What is the MITRE ATT&CK® Framework?
- Understanding MITRE ATT&CK: Tactics, techniques, and procedures (TTPs)
- How the MITRE ATT&CK framework works
- Use cases of MITRE ATT&CK
- How Log360 leverages MITRE ATT&CK for threat detection
- Improving threat detection and compliance with MITRE ATT&CK
- 1. What is MITRE ATT&CK®?The MITRE ATT&CK® framework is a globally recognized, comprehensive matrix used by cybersecurity professionals to categorize and understand adversary tactics, techniques, and procedures (TTPs). It helps organizations detect and mitigate cyberattacks by modeling real-world adversarial behaviors.
- 2. Core components of ATT&CK:The framework is built around tactics, techniques, and procedures(TTPs) which outline how adversaries approach and execute their attacks. These components guide security teams in defending against threats by mapping the entire life cycle of a cyberattack.
- 3. Real-world applications:By leveraging MITRE ATT&CK, organizations gain insights into real-world cyberthreats, improving detection, threat intelligence, and response strategies. It helps security professionals anticipate potential attack vectors and take proactive measures to strengthen their defenses.
- 4. Enhanced threat detection:The ATT&CK framework is integrated into SIEM tools, enabling organizations to automate threat detection through predefined correlation rules, improve incident investigation, and align cybersecurity strategies with compliance standards.
The MITRE ATT&CK framework is a globally recognized knowledge base of adversary TTPs used in real-world cyberattacks. Designed to provide security professionals with detailed insights into adversarial behavior, it empowers organizations to enhance their defenses against sophisticated cyberthreats by categorizing the attack life cycle into actionable steps.
The ATT&CK framework aids in understanding how adversaries operate by modeling their behaviors in a structured way. It is continuously updated based on real-world data, making it a valuable tool for threat detection, response, and cybersecurity strategies.
Understanding MITRE ATT&CK: Tactics, techniques, and procedures (TTPs)
The MITRE ATT&CK framework categorizes adversary behavior into three core components, often referred to as TTPs: Tactics, Techniques, and Procedures.
- Tactics represent the adversary's high-level objectives during an attack, such as gaining access to a system or maintaining persistence. They provide insight into the why of an adversary's actions.
- Techniques are the methods adversaries use to accomplish their goals. For example, an adversary may use a brute force technique to gain access to credentials.
- Procedures are the detailed steps attackers follow to implement a technique. These steps are often highly specific, adapting to the attacker’s goals and the environment they are operating in.
These components help security teams anticipate adversary actions and build defenses tailored to real-world attack strategies. For example, in an attack focused on credential access, an adversary may use the brute force technique and follow a password spraying procedure, where they try common passwords across multiple accounts.
This structured classification enables security teams to better defend against threats by understanding the entire attack life cycle, from the adversary’s goals (tactics) to their specific execution steps (procedures).
The 14 tactics in the MITRE ATT&CK matrix
The MITRE ATT&CK matrix visually represents adversary behavior by breaking down attacks into 14 core tactics. These tactics represent each stage of an adversary's attack, from the initial reconnaissance phase to the final impact on systems.
1. Reconnaissance (TA0043)
The adversary conducts reconnaissance to gather information that will support their future operations. To achieve this, the adversaries often employ passive methods to avoid detection, such as researching public resources for information on targets.
2. Resource development (TA0042)
This tactic involves adversaries creating or obtaining resources, like establishing command and control infrastructure or acquiring tools, that support their operations. These resources aid in launching attacks and maintaining a presence within a target's environment.
3. Initial access (TA0001)
The adversary seeks to enter your network. Techniques for initial access include tactics like spear phishing, exploiting public-facing applications, or using stolen credentials to masquerade as legitimate users.
4. Execution (TA0002)
The adversary will try to execute malicious code on a local or remote system. This could be achieved through various means, such as user execution of a malicious file or automated execution via a vulnerability exploit.
5. Persistence (TA0003)
The adversary will try to maintain their foothold in the network. Adversaries may create accounts, manipulate existing ones, or use legitimate credentials to ensure continued access to compromised systems. This includes during disruptions like system restarts or credential changes.
6. Privilege escalation
(TA0004)
The adversary will try to gain higher-level permissions in a system or network. To achieve this, adversaries might utilize software vulnerabilities to elevate privileges. Exploiting such vulnerabilities involves taking advantage of programming errors within programs, services, or the operating system software itself. This allows adversaries to execute their own code, exerting control over the compromised system.
7. Defense evasion (TA0005)
The adversary uses defense evasion to avoid being detected. They may disguise their actions, modify system processes, or use obfuscation to hide their activities. This allowing them to remain undetected while conducting their operations.
8. Credential access (TA0006)
The adversary aims to steal credentials like passwords or tokens to gain access to systems, services, and network resources. To achieve this, adversaries might employ brute-force techniques to gain unauthorized access to accounts when passwords are either unknown or when they have obtained password hashes.
9. Discovery (TA0007)
The adversary will try to figure out your systems and environment. To achieve this, adversaries might turn to network sniffing to gather information about a targeted environment. This involves intercepting sensitive login credentials and other network traffic.
10. Lateral movement
(TA0008)
The adversary will try to move through your environment to gain control of additional systems. Techniques include using stolen credentials to access networked devices, or employing methods like pass-the-ticket or remote services to extend their reach within the network.
11. Collection (TA0009)
The adversary will try to gather data of interest to their goal. To achieve this, adversaries might attempt to collect data from sensitive documents, key operational data, or proprietary technology within compromised environments, often before exfiltration.
12. Command & control
(TA011)
The adversary will try to communicate with compromised systems to control them. To achieve this, adversaries might employ a connection proxy, which acts as an intermediary for network traffic between systems. By doing so, they can redirect network traffic through the proxy, avoiding direct links to their own infrastructure or command and control servers.
13. Exfiltration (TA0010)
The adversary will try to steal data from their targets. To achieve this, adversaries might illicitly move data, including backups of cloud environments, from one cloud account to another that they control within the same service. This is done to avoid standard detection systems that might trigger alerts based on file transfers, downloads, or network-based exfiltration.
14. Impact (TA0040)
The adversary will try to manipulate, interrupt, or destroy your systems and data. To achieve this, adversaries might disrupt the availability of systems, services, and network resources by deliberately deleting data and files on targeted systems or across an entire network.
Play the role of the cybercriminal and understand the tactics behind a real-world cyberattack and learn how to defend against them.
Access resourceHow the MITRE ATT&CK framework works
The MITRE ATT&CK framework is organized into a matrix that categorizes the behaviors of adversaries across different attack stages. The framework covers a variety of environments, including enterprise systems, mobile devices, and industrial control systems (ICS). This allows organizations across various sectors to adopt it and improve their cyberdefense strategies.
The structure of the MITRE ATT&CK matrix
The ATT&CK matrix is divided into rows representing adversary tactics and columns representing techniques used to achieve these tactics. Each tactic, such as initial access or lateral movement, is accompanied by a list of specific techniques adversaries might use. For example, under the credential access tactic, techniques like password spraying or keylogging are listed.
Each technique may also be broken down further into sub-techniques, which provide even more detail on how adversaries might execute an attack. This structure allows organizations to map out the entire attack life cycle, from the initial reconnaissance to the final impact on the target systems.
Multi-platform coverage
The MITRE ATT&CK framework covers three major domains:
- 1. Enterprise ATT&CK Focuses on tactics and techniques targeting traditional enterprise environments, such as Windows, Linux, and macOS systems. This domain includes a broad range of attack vectors, including network exploits, credential theft, and malware delivery.
- 2. Mobile ATT&CK Focuses on tactics and techniques used in attacks on mobile devices, covering both iOS and Android platforms. This domain includes techniques like data extraction, location tracking, and device compromise through malicious apps.
- 3. ICS ATT&CK Focuses on tactics and techniques that adversaries use to target industrial control systems, which are critical for sectors like energy, manufacturing, and transportation. These attacks often aim to disrupt physical processes, causing damage or downtime.
How the matrix enhances cyberdefense
By leveraging the MITRE ATT&CK matrix, security teams can:
- Visualize the attack life cycle The matrix provides a clear representation of each phase of an attack, from reconnaissance to impact. This helps security teams understand how adversaries progress through their attacks, allowing them to anticipate the next steps.
- Detect early indicators of compromise (IoCs)The framework helps organizations identify IoCs related to each technique. For example, if a technique like lateral movement is detected, teams can look for indicators such as unauthorized remote access or unusual credential usage. This enables faster detection of active threats.
- Correlate threat intelligenceSecurity teams can map threat intelligence and real-world incidents to specific techniques in the matrix. This helps build a comprehensive picture of how adversaries are behaving in real-time and allows organizations to adjust defenses accordingly.
- Prioritize security effortsBy using the matrix, teams can prioritize high-risk techniques and tactics that are most relevant to their environment. For instance, a company operating in a cloud-heavy environment might focus on techniques related to cloud account compromise, while an ICS-heavy organization may focus on techniques targeting industrial control systems.
From understanding to defending: Explore how to leverage MITRE ATT&CK to proactively identify and mitigate potential threats.
Threat hunting 101: Extend your threat detection and investigation with the MITRE ATT&CK framework
Watch nowUse cases of MITRE ATT&CK
The MITRE ATT&CK framework is widely used by both private and public organizations to improve their cybersecurity posture. Here are the primary use cases:
- Threat intelligence analysis MITRE ATT&CK offers a common language for categorizing and sharing adversary behaviors, fostering a collective defense against cyberthreats. Analysts can map observed behavior to specific TTPs in the framework, helping organizations track and analyze cyberthreats more effectively.
- Red and blue team exercises The framework is a critical resource for red teams when emulating real-world adversaries. By simulating attack scenarios, they can identify system vulnerabilities. Blue teams, on the other hand, use the framework to develop detection rules and improve their response strategies.
- Incident response ATT&CK is used to map incidents back to adversary techniques, enabling faster and more effective response. By pinpointing specific tactics, security teams can correlate these behaviors to alerts, allowing for quicker containment of ongoing attacks.
- Compliance alignment Organizations can align their security initiatives with compliance standards such as PCI DSS, HIPAA, and GDPR by mapping specific ATT&CK tactics and techniques to regulatory requirements. This helps demonstrate a proactive approach to threat detection and response.
- Automated threat detection The ATT&CK framework helps automate the identification of adversary behaviors, reducing false positives. By correlating log data and detecting patterns that align with ATT&CK techniques, security teams can improve operational efficiency and focus on higher-priority threats.
Interested in exploring how Log360 leverages SIEM to enhance threat detection? Discover how Log360 uses MITRE ATT&CK to track and mitigate cyberthreats effectively.
Log360's MITRE pageHow Log360 leverages MITRE ATT&CK for threat detection
By integrating MITRE ATT&CK into Log360, organizations can boost their cybersecurity capabilities. Log360 enhances threat detection and response by:
- Providing ATT&CK-aligned security dashboards and incident reports These reports give a detailed view of adversary activities mapped to the framework, enabling better situational awareness and quick response times.
- Predefined correlation rules for ATT&CK techniques Log360 includes predefined correlation rules for detecting ATT&CK techniques, allowing security admins to track and monitor adversary behavior in real-time.
- Actionable mitigation strategies Log360 offers recommended mitigation strategies for each stage of the attack life cycle, helping teams implement effective countermeasures.
- Comprehensive incident investigation With in-depth visibility into all 14 tactics and associated techniques, Log360 facilitates thorough investigation of security incidents, ensuring that no threat goes unnoticed.
The alerts that warn of critical security events once detected have been instrumental in our threat detection efforts."
-Mireille Kasikila, system administrator at Zaxby's
How MITRE updates the framework
MITRE's framework is updated biannually, with adjustments and enhancements implemented to ensure its relevance and efficiency in addressing evolving cybersecurity threats.
Introducing campaigns
MITRE adds new campaigns to mirror emerging attack patterns or strategies observed in the cyber domain.
Threat intelligence analysis
MITRE analysts continually monitor threat intelligence feeds, incident reports, and other sources of information to identify new adversary behaviors, techniques, and procedures.
Periodic review and updates
The framework is reviewed periodically (typically biannually) to ensure it reflects the current threat landscape. During these reviews, existing entries may be updated and new ones added.
Technique, software, and group modifications
Regular updates include changes to current techniques, software, and groups to account for changes in adversary TTPs.
Research and validation
New data is researched and validated to ensure accuracy. This involves cross-referencing with existing knowledge and potentially collaborating with external experts and entities.
Changelog publication
When updates are made, MITRE publishes a changelog that details the changes. This may include new techniques, the retirement or modification of existing ones, and restructuring of the framework to accommodate new concepts or threat models.
Community feedback and contributions
MITRE solicits and incorporates feedback from the cybersecurity community. Security researchers, organizations, and users of the framework can submit new information about TTPs based on their observations and experiences.
Adversary emulation and testing
MITRE may use adversary emulation plans to simulate tactics and techniques to validate their relevance and applicability within the framework.
What lies ahead for the MITRE ATT&CK framework?
MITRE aims to help the community by offering tools and resources for utilizing the information in the ATT&CK framework. It strives to customize the gathered data and resources to help organizations create cybersecurity compliance programs that align with their specific needs. MITRE's roadmap involves regular updates, including the introduction of campaigns; modifications to techniques, software, and groups; as well as changes to data sources and components. The framework, refreshed biannually, stands as a continual resource for cybersecurity compliance professionals and the broader industry.
Improving threat detection and compliance with MITRE ATT&CK
The MITRE ATT&CK framework offers a comprehensive approach to improving an organization’s cybersecurity posture. With Log360's integration of ATT&CK, organizations can:
- Gain real-time visibility into adversary tactics and techniques.
- Automate threat detection with predefined correlation rules.
- Enhance incident investigations by mapping adversary behaviors to the 14 ATT&CK tactics.
- Strengthen compliance efforts by aligning security strategies with regulatory standards.
Learn how MITRE ATT&CK implementation can improve your SIEM.
