Interpreting MITRE Engenuity Att&ck evaluations with some Graph Theory.

No ratings

Presented at 0xcon 2024 by

Tswelopele Moshe

Every year MITRE Engenuity runs evaluations for a variety of EDR (and MDR) products. This data is often raw and not very easy to interpret for the consumer. Each vendor has had their own way of interpreting these results. However, Xiangmin Shen et al. (https://dl.acm.org/doi/10.1145/3634737.3645012) introduced a whole-graph analysis method to interpret these data objectively. In particular, this analysis is performed on the various TTPs executed by Mitre Engenuity. The core idea is to measure how well an EDR can reproduce an attack graph of the APT techniques that are executed. Other quantities are introduced to capture other metrics not captured from this whole graph analysis. I will be extending this whole-graph analysis to introduce a more systematic way of deriving the other metrics they introduce within the context of just the TTP graph an EDR product is able reproduce.