Mitre Attck Reference

name: mitre-attck-reference description: MITRE ATT&CK Enterprise framework reference for mapping adversary tactics, techniques, and detection guidance tags: [security, threat-intelligence]

MITRE ATT&CK Framework Reference

Overview

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally recognized knowledge base of adversary behavior. The Enterprise matrix organizes attack patterns into 14 tactical phases that describe the progression of a cyberattack from initial reconnaissance through final impact. Security agents use ATT&CK to classify incidents, build detection logic, identify coverage gaps, and communicate threats using a shared vocabulary.

The Enterprise matrix covers behaviors observed against Windows, macOS, Linux, cloud (AWS, Azure, GCP), network infrastructure, and container environments. Each technique has a unique identifier (e.g., T1566) and may include sub-techniques (e.g., T1566.001).

When to Use This Skill

• Classifying security incidents against a standardized taxonomy
• Building or reviewing detection rules that need ATT&CK technique references
• Performing threat coverage gap analysis across your detection stack
• Writing incident reports that require ATT&CK mapping
• Evaluating adversary emulation plans or red team findings
• Correlating threat intelligence feeds with internal telemetry

How It Works

Step 1: Identify the Tactic

Determine which tactical phase the observed activity falls under. The 14 Enterprise tactics in kill-chain order are:

Step 2: Map the Technique

Within the identified tactic, select the specific technique that matches the observed behavior. Key techniques per tactic:

Reconnaissance (TA0043): T1595 Active Scanning, T1592 Gather Victim Host Info, T1589 Gather Victim Identity Info, T1590 Gather Victim Network Info, T1593 Search Open Websites/Domains, T1594 Search Victim-Owned Websites

Resource Development (TA0042): T1583 Acquire Infrastructure, T1586 Compromise Accounts, T1584 Compromise Infrastructure, T1587 Develop Capabilities, T1585 Establish Accounts, T1588 Obtain Capabilities

Initial Access (TA0001): T1566 Phishing, T1190 Exploit Public-Facing App, T1133 External Remote Services, T1078 Valid Accounts, T1195 Supply Chain Compromise, T1199 Trusted Relationship

Execution (TA0002): T1059 Command and Scripting Interpreter, T1204 User Execution, T1203 Exploitation for Client Execution, T1047 WMI, T1053 Scheduled Task/Job, T1569 System Services

Persistence (TA0003): T1053 Scheduled Task/Job, T1547 Boot/Logon Autostart, T1136 Create Account, T1098 Account Manipulation, T1543 Create/Modify System Process, T1546 Event Triggered Execution

Privilege Escalation (TA0004): T1548 Abuse Elevation Control, T1134 Access Token Manipulation, T1068 Exploitation for Privilege Escalation, T1078 Valid Accounts, T1547 Boot/Logon Autostart, T1055 Process Injection

Defense Evasion (TA0005): T1070 Indicator Removal, T1036 Masquerading, T1027 Obfuscated Files, T1055 Process Injection, T1218 System Binary Proxy Execution, T1562 Impair Defenses, T1112 Modify Registry

Credential Access (TA0006): T1110 Brute Force, T1555 Credentials from Password Stores, T1003 OS Credential Dumping, T1558 Steal or Forge Kerberos Tickets, T1539 Steal Web Session Cookie, T1552 Unsecured Credentials

Discovery (TA0007): T1087 Account Discovery, T1083 File and Directory Discovery, T1057 Process Discovery, T1018 Remote System Discovery, T1082 System Information Discovery, T1016 System Network Configuration

Lateral Movement (TA0008): T1021 Remote Services, T1570 Lateral Tool Transfer, T1080 Taint Shared Content, T1550 Use Alternate Authentication Material, T1563 Remote Service Session Hijacking

Collection (TA0009): T1560 Archive Collected Data, T1119 Automated Collection, T1005 Data from Local System, T1039 Data from Network Shared Drive, T1114 Email Collection, T1056 Input Capture

Command and Control (TA0011): T1071 Application Layer Protocol, T1132 Data Encoding, T1573 Encrypted Channel, T1105 Ingress Tool Transfer, T1090 Proxy, T1572 Protocol Tunneling, T1571 Non-Standard Port

Exfiltration (TA0010): T1041 Exfiltration Over C2 Channel, T1048 Exfiltration Over Alternative Protocol, T1567 Exfiltration Over Web Service, T1029 Scheduled Transfer, T1030 Data Transfer Size Limits

Impact (TA0040): T1486 Data Encrypted for Impact, T1489 Service Stop, T1490 Inhibit System Recovery, T1485 Data Destruction, T1498 Network Denial of Service, T1496 Resource Hijacking

Step 3: Find Sub-Techniques

Many techniques have sub-techniques that provide finer granularity. For example:

• T1566.001 - Phishing: Spearphishing Attachment
• T1566.002 - Phishing: Spearphishing Link
• T1566.003 - Phishing: Spearphishing via Service
• T1566.004 - Phishing: Spearphishing Voice

Always map to the most specific sub-technique available to improve detection precision and reporting accuracy.

Step 4: Identify Detection Data Sources

Each technique in ATT&CK lists recommended data sources. Common data source categories:

Step 5: Build Detection Rules

Use the mapped technique and data sources to create detection rules in your SIEM or detection platform. Reference the ATT&CK technique ID in every rule for traceability.

Examples

Example 1: Mapping a Phishing Attack to ATT&CK

Scenario: A user received an email with a malicious Word document attachment. Opening it executed a PowerShell download cradle.

ATT&CK mapping:

• Tactic: Initial Access (TA0001)
• Technique: T1566.001 - Phishing: Spearphishing Attachment
• Follow-on Tactic: Execution (TA0002)
• Follow-on Technique: T1059.001 - Command and Scripting Interpreter: PowerShell

Detection data sources:

• Email gateway logs (attachment metadata, sender reputation)
• Sysmon Event 1 (process creation: WINWORD.EXE spawning powershell.exe)
• PowerShell ScriptBlock Logging (Event 4104)
• Network traffic (outbound HTTP/HTTPS to uncommon domains)

Example 2: Mapping Lateral Movement to ATT&CK

Scenario: An attacker used stolen credentials to establish RDP sessions across multiple internal hosts.

ATT&CK mapping:

• Tactic: Lateral Movement (TA0008)
• Technique: T1021.001 - Remote Services: Remote Desktop Protocol
• Supporting Tactic: Credential Access (TA0006)
• Supporting Technique: T1078 - Valid Accounts

Detection data sources:

• Windows Security Event 4624 (Type 10 - RemoteInteractive logon)
• Windows Security Event 4625 (failed logon attempts)
• Network traffic (port 3389 connections between internal hosts)
• EDR telemetry (new RDP client processes on workstations)

Example 3: YAML-Based Detection Rule Referencing ATT&CK

title: Suspicious PowerShell Download Cradle
id: 7f3b2a1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: production
description: >
  Detects PowerShell commands commonly used as download cradles,
  often observed after initial access via phishing attachments.
references:
  - https://attack.mitre.org/techniques/T1059/001/
  - https://attack.mitre.org/techniques/T1566/001/
tags:
  - attack.execution
  - attack.t1059.001
  - attack.initial_access
  - attack.t1566.001
logsource:
  product: windows
  category: ps_script
  definition: "PowerShell ScriptBlock Logging (Event 4104) must be enabled"
detection:
  selection_keywords:
    ScriptBlockText|contains:
      - "Invoke-WebRequest"
      - "Invoke-RestMethod"
      - "Net.WebClient"
      - "Start-BitsTransfer"
      - "DownloadFile"
      - "DownloadString"
  selection_execution:
    ScriptBlockText|contains:
      - "Invoke-Expression"
      - "IEX"
      - "-enc"
      - "-EncodedCommand"
  condition: selection_keywords and selection_execution
  timeframe: 5m
level: high
falsepositives:
  - Legitimate admin scripts that download and execute content
  - Software deployment tools using PowerShell

Best Practices

Do This

• Always map incidents to the most specific sub-technique available
• Include ATT&CK technique IDs in all detection rule metadata
• Perform quarterly coverage gap analysis using ATT&CK Navigator
• Cross-reference threat intelligence reports with your ATT&CK heat map
• Use ATT&CK data sources to validate that required telemetry is collected
• Link detection rules to response playbooks via shared technique IDs
• Track technique prevalence using threat reports (e.g., Red Canary, Mandiant)

Don't Do This

• Do not map only to the tactic level; always identify the specific technique
• Do not assume one detection rule covers an entire technique and all sub-techniques
• Do not ignore the data source requirements; a rule is useless without the right logs
• Do not treat ATT&CK as a compliance checklist; prioritize based on threat landscape
• Do not forget to update mappings when ATT&CK releases new versions (typically biannual)
• Do not create detection rules without testing them against both true positive and benign samples

Security Checklist

• All known incidents are mapped to ATT&CK techniques with sub-technique granularity
• Detection rules include ATT&CK technique IDs in metadata/tags
• ATT&CK Navigator layer is generated showing current detection coverage
• Coverage gaps are identified and prioritized by threat relevance
• Required data sources for high-priority techniques are actively collected
• Detection rules are tested against adversary emulation (e.g., Atomic Red Team)
• Response playbooks reference corresponding ATT&CK techniques
• Threat intelligence feeds are correlated with ATT&CK technique mappings
• ATT&CK mappings are reviewed and updated with each framework release
• Coverage metrics are reported to stakeholders (percentage of techniques detected)

Related Skills

• @sigma-rules-guide - Writing and managing Sigma detection rules with ATT&CK tags
• @ir-playbook-templates - Incident response playbooks linked to ATT&CK techniques
• @cve-epss-guide - Vulnerability prioritization that maps CVEs to ATT&CK techniques

Additional Resources

• MITRE ATT&CK Enterprise Matrix
• ATT&CK Navigator - Interactive coverage visualization
• Atomic Red Team - Technique validation tests
• MITRE CAR (Cyber Analytics Repository) - Detection analytics mapped to ATT&CK
• ATT&CK STIX Data - Machine-readable ATT&CK content
• D3FEND - Defensive technique knowledge graph linked to ATT&CK