{"id":304515,"date":"2023-09-20T11:20:10","date_gmt":"2023-09-20T18:20:10","guid":{"rendered":"https:\/\/www.paloaltonetworks.com\/blog\/?p=304515"},"modified":"2023-10-05T10:50:23","modified_gmt":"2023-10-05T17:50:23","slug":"mitre-engenuity-attck-evaluations-results","status":"publish","type":"post","link":"https:\/\/www2.paloaltonetworks.com\/blog\/2023\/09\/mitre-engenuity-attck-evaluations-results\/","title":{"rendered":"ONLY Cortex Delivers 100% Protection and Detection in MITRE Engenuity"},"content":{"rendered":"

The 2023 MITRE Engenuity ATT&CK Evaluation results are in, and only Cortex XDR delivers 100% protection and 100% analytic coverage with zero configuration changes and zero delayed detections.<\/h3>\n

Listen to the 2023 MITRE ATT&CK Results<\/a><\/p>\n

The results of the fifth round of the MITRE Engenuity ATT&CK Evaluations have been released, and while every vendor is claiming 100% of everything, the truth is in the details, and the data does not lie. This year, Cortex is the only vendor with 100% prevention and analytic detection.<\/p>\n

\"Results<\/span><\/div>
An illustration directly from the MITRE Engenuity ATT&CK Evaluation<\/a> website shows the 2023 Turla evaluation results for the first detection test.<\/figcaption><\/figure>\n

In the ever-evolving landscape of cybersecurity, staying one step ahead has never been more critical. Adversaries continuously seek new and sophisticated ways to breach defenses. It's a high-stakes game where the rules constantly change, and the consequences of falling behind can be catastrophic.<\/p>\n

This is where MITRE Engenuity enters the scene with their Enterprise ATT&CK Evaluations, offering a beacon of clarity amidst the chaos. These evaluations have become an invaluable resource for CISOs, security professionals and anyone tasked with safeguarding an organization's digital assets. They provide a litmus test or a performance review of how the industry\u2019s endpoint security solutions hold up in the face of the most resourceful cyber saboteurs.<\/p>\n

But, what exactly are the MITRE Engenuity ATT&CK evaluations, and why should you care about the results? These annual evaluations emulate the tactics, techniques and procedures (TTPs) employed by some of our time's most active and notorious threat groups. The MITRE Engenuity red team invites cybersecurity solution providers to defend against carefully choreographed attacks (in both detect-only and prevent modes) to provide insight into three capabilities:<\/p>\n

    \n
  1. Visibility<\/strong> \u2013 what can a solution see<\/li>\n
  2. Detection<\/strong> \u2013 what actions can a solution accurately identify as malicious<\/li>\n
  3. Protection<\/strong> \u2013 what malicious actions can a solution prevent<\/li>\n<\/ol>\n

    A staggering number of vendors participate in these evaluations \u2013 29 this year \u2013 which is a tribute to their value and reflects the painstaking efforts that MITRE Engenuity pours into the assessments to ensure they provide a challenging and provocative engagement.<\/p>\n

    <\/a>Round 5 (Turla)<\/h2>\n

    This year marks the fifth annual evaluation, and the MITRE Engenuity red team focused on emulating the methods of Turla<\/a>, a threat group our Unit 42 threat researchers have studied<\/a>\u00a0extensively. Turla is an extraordinarily well-funded and sophisticated Russian-based threat group that has infected victims in over 45 countries. They have targeted government agencies, military groups, diplomatic missions, as well as research and media organizations. Turla\u2019s infamy stems from its covert exfiltration tactics, including water holing of government websites, custom rootkits, elaborate command-and-control network infrastructure and deception tactics. In speaking with defenders who participated, it is clear that MITRE Engenuity took a great leap forward in the sophistication of their attack methods this year.<\/p>\n

    The blue team deployed the Cortex XDR Pro for Endpoint agent on both Windows and Linux endpoints. No additional solutions were deployed, and Cortex XDR was configured with default settings as it would be out of the box, with the only changes enabling the quarantining of malicious files and, for Linux, enabling the option to treat grayware as malware.<\/p>\n

    <\/a>Key Metrics and Evaluation Criteria<\/h2>\n

    This year's evaluation was broken down into two detection-only scenarios, named Carbon and Snake, corresponding to notable tools created and used by Turla. A protection phase followed this, mirroring the techniques in the detection tests, with enough entropy injected not to look identical to the detection test. The two detection scenarios each had 10 steps, consisting of multiple substeps that map to actual techniques in the MITRE ATT&CK framework. Combined, there were 143 substeps that each vendor had the opportunity to see. For each of these substeps, the MITRE Engenuity team recorded whether each solution had a detection for the action taken.<\/p>\n

    Each of these detections was categorized based on the detection quality observed.<\/p>\n

    MITRE Engenuity Detection Categories:<\/p>\n