What is MITRE ATT&CK?

What is MITRE ATT&CK?

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a publicly available knowledge base of how real attackers behave, maintained by the nonprofit MITRE Corporation. It is built from observed intrusions and published threat reporting, and it is updated regularly as new behavior is documented. Security tools tag their alerts with ATT&CK IDs, threat intelligence reports map adversaries to it, and SOC teams use it to measure what they can and cannot detect.

Tactics, techniques and procedures

• Tactics are the attacker's goals, the reason for an action. Examples include initial access, execution, persistence, privilege escalation, credential access, lateral movement, command and control, exfiltration and impact. Tactics form the columns of the matrix and have IDs that begin with TA.
• Techniques are how a tactic is achieved. Each has an ID that begins with T: Phishing is T1566, OS Credential Dumping is T1003 and Data Encrypted for Impact is T1486.
• Sub-techniques are more specific variants, numbered after a dot: Spearphishing Attachment is T1566.001, and dumping credentials from LSASS memory is T1003.001.
• Procedures are the specific ways a particular group or piece of malware carries out a technique, documented in ATT&CK's entries for groups and software.

Together these are often called TTPs. A technique can serve more than one tactic, so the same technique may appear in more than one column.

The ATT&CK matrices

ATT&CK is organized into domains, each with its own matrix: Enterprise (covering Windows, macOS, Linux, cloud platforms, network devices and containers, among others), Mobile (Android and iOS) and ICS (industrial control systems). Because the framework is versioned and revised, the number of tactics and techniques changes over time; the IDs are the stable part. A related MITRE project, ATLAS, catalogs attacks on AI systems in the same style.

An example mapping

An endpoint alert reports that a finance user opened a Word attachment, a macro launched PowerShell, a scheduled task was created and the host began beaconing over HTTPS. In ATT&CK terms that is Spearphishing Attachment (T1566.001), User Execution: Malicious File (T1204.002), PowerShell (T1059.001), Scheduled Task (T1053.005) and Web Protocols for command and control (T1071.001). Mapping the alert this way tells the analyst which tactics the attacker has already reached and what usually comes next, such as credential dumping and lateral movement.

How defenders use ATT&CK

• Detection coverage: map existing detection rules to techniques to find behaviors that would pass unnoticed.
• Threat hunting: build hunt hypotheses around techniques used by groups that target the industry.
• Threat intelligence: describe an adversary by the techniques it uses, which change more slowly than its IP addresses and file hashes.
• Adversary emulation and purple teaming: run a technique, check whether it was detected, tune the detection, and repeat.
• Assessments: judge whether controls address the techniques most relevant to the organization.

ATT&CK vs. the Cyber Kill Chain and Diamond Model

The Cyber Kill Chain describes an intrusion as seven ordered phases, from reconnaissance to actions on objectives; ATT&CK is far more detailed and is not a strict sequence. The Diamond Model analyzes a single intrusion event through its adversary, capability, infrastructure and victim. Many teams use the Kill Chain for the high-level story, ATT&CK for the specific behaviors and the Diamond Model for linking events into campaigns.

MITRE ATT&CK on the CompTIA Security+ exam

MITRE ATT&CK is one of the threat frameworks named in SY0-801 objective 5.5 as a reference source for audit and assessment work, and it also comes up wherever threat intelligence, hunting and detection are discussed. Wording about tactics and techniques, sub-techniques, technique IDs or mapping attacker behavior to detections points at ATT&CK. Ordered phases point at the Cyber Kill Chain instead, and adversary, capability, infrastructure and victim point at the Diamond Model. Watch for options that call a technique a tactic: tactics are the goals, techniques are the methods, an ID such as T1566 identifies a technique, and tactic IDs begin with TA.