MITRE ATT&CK Framework for SOC Analysts

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a curated knowledge base that models the behavior of cyber adversaries. It was developed by MITRE Corporation starting in 2013 to address the need for a standardized taxonomy of attacker actions. Before ATT&CK, organizations used disparate frameworks (Lockheed Martin's Cyber Kill Chain, Diamond Model) that lacked the granularity needed for modern threat hunting and detection engineering. ATT&CK fills this gap by providing a matrix of tactics (the 'why' behind an action) and techniques (the 'how'). The framework is vendor-neutral and community-driven, with contributions from security researchers worldwide. It is regularly updated to reflect new attack patterns, making it the de facto standard for threat intelligence sharing.

ATT&CK is organized into a matrix where columns represent tactics (e.g., Initial Access, Execution, Persistence) and rows represent techniques. Each technique is assigned a unique ID (e.g., T1566 for Phishing) and may have sub-techniques (e.g., T1566.001 for Spearphishing Attachment). The matrix is available for multiple platforms: Enterprise (Windows, macOS, Linux, Cloud, Network), Mobile (iOS, Android), and ICS (Industrial Control Systems). The CS0-003 exam focuses on the Enterprise matrix.

Key components: - Tactics: The adversary's goal or reason for performing an action. There are 14 tactics in the Enterprise matrix: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact. - Techniques: The specific method used to achieve a tactic. For example, under Persistence, one technique is 'Create Account' (T1136). - Sub-techniques: More specific variations of a technique. For example, 'Create Account: Local Account' (T1136.001) vs. 'Domain Account' (T1136.002). - Procedures: The exact implementation of a technique by a specific threat actor group. For example, APT29 uses PowerShell to create local accounts. - Mitigations: Recommendations to prevent or detect the technique (e.g., M1032 for Multi-factor Authentication). - Detections: Specific data sources and analytics to identify the technique (e.g., Windows Event ID 4720 for account creation).

The matrix is available online at attack.mitre.org. For exam purposes, you should understand how to read a technique page. Each technique page includes: - ID: e.g., T1059 - Name: e.g., Command and Scripting Interpreter - Description: Detailed explanation of the technique. - Tactics: The tactic(s) the technique can be used for (e.g., Execution). - Platforms: e.g., Windows, Linux, macOS. - Permissions Required: e.g., User, Administrator. - Data Sources: e.g., Process creation logs, PowerShell logs. - Mitigations: e.g., Restrict PowerShell execution policy. - Detection: e.g., Monitor for suspicious PowerShell commands. - Examples: Real-world use by threat groups.

SOC analysts use ATT&CK for several purposes: 1. Alert Triage: When an alert fires, map it to a technique to understand the adversary's intent. For example, a suspicious outbound connection on port 443 might be Command and Control (T1071.001). 2. Detection Engineering: Create rules based on ATT&CK techniques. For example, a Sigma rule for 'PowerShell Download Cradles' maps to T1059.001. 3. Threat Intelligence: When a new threat group is identified, look up their techniques in ATT&CK to understand their capabilities and prioritize defenses. 4. Gap Analysis: Assess which techniques your current detection coverage lacks and build new detections. 5. Incident Response: Use ATT&CK to map the attack chain and ensure all stages are addressed.

While the exam does not require memorizing all techniques, you should be familiar with common ones: - Initial Access: T1566 (Phishing), T1190 (Exploit Public-Facing Application), T1078 (Valid Accounts) - Execution: T1059 (Command and Scripting Interpreter), T1204 (User Execution), T1047 (Windows Management Instrumentation) - Persistence: T1136 (Create Account), T1053 (Scheduled Task/Job), T1098 (Account Manipulation) - Privilege Escalation: T1548 (Abuse Elevation Control Mechanism), T1068 (Exploitation for Privilege Escalation) - Defense Evasion: T1562 (Impair Defenses), T1070 (Indicator Removal on Host), T1055 (Process Injection) - Credential Access: T1003 (OS Credential Dumping), T1555 (Credentials from Password Stores), T1110 (Brute Force) - Discovery: T1087 (Account Discovery), T1069 (Permission Groups Discovery), T1518 (Software Discovery) - Lateral Movement: T1021 (Remote Services), T1550 (Use Alternate Authentication Material), T1570 (Lateral Tool Transfer) - Collection: T1005 (Data from Local System), T1119 (Automated Collection), T1560 (Archive Collected Data) - Command and Control: T1071 (Application Layer Protocol), T1573 (Encrypted Channel), T1095 (Non-Application Layer Protocol) - Exfiltration: T1048 (Exfiltration Over Alternative Protocol), T1567 (Exfiltration Over Web Service), T1020 (Automated Exfiltration) - Impact: T1485 (Data Destruction), T1496 (Resource Hijacking), T1499 (Endpoint Denial of Service)

ATT&CK complements the Cyber Kill Chain by providing more granular detail within each phase. The Diamond Model focuses on the relationships between adversary, capability, infrastructure, and victim; ATT&CK techniques can be used to describe the capability. Additionally, ATT&CK is often used alongside the NIST Cybersecurity Framework to map technical controls to functions like Detect and Respond.

Consider a ransomware attack: 1. Initial Access: Spearphishing email with malicious attachment (T1566.001). 2. Execution: User opens the attachment, which runs a macro (T1204.002). 3. Persistence: The macro downloads a scheduled task to run daily (T1053.005). 4. Defense Evasion: The script disables Windows Defender (T1562.001). 5. Credential Access: The ransomware dumps credentials using Mimikatz (T1003.001). 6. Lateral Movement: Uses RDP with stolen credentials (T1021.001). 7. Impact: Encrypts files on all accessible systems (T1486).

Each step corresponds to an ATT&CK technique, allowing defenders to build detections for each stage.

The ATT&CK Navigator is a web-based tool for visualizing and analyzing coverage. It allows you to create layers that highlight techniques you have detections for, techniques used by specific threat groups, or techniques you want to prioritize. You can export layers as JSON or share them with your team. The exam may ask about the purpose of the Navigator.

While ATT&CK is not a tool you configure, you might use it to generate detection rules. For example, to detect 'Scheduled Task' (T1053.005), you could create a Sysmon rule:

<Sysmon eventid="1" onmatch="include">
  <Rule name="Scheduled Task Creation" groupRelation="or">
    <Image condition="contains">schtasks.exe</Image>
    <CommandLine condition="contains">/create</CommandLine>
  </Rule>
</Sysmon>

Or a Windows Event Log query:

Event ID 4698 (Scheduled Task Created)

MITRE ATT&CK is the foundational framework for modern cyber defense. By understanding its structure and how to apply it, you can improve detection, response, and communication. On the CS0-003 exam, expect scenario-based questions where you must identify the technique or tactic from a description of an attack.

A large enterprise receives alerts for multiple users clicking links in phishing emails. The SOC analyst uses ATT&CK to map the initial click to T1566.002 (Spearphishing Link). Further investigation reveals that the links download a JavaScript file, which maps to T1059.007 (JavaScript). The analyst then checks for post-execution behavior: the JavaScript creates a scheduled task for persistence (T1053.005). By mapping each step, the SOC can prioritize detection for the entire chain. In this environment, the SIEM is configured with ATT&CK tags on alerts, allowing automated triage. Common misconfiguration: tagging only the initial technique and missing lateral movement, leading to incomplete incident response.

A threat hunter proactively searches for credential dumping techniques. They create a hypothesis: 'Attackers may use T1003.001 (LSASS Memory) to dump credentials.' They query Windows Event Logs for Event ID 4688 with ProcessName = 'procdump.exe' or 'mimikatz.exe'. They also look for suspicious access to lsass.exe (Event ID 10 from Sysmon). By focusing on ATT&CK techniques, the hunt is guided and efficient. In production, they use the ATT&CK Navigator to visualize coverage gaps. A common issue: false positives from legitimate administration tools; analysts must tune detections by excluding known good processes (e.g., legitimate Procdump from Microsoft).

During a ransomware incident, responders map the attack using ATT&CK. They identify initial access via RDP brute-force (T1110.001), then privilege escalation via exploitation of a local vulnerability (T1068), and finally impact via data encryption (T1486). This mapping helps them contain the attack by blocking RDP (mitigation for T1110) and applying patches (mitigation for T1068). They also discover that the ransomware used a custom tool to disable Windows Defender (T1562.001). Performance consideration: during active incident, mapping should be done quickly; pre-built playbooks based on ATT&CK can save time. Misconfiguration: failing to map the entire chain can leave backdoors undetected.