中图分类号： TP309.1
文献标识码： A
DOI： 10.19358/j.issn.2096-5133.2021.12.003
引用格式： 何树果，袁瑗，朱震，等. 基于ATT&CK框架的域威胁检测[J].信息技术与网络安全，2021，40(12)：15-18，25.

Domain threat detection based on ATT&CK framework

Abstract： It has always been one of the challenges faced by security researchers about how to ensure the security of sensitive information and data in the enterprise domain environment. In response to this problem, it is proposed to combine the attack behavior knowledge base provided by the ATT&CK framework with the domain security defense to fully cover the domain security-related tactics and technologies involved in ATT&CK. Real-time log data generated in a simulated environment is analyzed, and sensitive log events and continuous abnormal log events are monitored and captured. Finally, technical personnel in the security field are organized to conduct a red-blue exercise. The results of the exercise show that under the guidance of the ATT&CK framework, the domain attack posture can be well detected.

Key words : ATT&CK framework；domain penetration；domain security；threat intelligence