Module 4 · MITRE ATT&CK in Operations 🔒

MITRE ATT&CK is the industry’s shared language for describing how adversaries operate. It is a taxonomy of 14 tactics, 200+ techniques, and 500+ sub-techniques, updated continuously. Used well, it structures CTI reports, maps detection coverage, scopes red-team exercises, and communicates across teams. Used as a checklist to pad reports, it produces noise. This module covers operational use of ATT&CK.

Structure of ATT&CK

• Tactic — the adversary’s goal (Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, plus Reconnaissance and Resource Development for the pre-compromise phase)
• Technique — how they achieve it (T1059 Command and Scripting Interpreter)
• Sub-technique — specific variant (T1059.001 PowerShell, T1059.003 Windows Command Shell)
• Procedure — exactly how a specific actor used the technique (free-form text, tied to group / software records)

ATT&CK also tracks Groups (named threat actors) and Software (malware and tools), each linked to the techniques they use.

The matrices

ATT&CK has several matrices, each scoped to a platform:

• Enterprise — Windows, macOS, Linux, IaaS, SaaS, Office 365, Azure AD, Network, Containers
• Mobile — Android, iOS
• ICS — industrial control systems

Use the matrix relevant to your environment. Cloud and SaaS-heavy organisations: focus on the cloud-specific tactics within Enterprise.

Operational uses

1. Describe a threat group

Every threat report should include an ATT&CK mapping: “APT29 uses T1566.002 (spearphishing link), T1059.001 (PowerShell), T1078.004 (valid cloud accounts)…” This lets defenders parse the report into detection work: “what techniques do we lack coverage for?”