Definition:
MITRE ATT&CK Framework is a comprehensive knowledge base that categorizes and describes the tactics, techniques, and procedures (TTPs) that cyber attackers commonly use. It provides a standardized way to understand, detect, and defend against different stages of cyberattacks by mapping out the adversary’s playbook.
Key characteristics:
- Organized by attack lifecycle stages (tactics)
- Documents specific methods (techniques)
- Based on real-world observed attacks
- Used for threat hunting, detection, and security planning
- Regularly updated with new attack methods
Example:
Email Phishing Attack Mapped to ATT&CK Attack Scenario: Hacker targets a company employee through email
📧 Phishing → 💻 Execute → 🔄 Persist → 🔑 Steal Creds → 📁 Collect → 📤 Exfiltrate
Email Malware Startup Passwords Files Data Theft