Mitre Attck Reference

<!-- AUTO-GENERATED by export-skills.py — DO NOT EDIT -->
---
name: mitre-attck-reference
description: MITRE ATT&CK Enterprise framework reference for mapping adversary tactics, techniques, and detection guidance
tags: [security, threat-intelligence]
---

# MITRE ATT&CK Framework Reference

## Overview

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally recognized knowledge base of adversary behavior. The Enterprise matrix organizes attack patterns into 14 tactical phases that describe the progression of a cyberattack from initial reconnaissance through final impact. Security agents use ATT&CK to classify incidents, build detection logic, identify coverage gaps, and communicate threats using a shared vocabulary.

The Enterprise matrix covers behaviors observed against Windows, macOS, Linux, cloud (AWS, Azure, GCP), network infrastructure, and container environments. Each technique has a unique identifier (e.g., T1566) and may include sub-techniques (e.g., T1566.001).

## When to Use This Skill

- Classifying security incidents against a standardized taxonomy
- Building or reviewing detection rules that need ATT&CK technique references
- Performing threat coverage gap analysis across your detection stack
- Writing incident reports that require ATT&CK mapping
- Evaluating adversary emulation plans or red team findings
- Correlating threat intelligence feeds with internal telemetry

## How It Works

### Step 1: Identify the Tactic

Determine which tactical phase the observed activity falls under. The 14 Enterprise tactics in kill-chain order are:

| ID    | Tactic                  | Description                                      |
|-------|-------------------------|--------------------------------------------------|
| TA0043 | Reconnaissance         | Gathering information to plan an attack           |
| TA0042 | Resource Development   | Establishing infrastructure and capabilities      |
| TA0001 | Initial Access         | Gaining a foothold in the target environment      |
| TA0002 | Execution              | Running malicious code                            |
| TA0003 | Persistence            | Maintaining access across restarts                |
| TA0004 | Privilege Escalation   | Gaining higher-level permissions                  |
| TA0005 | Defense Evasion        | Avoiding detection                                |
| TA0006 | Credential Access      | Stealing credentials                              |
| TA0007 | Discovery              | Understanding the environment                     |
| TA0008 | Lateral Movement       | Moving through the network                        |
| TA0009 | Collection             | Gathering data of interest                        |
| TA0011 | Command and Control    | Communicating with compromised systems            |
| TA0010 | Exfiltration           | Stealing data out of the network                  |
| TA0040 | Impact                 | Disrupting availability or integrity              |

### Step 2: Map the Technique

Within the identified tactic, select the specific technique that matches the observed behavior. Key techniques per tactic:

**Reconnaissance (TA0043):** T1595 Active Scanning, T1592 Gather Victim Host Info, T1589 Gather Victim Identity Info, T1590 Gather Victim Network Info, T1593 Search Open Websites/Domains, T1594 Search Victim-Owned Websites

**Resource Development (TA0042):** T1583 Acquire Infrastructure, T1586 Compromise Accounts, T1584 Compromise Infrastructure, T1587 Develop Capabilities, T1585 Establish Accounts, T1588 Obtain Capabilities

**Initial Access (TA0001):** T1566 Phishing, T1190 Exploit Public-Facing App, T1133 External Remote Services, T1078 Valid Accounts, T1195 Supply Chain Compromise, T1199 Trusted Relationship

**Execution (TA0002):** T1059 Command and Scripting Interpreter, T1204 User Execution, T1203 Exploitation for Client Execution, T1047 WMI, T1053 Scheduled Task/Job, T1569 System Services

**Persistence (TA0003):** T1053 Scheduled Task/Job, T1547 Boot/Logon Autostart, T1136 Create Account, T1098 Account Manipulation, T1543 Create/Modify System Process, T1546 Event Triggered Execution

**Privilege Escalation (TA0004):** T1548 Abuse Elevation Control, T1134 Access Token Manipulation, T1068 Exploitation for Privilege Escalation, T1078 Valid Accounts, T1547 Boot/Logon Autostart, T1055 Process Injection

**Defense Evasion (TA0005):** T1070 Indicator Removal, T1036 Masquerading, T1027 Obfuscated Files, T1055 Process Injection, T1218 System Binary Proxy Execution, T1562 Impair Defenses, T1112 Modify Registry

**Credential Access (TA0006):** T1110 Brute Force, T1555 Credentials from Password Stores, T1003 OS Credential Dumping, T1558 Steal or Forge Kerberos Tickets, T1539 Steal Web Session Cookie, T1552 Unsecured Credentials

**Discovery (TA0007):** T1087 Account Discovery, T1083 File and Directory Discovery, T1057 Process Discovery, T1018 Remote System Discovery, T1082 System Information Discovery, T1016 System Network Configuration

**Lateral Movement (TA0008):** T1021 Remote Services, T1570 Lateral Tool Transfer, T1080 Taint Shared Content, T1550 Use Alternate Authentication Material, T1563 Remote Service Session Hijacking

**Collection (TA0009):** T1560 Archive Collected Data, T1119 Automated Collection, T1005 Data from Local System, T1039 Data from Network Shared Drive, T1114 Email Collection, T1056 Input Capture

**Command and Control (TA0011):** T1071 Application Layer Protocol, T1132 Data Encoding, T1573 Encrypted Channel, T1105 Ingress Tool Transfer, T1090 Proxy, T1572 Protocol Tunneling, T1571 Non-Standard Port

**Exfiltration (TA0010):** T1041 Exfiltration Over C2 Channel, T1048 Exfiltration Over Alternative Protocol, T1567 Exfiltration Over Web Service, T1029 Scheduled Transfer, T1030 Data Transfer Size Limits

**Impact (TA0040):** T1486 Data Encrypted for Impact, T1489 Service Stop, T1490 Inhibit System Recovery, T1485 Data Destruction, T1498 Network Denial of Service, T1496 Resource Hijacking

### Step 3: Find Sub-Techniques

Many techniques have sub-techniques that provide finer granularity. For example:
- T1566.001 - Phishing: Spearphishing Attachment
- T1566.002 - Phishing: Spearphishing Link
- T1566.003 - Phishing: Spearphishing via Service
- T1566.004 - Phishing: Spearphishing Voice

Always map to the most specific sub-technique available to improve detection precision and reporting accuracy.

### Step 4: Identify Detection Data Sources

Each technique in ATT&CK lists recommended data sources. Common data source categories:

| Data Source              | Log Types                                          |
|--------------------------|-----------------------------------------------------|
| Process                  | Sysmon (Event 1), EDR telemetry, auditd             |
| Network Traffic          | Zeek/Bro logs, firewall logs, DNS logs, proxy logs   |
| File                     | Sysmon (Event 11, 15), file integrity monitoring     |
| Command                  | PowerShell ScriptBlock (4104), Bash history          |
| User Account             | Windows Security (4624, 4625, 4720), LDAP audit      |
| Cloud Service            | CloudTrail, Azure Activity Log, GCP Audit Log        |
| Application Log          | Web server access logs, application audit logs       |
| Windows Registry         | Sysmon (Event 12, 13, 14), Windows Security          |

### Step 5: Build Detection Rules

Use the mapped technique and data sources to create detection rules in your SIEM or detection platform. Reference the ATT&CK technique ID in every rule for traceability.

## Examples

### Example 1: Mapping a Phishing Attack to ATT&CK

Scenario: A user received an email with a malicious Word document attachment. Opening it executed a PowerShell download cradle.

ATT&CK mapping:
- **Tactic:** Initial Access (TA0001)
- **Technique:** T1566.001 - Phishing: Spearphishing Attachment
- **Follow-on Tactic:** Execution (TA0002)
- **Follow-on Technique:** T1059.001 - Command and Scripting Interpreter: PowerShell

Detection data sources:
- Email gateway logs (attachment metadata, sender reputation)
- Sysmon Event 1 (process creation: WINWORD.EXE spawning powershell.exe)
- PowerShell ScriptBlock Logging (Event 4104)
- Network traffic (outbound HTTP/HTTPS to uncommon domains)

### Example 2: Mapping Lateral Movement to ATT&CK

Scenario: An attacker used stolen credentials to establish RDP sessions across multiple internal hosts.

ATT&CK mapping:
- **Tactic:** Lateral Movement (TA0008)
- **Technique:** T1021.001 - Remote Services: Remote Desktop Protocol
- **Supporting Tactic:** Credential Access (TA0006)
- **Supporting Technique:** T1078 - Valid Accounts

Detection data sources:
- Windows Security Event 4624 (Type 10 - RemoteInteractive logon)
- Windows Security Event 4625 (failed logon attempts)
- Network traffic (port 3389 connections between internal hosts)
- EDR telemetry (new RDP client processes on workstations)

### Example 3: YAML-Based Detection Rule Referencing ATT&CK

```yaml
title: Suspicious PowerShell Download Cradle
id: 7f3b2a1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: production
description: >
  Detects PowerShell commands commonly used as download cradles,
  often observed after initial access via phishing attachments.
references:
  - https://attack.mitre.org/techniques/T1059/001/
  - https://attack.mitre.org/techniques/T1566/001/
tags:
  - attack.execution
  - attack.t1059.001
  - attack.initial_access
  - attack.t1566.001
logsource:
  product: windows
  category: ps_script
  definition: "PowerShell ScriptBlock Logging (Event 4104) must be enabled"
detection:
  selection_keywords:
    ScriptBlockText|contains:
      - "Invoke-WebRequest"
      - "Invoke-RestMethod"
      - "Net.WebClient"
      - "Start-BitsTransfer"
      - "DownloadFile"
      - "DownloadString"
  selection_execution:
    ScriptBlockText|contains:
      - "Invoke-Expression"
      - "IEX"
      - "-enc"
      - "-EncodedCommand"
  condition: selection_keywords and selection_execution
  timeframe: 5m
level: high
falsepositives:
  - Legitimate admin scripts that download and execute content
  - Software deployment tools using PowerShell
```

## Best Practices

### Do This

- Always map incidents to the most specific sub-technique available
- Include ATT&CK technique IDs in all detection rule metadata
- Perform quarterly coverage gap analysis using ATT&CK Navigator
- Cross-reference threat intelligence reports with your ATT&CK heat map
- Use ATT&CK data sources to validate that required telemetry is collected
- Link detection rules to response playbooks via shared technique IDs
- Track technique prevalence using threat reports (e.g., Red Canary, Mandiant)

### Don't Do This

- Do not map only to the tactic level; always identify the specific technique
- Do not assume one detection rule covers an entire technique and all sub-techniques
- Do not ignore the data source requirements; a rule is useless without the right logs
- Do not treat ATT&CK as a compliance checklist; prioritize based on threat landscape
- Do not forget to update mappings when ATT&CK releases new versions (typically biannual)
- Do not create detection rules without testing them against both true positive and benign samples

## Security Checklist

- [ ] All known incidents are mapped to ATT&CK techniques with sub-technique granularity
- [ ] Detection rules include ATT&CK technique IDs in metadata/tags
- [ ] ATT&CK Navigator layer is generated showing current detection coverage
- [ ] Coverage gaps are identified and prioritized by threat relevance
- [ ] Required data sources for high-priority techniques are actively collected
- [ ] Detection rules are tested against adversary emulation (e.g., Atomic Red Team)
- [ ] Response playbooks reference corresponding ATT&CK techniques
- [ ] Threat intelligence feeds are correlated with ATT&CK technique mappings
- [ ] ATT&CK mappings are reviewed and updated with each framework release
- [ ] Coverage metrics are reported to stakeholders (percentage of techniques detected)

## Related Skills

- @sigma-rules-guide - Writing and managing Sigma detection rules with ATT&CK tags
- @ir-playbook-templates - Incident response playbooks linked to ATT&CK techniques
- @cve-epss-guide - Vulnerability prioritization that maps CVEs to ATT&CK techniques

## Additional Resources

- [MITRE ATT&CK Enterprise Matrix](https://attack.mitre.org/matrices/enterprise/)
- [ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/) - Interactive coverage visualization
- [Atomic Red Team](https://github.com/redcanaryco/atomic-red-team) - Technique validation tests
- [MITRE CAR (Cyber Analytics Repository)](https://car.mitre.org/) - Detection analytics mapped to ATT&CK
- [ATT&CK STIX Data](https://github.com/mitre-attack/attack-stix-data) - Machine-readable ATT&CK content
- [D3FEND](https://d3fend.mitre.org/) - Defensive technique knowledge graph linked to ATT&CK

<!-- Source: .faos/custom/skills/security/mitre-attck-reference/SKILL.md -->