MITRE ATT&CK: what it is

In short

ATT&CK is a shared vocabulary. Instead of saying "the attacker used a trick to stay on the machine", you say "persistence through a scheduled task, T1053.005". Analysts, security vendors, threat intelligence reports and detection rules use the same names and the same codes, and that makes comparable what would otherwise be described in a hundred different ways.

How it works

The knowledge is organised into matrices: Enterprise (corporate systems and cloud), Mobile and ICS (industrial control systems). Each matrix has:

• tactics: the why, that is, the attacker's goal at that moment. The Enterprise matrix has 14, from Reconnaissance and Initial Access through to Lateral Movement, Exfiltration and Impact;
• techniques and sub-techniques: the how, each with an identifier. T1566 is Phishing, T1566.001 its variant with a malicious attachment;
• procedures: concrete examples of how a group or a piece of malware has used that technique;
• entries on groups, software, mitigations and ways to detect each technique.

Why it matters

ATT&CK helps defenders ask precise questions: "if an attacker used this technique, would I notice?". It is used to measure the coverage of a SIEM's rules, to guide threat hunting, to design realistic exercises and penetration tests, and to read threat intelligence reports, which list the techniques of the groups active in a given industry.

Example

A typical ransomware attack, described in ATT&CK terms:

1. email with a malicious attachment, T1566.001;
2. execution of a PowerShell script, T1059.001;
3. use of stolen valid credentials, T1078;
4. movement to other servers through Windows administrative shares, T1021.002;
5. deletion of the recovery copies, T1490;
6. encryption of the data, T1486.

Each step is an opportunity to detect and stop the attack. Many of these techniques use programs already present in Windows (this is known as living off the land): that is why it matters to know which system tools are being used, and by whom.

A useful exercise even for an SME: take the most common techniques in your industry, ask for each one which piece of data would reveal it (a log, an event on the endpoint, a login) and check whether that data is actually being collected.

Related terms

• Indicators of compromise (IoC)
• Threat hunting
• XDR
• Phishing