsoft has released a nice report summarizing attacks that they have observed in Ukraine so far

since the war with Russia started.

Now, there was a very spur of activity in the very beginning.

Week 1, they counted 22 incidents where an incident basically is an

organization being affected, not an individual system. Since then, it has actually become a little

more quiet with sort of two to six events per week. Overall, the numbers aren't really all that bad, in my opinion.

They're fairly small, but they're very focused on government organizations, of course,

and with that also on IT service providers, which of course are often used then in order

to gain access to, for example, government networks.

There were, of course, also a couple of ICS-related events, most recently, of course, in the Destroyer 2.

Another interesting part about this report is they sort of have some nice timelines comparing, for example,

military kinetic activity to cyber activity and also political events and cyber activity

and how the two sort of match up and intertwine.

The most visible part here was, of course, the wipers that were used to just destroy data, but there

...