MITRE ATT&CK Framework (PDF): The #1 Quick Study Guide
Introduction: What is MITRE ATT&CK Framework?
MITRE ATT&CK framework is a database of knowledge about Adversaries, and their TTPs (Tactics, Techniques, and Procedures) based on real-world observations. ATT&CK stands for Adversarial Tactics Techniques & Common Knowledge. It reflects the different stages/tactics that adversaries use in performing an advanced attack and captures the techniques used in each of these stages.
Mitre’s att&ck and security framework is a guide for building up a defense system. It consists of six steps that are used by the company to protect their systems against attacks.
Mitre’s framework is a guide for building up a defense system. It consists of six steps that are used by the company to protect their systems against attacks.
The first step in Mitre’s att&ck and security framework is to identify what assets need protection, which may be anything from data to people, or even information about the organization itself. The second step is then to identify what threats these assets are exposed to and how they might be attacked, which could be anything from malware or hacking, but also includes natural disasters or other external threats. The third step requires identifying vulnerabilities in the current defenses, which can be identified through penetration testing or other means of assessing risk. The fourth step involves developing countermeasures that can reduce these vulnerabilities and eliminate any weaknesses left behind by previous defenses.
What are TTPs?
TTP stands for Tactics, Techniques, and Procedures.
Tactics are the what attackers are trying to achieve.
Techniques are how they accomplish those steps or goals.
Procedures are detailed step-by-step implementation of these Tactics, and Techniques.
What Can Be Done with MITRE ATT&CK framework?
There are a number of ways an organization can use MITRE ATT&CK framework. Here are the primary use cases.
• Adversary Emulation: Organizations can use the framework to emulate scenarios and verify their defenses
• Red Teaming: Plan and organize red team operations to avoid certain defensive measures within a network
• Behavioral Analytics Development: Construct and test behavioral analytics to detect adversarial behavior within an environment
• Defensive Gap Assessment: Assess tools, monitoring, and mitigations of existing defenses to find gaps
• SOC Maturity Assessment: The matrix can be used as one measure of a SOC’s effectiveness and can signal its maturity in detecting and responding to intrusions
• Cyber Threat Intelligence: Use the MITRE ATT&CK framework to better understand adversary group profiles and popular threat actors
MITRE ATT&CK Framework Mapping Module
ATT&CK Mapping Module is a tool that helps to visualize the various phases of an attack and to understand the relation between them.
The MITRE ATT&CK Framework Mapping Module is a tool created by MITRE, which helps to map out an attack tree. The module provides a visual representation of an attack and its phases. It also indicates the relation between these phases, which helps in understanding how they are connected with each other.
Mitigating ATT&CK Actions
The Mitre ATT&CK framework mitigation module is a collection of mitigations against attacks from at&t & tk. It provides a set of templates to detect and mitigate these types of attacks.
The Mitre ATT&CK framework mitigation module will be updated with new mitigations as they are developed.
The #1 Easy to Learn MITRE ATT&CK Framework Table
ID | Tactic | Description & Techniques |
|---|---|---|
TA0043 | Reconnaissance | The adversary is trying to gather information and use it to plan future actions. Information can be about the host, an identity, network, and an organization. |
TA0042 | Resource Development | The adversary is trying to establish resources they can use to carry out their operations. Resources can be stolen or acquired such as infrastructure, domains, third party services and botnets. |
TA0001 | Initial Access | Adversary is trying to get into the target network. Techniques such as Phishing, exploiting public facing servers, using removable media, stolen credentials. |
TA0002 | Execution | Adversary is trying to run malicious code by using a command or scripting interpreter on the target device. |
TA0003 | Persistence | The adversary is trying to maintain their foothold in the system by executing malicious payloads to auto-start on system boot or run at particular intervals (scheduled tasks), or by creating new accounts/manipulating existing ones in the system. |
TA0004 | Privilege Escalation | The adversary is trying to gain higher level permissions such as Admin rights by manipulating access tokens, creating new processes with tokens, or trigger mechanisms based on events. Some other techniques used are similar to persistence. |
TA0005 | Defense Evasion | The adversary is trying to avoid being detected by defensive mechanisms used in the system by uninstalling or disabling security software, and using masquerading techniques in their malware, removing the logs by deleting the record of events that are taking place. |
TA0006 | Credential Access | The adversary is trying to steal account usernames and passwords by using brute force techniques, by capturing inputs, making the OS dump credentials, by network sniffing, and by stealing or forging Authentication Tickets. |
TA0007 | Discovery | The adversary is trying to figure out the environment of the target such as the network infrastructure and the nodes in the network through Remote System Discovery, Software Discovery, Account Discovery by using native OS tools. |
TA0008 | Lateral Movement | The adversary is trying to move to other hosts in the environment/network by exploiting remote services hosted, hijacking connections, and passing authentication tokens. |
TA0009 | Collection | The adversary is trying to gather information of interest that aligns with their goal before exfiltrating them by archiving the data, storing in central locations in files, by capturing screenshots/video and keyboard input. |
TA0011 | Command & Control (C2) | The adversary is trying to control the systems they have infected by communicating with them stealthily. Communication can happen through encrypted channels, steganography, encoding the data, obfuscation, protocol tunnelling and using non-standard ports. |
TA0010 | Exfiltration | The adversary is trying to steal data by using automated or manual exfiltration techniques through C2 channels or non-C2 channels, USB, using scheduled transfer and implementing data transfer size limits. |
TA0040 | Impact | The adversary is trying to change, destroy the systems and data after exfiltrating it by using techniques such as Account access removal, data encryption/destruction/manipulation, disk wipe, DoS the network to exhaust network bandwidth, stop all services and shutdown the system. |
TOTAL | 14 Tactics | 218 Techniques |
Conclusion: The MITRE ATT&CK Framework
This framework was built with the idea of being able to provide an all-inclusive guide to security testing.
The conclusion of this blog post is that the Mitre Att&ck Framework is a good tool for developers and testers to use when assessing the security of their applications.
Here is the PDF as Promised:
Helⅼo! Do you know if they make any plugins
tⲟ help with SEO? Ӏ’m trүing to get my blog tօ rank for ѕome taｒgeteɗ
keywords but I’m not seeing very good success.
If you know of any рlease share. Thank you!
Hi there!
I can surely help you with this. Try using YOAST SEO or Rank Math. Both are good although yoast is better. I wouldn’t suggest you to go for the pro version. Instead, try to get visitors first through social media channels or any other way. Offer something for free that they would want to visit your blog to get it. Once you have enough visitors and you have indexed your pages, the search engine will automatically rank your pages in search results based on the number of visits to your web page, page view time, and other important factors. From there on, it is easier to build on your SEO strategy and get more visitors to your site.
Hope this helps! And keep updating your blog regularly and make sure you get the pages indexed as soon as you update so that you can start ranking in search engines.