Eviction: Mapping APT28 TTPs with the MITRE ATT&CK Navigator

Introduction

Welcome to my walkthrough of the room Eviction! This room is part of the SOC Level 1 path and is the final room in the Cyber Defence Frameworks module. In my previous article, I walked through Summit, a challenge room where we climbed the Pyramid of Pain by making a simulated attacker's indicators progressively harder to use.

Eviction is also a challenge room. Instead of reading theory and answering questions about it, we step into the shoes of a SOC analyst and use the MITRE ATT&CK Navigator to trace how a real APT group might move through a network, from reconnaissance all the way to command and control. This article walks through the methodology for every question without revealing any answers, so you still get the satisfaction of finding each one yourself.

Catch up on my previous article, Summit, by clicking the banner below.

What we will cover

• How the MITRE ATT&CK Navigator layer for the APT group is organized
• How to expand techniques and read highlighted sub-techniques
• How to map each stage of the scenario to the correct ATT&CK tactic column
• A spoiler free path to every answer in the room

Room Information

Before we dive into the challenge, here is a quick overview of the room details.

• Room Name: Eviction
• Path: SOC Level 1
• Module: Cyber Defence Frameworks
• Topic: MITRE ATT&CK Navigator, Threat Intelligence, Adversary TTP Mapping
• Difficulty: Easy
• Room Link: TryHackMe — Eviction

Task 1: Understand the adversary

The scenario follows Sunny, a SOC analyst at E-corp, a manufacturer of rare earth metals for government and private clients. A classified intelligence report warns her that APT28 may be targeting organizations like E-corp. Her job is to translate that intelligence into action: identify the group's tactics, techniques, and procedures (TTPs), confirm whether it has already reached the network, and stop it if it has.

Her tool of choice is the MITRE ATT&CK Navigator, a web interface for viewing and annotating the ATT&CK matrix. The room provides a prepared Navigator layer in which every technique attributed to the APT group is highlighted. Each column of the matrix is a tactic (the adversary's goal at that stage, such as Persistence or Lateral Movement), and each cell inside a column is a technique (how the goal is achieved). Many techniques also contain sub-techniques that describe a more specific method.

Tactics represent the "why" of an ATT&CK technique or sub-technique. It is the adversary's tactical goal: the reason for performing an action.

Every question in this room follows the same pattern: read the scenario, decide which tactic column it describes, find the relevant parent technique, expand it, and read which sub-techniques are highlighted for this APT.

Getting Started

Open the Navigator layer using the link in the task text. It opens in a tab named after the group, APT28 (G0007), and loads the full Enterprise matrix with the group's techniques shaded in blue (and underlined in yellow), while everything the group is not known to use stays plain. The tactic columns run left to right in the same order as an attack unfolds, starting with Reconnaissance, and each column header shows how many techniques it contains.

Techniques that contain sub-techniques show a count next to their name, such as (1/3), meaning one of three sub-techniques is used by the group. A grey handle on the right edge of the cell expands the technique to reveal its children. If you prefer to see everything at once, use the expand control in the layer controls group of the toolbar, and the magnifying glass under selection controls lets you jump straight to a technique by name.

Recon and Initial Access

The first question asks for a single technique that serves the APT in two different phases. Start in the Reconnaissance column: the parent technique built around tricking people through messages to gather information is highlighted, with a count showing one of its three sub-techniques is in use. Expand it and note the highlighted child. Then look at the equivalent parent technique in the Initial Access column and confirm that the same sub-technique name appears there as well. That shared name is your answer.

Resource Development

Before an attack begins, adversaries build up infrastructure and accounts they can abuse later. That preparation lives in the Resource Development column. The question tells you the APT compromises accounts, so locate the Compromise Accounts technique (marked (1/3)), expand it, and read the one sub-technique that is highlighted.

User Execution

Social engineering that makes a user run the attacker's code is categorized under the Execution tactic. Find the User Execution technique in that column, marked (2/3), and expand it. Two of its three sub-techniques are highlighted for this APT, and the third one stays plain. The room expects both highlighted names joined with "and", following the answer format shown under the question.

Scripting Interpreters

Staying in the Execution column, the next step is to work out which interpreters the code would run through once the user takes the bait. Expand Command and Scripting Interpreter, marked (2/9), and look for the two highlighted entries among its nine sub-techniques. Both are interpreters built into Windows. Again, enter both, joined with "and".

Registry Persistence

Scripts that modify the registry to survive reboots point to the Persistence tactic. Find Boot or Logon Autostart Execution, marked (1/14), and expand it. Only one of its fourteen sub-techniques is highlighted, and it is the one that deals with the registry. Its full name has two parts separated by a slash: the answer is only the registry part before the slash, written exactly as the Navigator shows it.

Proxy Execution

Abusing trusted, signed Windows binaries to run malicious code is a classic way to slip past defences, which places this question under Defense Evasion. Find System Binary Proxy Execution, marked (1/13), and expand it. The list is long and alphabetical, but only one system binary is highlighted.

Discovery with tcpdump

tcpdump is a command line packet capture tool: it listens on a network interface and records the traffic passing through it. Think about what an attacker gains by doing that. Capturing traffic reveals hosts and services on the network (discovery), but it can also expose credentials sent in clear text, which is why ATT&CK lists this technique under both Discovery and Credential Access. It is a standalone technique with no sub-techniques. Look for the highlighted entry about capturing network traffic; you will find it in either column, and in the Credential Access column it sits just below the Multi-Factor Authentication entries.

Lateral Movement

The scenario states the APT moved between hosts by exploiting remote services. Head to the Lateral Movement column and expand Remote Services, marked (1/7). Of its seven sub-techniques, only one is highlighted, and it covers the Windows file sharing protocol and the hidden administrative shares. Enter its name in the format the Navigator uses, including the slash between the two parts.

Information Repositories

Stealing intellectual property means gathering data before it leaves the network, which is the Collection tactic. Locate Data from Information Repositories, marked (1/3), and expand it. Its three sub-techniques are all repositories organizations use to store internal work, and only one is highlighted: a well known document collaboration platform.

Proxies for Command and Control

The final question asks how the APT would reroute its traffic to reach its C2 server. That lives in the Command and Control column. Expand the Proxy technique, marked (2/4), and note the two highlighted sub-techniques among its four. The two plain ones tell you what the answer is not, which makes it easy to spot. Enter both highlighted names joined with "and".

Wrapping Up the Investigation

With the last answer submitted, the room confirms that Sunny has stopped the APT before it could exfiltrate E-corp's intellectual property. Looking back, every answer came from the same repeatable routine: map the observed behaviour to a tactic, find the parent technique, expand it, and read what the threat intelligence layer highlights. That routine is exactly how analysts turn an intelligence report into concrete hunting leads.

Summary & Key Takeaways

Congratulations on completing Eviction and with it the entire Cyber Defence Frameworks module! Over this module we moved from the Pyramid of Pain and the kill chain models to MITRE ATT&CK, and Eviction tied it all together by putting a real threat intelligence layer to work. Keep this workflow close, because you will reach for ATT&CK again and again in the rooms ahead.

Key lessons:

• The MITRE ATT&CK Navigator turns threat intelligence about a specific group into a visual map of the TTPs to hunt for.
• Tactics describe the adversary's goal at each stage, while techniques and sub-techniques describe how that goal is reached.
• Many important details are hidden in collapsed sub-techniques, so expanding techniques is essential before drawing conclusions.
• A single technique can serve several tactics, so the same activity may appear in more than one column.
• Mapping each observed behaviour (a dropped tool, a registry change, a new proxy) to a tactic gives analysts concrete places to look for evidence of compromise.

That's it for this module, next up is the first room in the Phishing Analysis module, Phishing Analysis Fundamentals, where we learn how phishing emails are built and how to examine their headers and contents. Click the banner below to check it out!