MITRE ATT&CK framework
The MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations.
Overview
- Tactics: Represent the “why” of an attack (e.g., Initial Access, Persistence).
- Techniques: Represent the “how” an adversary achieves a tactical objective (e.g., Phishing, T1566).
- Procedures: Specific implementations of techniques by a particular actor.
Usage in Defense
- Gap Analysis: Identifying which techniques the organization cannot currently detect.
- Detection Engineering: Developing rules based on specific ATT&CK techniques.
- Adversary Emulation: Testing defenses against known actor behaviors.