Introduction to MITRE ATT&CK
The MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It has become the de facto standard for understanding attacker behavior.
Why ATT&CK Matters
ATT&CK provides a common language for describing adversary behavior, enabling:
Threat Intelligence: Mapping threat actors to specific techniques
Detection Engineering: Building detections based on known techniques
Red Team Operations: Emulating real-world adversary behavior
Gap Analysis: Identifying coverage gaps in your defenses
The ATT&CK Matrix Structure
Enterprise Matrix Overview
The Enterprise ATT&CK matrix covers techniques used against enterprise IT systems:
14 Tactics (the "why"):
1Reconnaissance - Gathering information
2Resource Development - Establishing resources
3Initial Access - Getting into the network
4Execution - Running malicious code
5Persistence - Maintaining foothold
6Privilege Escalation - Gaining higher permissions
7Defense Evasion - Avoiding detection
8Credential Access - Stealing credentials
9Discovery - Learning the environment
10Lateral Movement - Moving through network
11Collection - Gathering target data
12Command and Control - Communicating with compromised systems
13Exfiltration - Stealing data
14Impact - Manipulating or destroying systems
Techniques and Sub-techniques
Each tactic contains multiple techniques (the "how"):
T1566 - Phishing: Initial access via malicious emails
T1566.001 - Spearphishing Attachment: Targeted emails with malicious attachments
T1566.002 - Spearphishing Link: Targeted emails with malicious links
Implementing ATT&CK for Detection
Step 1: Prioritize Techniques
Not all techniques are equal. Prioritize based on:
Prevalence: How often the technique is used
Relevance: Applicability to your environment
Impact: Potential damage if successful
Detectability: Feasibility of detection
Step 2: Map Data Sources
For each prioritized technique, identify required data sources:
Example - T1059.001 (PowerShell):
Process creation logs (Event ID 4688)
PowerShell script block logging (Event ID 4104)
Module logging (Event ID 4103)
Command line auditing
Step 3: Build Detection Rules
Create detection logic based on technique indicators:
PowerShell Detection Example:
Encoded commands (-enc, -e flags)
Download cradles (IEX, Invoke-Expression)
Suspicious cmdlets (Invoke-Mimikatz)
Obfuscation patterns
Step 4: Test and Validate
Use tools to validate detections:
Atomic Red Team: Execute specific technique tests
CALDERA: Automated adversary emulation
Red Canary's Threat Reports: Real-world technique usage
ATT&CK for Red Team Operations
Planning Adversary Emulation
1Select Threat Actor: Choose relevant APT group
2Map Techniques: Identify their known TTPs
3Create Playbook: Sequence techniques logically
4Execute Safely: Use proper authorization and scoping
Common Technique Chains
Ransomware Operator Pattern:
1T1566 - Phishing (Initial Access)
2T1059 - Command Scripting (Execution)
3T1547 - Boot/Logon Autostart (Persistence)
4T1078 - Valid Accounts (Privilege Escalation)
5T1021 - Remote Services (Lateral Movement)
6T1486 - Data Encrypted for Impact
ATT&CK Navigator
Using the Navigator Tool
ATT&CK Navigator is a web-based tool for visualizing coverage:
Create Layers: Visualize detection coverage
Compare Layers: Identify gaps between desired and actual coverage
Score Techniques: Rate detection confidence levels
Export/Share: Collaborate with team members
Building a Coverage Map
1Export current detection rules
2Map each rule to ATT&CK techniques
3Import into Navigator
4Identify coverage gaps
5Prioritize gap remediation
Measuring ATT&CK Coverage
Metrics to Track
Technique Coverage %: Techniques with at least one detection
Detection Confidence: High/Medium/Low ratings per technique
Data Source Availability: Required logs being collected
Alert Volume: Detections firing per technique
Maturity Model
Level 1 - Basic: <25% technique coverage, manual analysis
Level 2 - Developing: 25-50% coverage, some automation
Level 3 - Defined: 50-75% coverage, integrated workflow
Level 4 - Managed: 75-90% coverage, continuous improvement
Level 5 - Optimized: >90% coverage, threat intelligence driven
Common Implementation Challenges
Challenge 1: Data Gaps
Solution: Prioritize high-value data sources first (endpoint, authentication, network)
Challenge 2: Alert Fatigue
Solution: Focus on high-fidelity detections, tune aggressively
Challenge 3: Keeping Current
Solution: Subscribe to ATT&CK updates, integrate threat intel feeds
Challenge 4: Organizational Buy-in
Solution: Demonstrate value through metrics and purple team exercises
Tools and Resources
Detection Validation
Atomic Red Team
MITRE CALDERA
Uber's Metta
Red Canary's Chain Reactor
Mapping Tools
ATT&CK Navigator
DeTT&CT
ATT&CK Workbench
Threat Intelligence
MITRE CTI Repository
Threat Actor Group Profiles
Technique Usage Reports
Conclusion
MITRE ATT&CK transforms security from reactive to proactive. By mapping defenses to known adversary behavior, organizations can systematically identify and close security gaps. Start with high-priority techniques, validate with testing, and continuously improve coverage.