MITRE ATT&CK

MITRE ATT&CK is a free framework that outlines all of the possible approaches cyber threat actors make take. The knowledge base, which is based entirely on real-world observations, offers a foundation for the development of specific threat models and methodologies for private, government, and Cybersecurity sectors. The framework has one component for enterprise IT networks and clouds, and another for mobile devices.

History

In 2013, the Mitre Corporation, an American nonprofit managing federally funded research and development centers, started ATT&CK to document common tactics, techniques, and procedures that Advanced Persistent Threats (APT)s use against Windows enterprise networks. It began as a documentation research project called "FMX," which investigated endpoint telemetry data and analytics usage with the aim of improving post-compromise detection. ATT&CK became the basis for testing the efficacy of sensors and analytics and is now the common language of cybersecurity offense and defense teams.
By 2021, the initially released ATT&CK framework had undergone many changes and is now in its ninth version.

Overview

ATT&CK vs. Kill Chain, Varonis

The framework covers four conceptual issues with the overarching aim to assist proactive offense rather than reactive defense.

1. Behaviors: ATT&CK reflects patterns of use rather than indicators of activities, such as domains, IP addresses, file hashes, registry keys, because threat actors can easily change the latter. They are useful for detection, but they don't holistically capture how threat actors interact with systems.
2. Models: ATT&CK is meant to provide less high-level lifecycle and Kill Chain models because too much abstraction makes them unhelpful.
3. Observation: ATT&CK relies on observed incidents so that the framework can be applied to real environments.
4. Taxonomy: ATT&CK emphasizes generating and using common terminology across incidents for the sake of comparison.

Terminology

Tactics

Tactics refer to the purpose behind an ATT&CK technique. It is the goal for performing the action, such as stealing credentials or gaining remote access.

Techniques

Techniques encompass the conceptual method for achieving the tactical goal in question.

Procedures

Procedures refer to the actual implementation of the techniques.

Screenshot of MITRE ATT&CK Enterprise Matrix Version 9.0