Understanding cyber threats requires more than knowing the latest tech terms; it demands a deep understanding of cyber attackers' tactics, techniques, and procedures. Understanding cyber attackers' tactics is where the MITRE ATT&CK Framework proves invaluable. It's a comprehensive guide that outlines the behavior of cyber adversaries across multiple platforms, including Windows, Linux, macOS, mobile, and cloud systems. The Framework doesn't just list attacks; it provides a detailed glimpse at how attackers execute cyber attacks, offering insights into the entire lifecycle of cyber threats.

The MITRE ATT&CK Framework is essential for cybersecurity activities like adversary emulation, red teaming, and behavioral analytics development. It helps professionals identify and understand the nuances of cyber attacks, enabling them to develop more robust defense mechanisms. Including procedures in the Framework, such as how specific groups might use Microsoft PowerShell for malicious activities, adds depth to this understanding.

This post will guide you through the MITRE ATT&CK Framework, demonstrating its critical role in modern cybersecurity and its varied industry applications. Suppose you're involved in cybersecurity, manage a business, or are simply keen on learning about cybersecurity. In that case, this article will give you the knowledge to better protect against cyber threats. Let's delve into the MITRE ATT&CK Framework and learn how it helps enhance cybersecurity strategies.

Defining MITRE ATT&CK

At its core, MITRE ATT&CK is a globally accessible knowledge base that documents adversary tactics, techniques, and procedures (TTPs) based on real-world observations. Developed initially to improve malicious behavior detection in Microsoft Windows systems, it has grown to encompass tactics for Linux, macOS, mobile devices, cloud-based systems, and industrial control systems. The MITRE ATT&CK Framework is currently on version 14 and has been organized into several core components:

  • MITRE ATT&CK Tactics represent the short-term goals adversaries aim to achieve during an attack. There are 14 Tactics that the MITRE ATT&CK Framework identifies.
  • MITRE ATT&CK Techniques are the methods adversaries use to achieve their tactical objectives.
  • MITRE ATT&CK Sub-techniques provide a more granular view of the methods used, detailing specific approaches within a broader technique.
  • MITRE ATT&CK Procedures document how adversaries implement techniques and sub-techniques, often spanning multiple ATT&CK techniques.

As mentioned, there are 14 tactics that the MITRE ATT&CK Framework called out.

  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Defense Evasion
  8. Credential Access
  9. Discovery
  10. Lateral Movement
  11. Collection
  12. Command and Control
  13. Exfiltration
  14. Impact

The Importance of the MITRE ATT&CK Framework

MITRE ATT&CK is a tool many organizations use to help guide their cyber-defense strategy. Businesses can use the MITRE ATT&CK Framework for various cybersecurity activities, including threat intelligence, detection and analytics, adversary emulation, and red teaming. It helps cybersecurity professionals identify and understand cyber attacks and develop robust strategies and solutions to mitigate them. By offering a detailed view of the attack lifecycle and adversary behavior, the framework enables a more proactive and informed approach to cyber defense. Because so many companies use the MITRE ATT&CK Framework, it's helpful to know when looking for a job in the cybersecurity field.

Understanding cyber attacks is critical and the first step in building an organization's defenses. Organizations can combine The MITRE ATT&CK Framework with complementary frameworks focusing on detecting, preventing, or mitigating cyber attacks. We recommend leveraging the Center for Internet Security (CIS) Controls with MITRE ATT&CK to map adversary tactics to cyber defense controls. We've published additional information on the CIS Controls here.

Examples of How to Use MITRE ATT&CK Framework

Now that we understand the MITRE ATT&CK Framework and its intent let's provide an example of how a security analyst can use the ATT&CK Framework to help identify adversary activities. We will begin with a simple technique within the MITRE ATT&CK Framework: Validate Accounts. This Technique lives within the Initial Access tactic. An excerpt from the Valid Accounts pages describes this Technique as:

"Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop."

The Valid Account Technique has four Sub-Techniques, the Sub-Techniques are:

  1. Default Accounts
  2. Domain Accounts
  3. Local Accounts
  4. Cloud Accounts

You can watch for these actions if you're responsible for monitoring an environment. Let's use a real example to illustrate the point. Your boss gives you the task of installing a Security Incident and Event Management (SIEM) platform, choosing the open-source platform Wazuh.  Wazuh is an open-source SIEM platform, which you can install locally on a cloud platform to reduce costs.   You chose the Docker installation because the environment is small enough to run the Wauh platform on a single server. You follow the Wazuh Docker installation guide and see that the default username and password are admin and SecretPassword.

If you forget to change the admin account password on your Wazuh application and leave this system accessible to the Internet, the configuration will expose you to the MITRE ATT&CK Default Accounts technique.

Another example of the Valid Account technique from the MITRE ATT&CK Framework would be a situation of password reuse. What is password reuse? It's when an individual uses duplicate account names and password combinations across several platforms. Suppose an employee signs up for services using their work ID, usually their email, and they use the same password. In that case, they open the door to password reuse attacks. This kind of activity happens so frequently that the website haveibeenpwned.com is dedicated to seeing if a username and password combination has been in a data breach.

How to Leverage MITRE ATT&CK Effectively

If you are attempting to learn how to use the MITRE ATT&CK Framework effectively, you can begin in one of two ways. Select the tactic that interests you the most. It could be reconnaissance or privilege escalation. Examine each technique and sub-technique from top to bottom within that tactic. For example, under the reconnaissance tactic, the first technique is Active Scanning. Be sure you read and comprehend the description of the technique, and do the same for each sub-technique, including:

A comprehensive understanding of the MITRE ATT&CK Framework benefits offensive (red team) and defensive (blue team) cybersecurity professionals.

If you would like to learn more about the controls you can put in place to mitigate the risks presented in the MITRE ATT&CK Framework, check out our article about the Center for Internet Security Controls