ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge. It was developed by MITRE Corporation, a not-for-profit organization that operates Federally Funded Research and Development Centers (FFRDCs) in the United States.
The main purpose of the MITRE ATT&CK framework is to provide a standardized and detailed mapping of the tactics and techniques that adversaries use to achieve their objectives in the cyber domain. It is essentially a matrix that categorizes these tactics and techniques based on observed real-world cyber threats and incidents.
Here’s a breakdown of the key components of the MITRE ATT&CK framework:
-
Tactics: High-level objectives that adversaries aim to achieve. Examples include Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, and Impact.
-
Techniques: Specific methods or procedures used by adversaries to achieve the goals outlined in the tactics. For instance, a technique under the “Execution” tactic could be “Command-Line Interface” or “Scripting.”
-
Procedures: Detailed descriptions of specific instances or implementations of techniques. Procedures are more specific and may provide information about tools, commands, or specific steps that adversaries have used in the past.
-
Mitigations: Strategies and countermeasures to prevent or minimize the impact of specific techniques.
-
Detection: Guidance on how to detect or identify the presence of specific techniques or procedures.
-
Tools: Examples of tools that adversaries commonly use for specific techniques.
-
Groups and Software: Information about known threat actor groups and specific malware or software associated with them.
Cybersecurity practitioners use the MITRE ATT&CK framework for various purposes, including:
-
Threat Intelligence: Analysts use ATT&CK to understand the tactics and techniques employed by threat actors, helping organizations stay ahead of evolving cyber threats.
-
Incident Response: When responding to a cybersecurity incident, security teams can use ATT&CK to identify the tactics and techniques employed by attackers and take appropriate actions.
-
Security Operations: The framework helps organizations enhance their security operations by providing a structured way to analyze, categorize, and prioritize security events.
-
Red Team and Penetration Testing: Security professionals use ATT&CK to simulate real-world attacks, ensuring that their security defenses are effective against known tactics and techniques.
-
Security Assessments: Organizations can use the framework to assess their security posture and identify potential weaknesses.