MITRE ATT&CK
The ATT&CK framework stands for Adversarial Tactics, Techniques, and Common Knowledge. This framework was developed by MITRE Corporation and is a knowledge base and model for cyber adversary behavior, reflecting the various phases of an adversary's attack life cycle and the platforms they are known to target. It serves as a guideline for classifying and describing cyberattacks and intrusions, and it was initially released in 2013. All the data mentioned here is from their website. This ATT&CK framework enables organizations to enhance their cyber defense with threat information. The framework is free to use and available on their website.
There are guidelines for various types of enterprise systems, including cloud, Windows, macOS, mobile, and industrial control systems. The ATT&CK framework categorizes tactics, techniques, and procedures (TTPs) used by hackers while targeting an enterprise, mobile system, or industrial control system. Additionally, there are guidelines on the cyber defenses that organizations can adopt, which reflect the assets hackers target and the data sources from which you can gather information related to security contexts to detect adversarial activities and implement mitigations.
On their website, you will also find cyber threat intelligence and other tools to help organizations improve their defenses. The framework outlines tactics, techniques, and procedures used by hackers targeting enterprises, which include 14 high-level behaviors: reconnaissance, resource development, initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, command and control, exfiltration, and impact.
For mobile systems, similar high-level behaviors or tactics are defined, showing how hackers target these systems. For industrial control systems, the framework provides tactics and techniques specific to these environments. The framework details each tactic and its associated techniques. For example, the initial access tactic includes techniques like active scanning, scanning IP blocks, and vulnerability scanning, among others.
Organizations can explore sub-techniques within these high-level behaviors, such as the active scanning technique in reconnaissance tactics related to enterprise environments. The framework also provides information on various cyber defense measures and mitigations, such as account usage policies, Active Directory configurations, and antivirus installations on endpoints and servers.
There are different types of assets within an enterprise, including application servers, control servers, data gateways, data historians, HMIs, intelligent electronic devices, and more. The framework identifies 14 major categories of assets and 41 data sources from which organizations can collect information to develop security contexts and detect attacks.
Regarding mitigations, the framework lists 43 mitigation strategies related to enterprise environments, including account usage policies, application isolation and sandboxing, and system audits. There are also 13 mitigations related to mobile devices and 52 mitigations related to industrial control systems.
The framework also covers cyber threat intelligence, detailing advanced persistent threat (APT) groups, the software they use, and various cyber hacking campaigns. The website lists 152 APT groups, different hacking software, and around 30 hacking campaigns. Organizations can use tools like ATT&CK Navigator to create customized threat matrices and defenses, and the ATT&CK Workbench to share this information with their teams. There are also Python tools for querying the ATT&CK database.
Cyber threat intelligence is available in STIX and TAXII formats, and organizations can access MITRE's servers to obtain this intelligence over the web. The ATT&CK framework data is also available in Excel sheets.
This was all. Thank you.