ATT&CK is a knowledge base of adversarial techniques. Unlike prior work in this area, the focus is not on the tools and malware that adversaries use, but on how they interact with systems during an operation.
Four Problems ATT&CK Addresses
- Adversary Behavior
- Lifecycle Models
- Applicability to real environments
- Common taxonomy — TTPs must be comparable across different adversary groups using the same terms
ATT&CK categorizes various techniques under different tactics to add context for each technique and explain why an adversary would perform it.
Vocabulary
Tactics
Tactics answer the "why" of an attack technique — the adversary's objective for performing an action.
- Reconnaissance — gathering information
- Resource Development — establishing resources to support operations
- Initial Access — getting into your network
- Execution — attempting to run malicious code
- Persistence — maintaining a foothold
- Privilege Escalation — gaining higher-level permissions
- Defense Evasion — avoiding detection
- Credential Access — stealing account names and passwords
- Discovery — exploring and gaining knowledge of the environment
- Collection — gathering data of interest
- Command and Control — communicating with and controlling compromised systems
- Lateral Movement — moving through your environment
- Exfiltration — attempting to steal data
Techniques
Techniques outline how an adversary accomplishes a tactical goal by executing specific actions. They can also answer "what" an adversary gains by performing an action.
The ATT&CK Matrix
The ATT&CK Matrix is a visual representation of the relationship between tactics and techniques. Each column is a tactic; the cells within each column are the techniques that fall under it.