What is ATTACK

What is ATT&CK?

ATT&CK is a knowledge base of adversarial techniques. However, unlike prior work in this area, the focus isn't on the tools and malware that adversaries use but on how they interact with systems during an operation.

Addresses Four Main Issues:

1. Adversary Behavior
2. Lifecycle Models
3. Lifecycle Models
4. Applicability to real environments.
5. Common taxonomy - TTPs must be able to be compared across different types of adversary groups using the same terms.

ATT&CK categorizes various techniques under different tactics to help explain and add context for the technique.

Vocabulary Terms

Tactics - answers the "why" question of an attack technique, explaining the adversary's objective for performing an action.

1. Reconnaissance - gathering information
2. Resource Development - working to establish resources that can be used to support operations.
3. Initial Access - The adversary tries to get into your network.
4. Execution - attempting to run malicious code.
5. Persistence - an adversary is trying to keep their foothold.
6. Privilege Escalation - attempt to gain higher-level permissions.
7. Defense Evasion - attempt to keep from being detected.
8. Credential Access -trying to steal account names and passwords.
9. Discovery - exploring and gaining knowledge of the environment.
10. Collection - gathering data of interest to their goal
11. Command and Control -trying to communicate with compromised systems to control them.
12. Lateral Movement - attempting to move through your environment.
13. Collection - gathering data of interest to their goal.
14. Command and Control - trying to communicate with compromised systems to control them.
15. Exfiltration - attempting to steal data.

Techniques Techniques outline how an adversary accomplishes a tactical goal by executing specific actions. Techniques can also answer "What" by explaining what an adversary gains by performing an action.

ATT&CK Matrix

The ATT&CK Matrix is a visual representation of the relationship between tactics and techniques.

* Title uses Mitre ATTACK instead of MITRE ATT&CK due to template url limitations.