MITRE ATT&CK to evaluate an EDR

How can you leverage the MITRE ATT&CK Evaluations to assess if an EDR meets your threat detection, analysis, and response needs?

Challenge any EDR solution by asking the following critical questions.

What attack tactics and techniques is the EDR able to detect?

Evaluate the EDR alignment with the MITRE ATT&CK Framework to assess how well the solution can identify a diverse array of techniques across different stages of the attack lifecycle, such as:

Weaponization
Delivery
Exploitation
Installation
Collection, Command and Control
Actions on objectives

… and their many sub-techniques.

Mapping the EDR detection capabilities with the MITRE ATT&CK Framework enables teams to identify the solution’s capacity to deliver the required alerts and on which specific attack techniques.

How does the EDR integrate Threat Intelligence and updates?

Is the EDR able to integrate external threat intelligence feeds that include MITRE ATT&CK data – notably with connectors? Is it able to integrate new tactics or techniques into their detection capabilities ?

Organizations change over time; detection needs to evolve alongside them. The ability to contextualize alerts and define priorities in the event of a security incident is paramount.

How does the EDR display reports and data

Reports and dashboards that follow MITRE ATT&CK’s mapping help monitor tactics and techniques set out in this framework.

In addition to enabling specific threat prioritization, it identifies those that weigh most heavily on the organization.

From that perspective, the more the tool gives access to data, the more security events can be contextualized and prioritized, and the more EDR can help investigations.

Our common priority: make it easier for experts to foil attacks

The MITRE ATT&CK Framework is useful for a wide range of cybersecurity players, and MITRE ATT&CK’s evaluation is an internationally recognized test serving as a benchmark for professionals and decision-makers in the cybersecurity industry.

It enables teams to test a tool’s ability to detect attack techniques, but each technique can be executed in many different ways, and it’s challenging for any tool to prevent 100% of them.
Rather than validating a detection list according to a predefined frame of reference, the real stakes hinge on being able to detect any suspicious behavior and respond swiftly and accordingly.

A burglar can (brute) force the door with a crowbar, lockpick, or battering ram… So the most important thing is detecting the abnormal behavior – the intrusion – period. Determining the precise tool the burglar used is secondary.

MITRE should therefore be seen as a way to assess a tool’s ability to accurately detect attack techniques (all it takes is one). Assigning the right level of criticality will prompt defensive action to counter the attacker.

Throughout your POC, you can test the EDR in the field in your own context, backed by MITRE’s guidelines. Ask yourself: Does this tool meet my organization’s needs? Your call, analysts.

Find out more about MITRE ATT&CK to evaluate an EDR: