MITRE ATT&CK

# RoE FIRST. Authorised use only. ATT&CK is a defensive framework; use it to map
# what your detections cover, not as a checklist of things to do offensively.

# ===== What ATT&CK is =====
# A knowledge base of adversary tactics, techniques, and procedures (TTPs) based on
# observed real-world attacks. Free, vendor-neutral, regularly updated.
# Matrices: Enterprise, Mobile, ICS. Sub-matrices for cloud, containers, etc.

# ===== Tactics (the WHY) =====
# Reconnaissance     gather info about the target
# Resource Dev       acquire infrastructure (domains, accounts, exploits)
# Initial Access     get a foothold (phishing, exposed services)
# Execution          run code
# Persistence        survive reboots / cred resets
# Privilege Esc      gain higher privileges
# Defense Evasion    avoid detection
# Credential Access  steal credentials
# Discovery          look around the environment
# Lateral Movement   pivot to other hosts
# Collection         gather data of interest
# Command + Control  comms with the operator
# Exfiltration       send data out
# Impact             destroy / encrypt / disrupt

# ===== Techniques (the HOW) =====
# Each tactic has many techniques + sub-techniques, e.g.:
# Persistence ->
#   T1547 Boot or Logon Autostart Execution
#     T1547.001 Registry Run Keys / Startup Folder
#     T1547.009 Shortcut Modification
# Each has descriptions, examples, detections, mitigations.

# ===== Using ATT&CK defensively =====
# 1. Pick a threat group your industry sees (FIN7, APT29, ransomware affiliate, ...)
# 2. Look up their MAPPED TTPs in ATT&CK
# 3. For each TTP, ask: do we have a detection + a mitigation?
# 4. Track coverage in a heatmap; close the worst gaps first

# ===== Coverage heatmap tools =====
# ATT&CK Navigator   (free; in-browser SVG-style matrix)
# DeTT&CT           open-source coverage scoring
# SIEM vendor maps  (Splunk, Sentinel, Elastic — usually have ATT&CK tagged rules)

# ===== Detections you can write =====
# T1059 Command + Scripting Interpreter   detect powershell.exe / cmd.exe spawned by Office
# T1547 Persistence via run keys           Sysmon EID 13 (RegistryValueSet) on HKCU Run
# T1071 Application Layer Protocol         outbound DNS to newly observed domains
# T1078 Valid Accounts                     impossible-travel logins, MFA fatigue patterns

# ===== Mitigations (controls) =====
# M1026  Privileged Account Management   tiered admin
# M1032  Multi-factor Authentication
# M1041  Encrypt Sensitive Information
# M1050  Exploit Protection              EDR, ASR rules, CFG
# Each technique lists which mitigations apply.

# ===== Tabletop drill template =====
# 1. Pick one technique a quarter
# 2. Walk through: 'How would we detect it?' + 'How would we recover?'
# 3. Run the technique safely in a lab; verify alerts fire
# 4. Write a runbook for response
# 5. Track time-to-detect + time-to-respond

# ===== Pair with engagement reports =====
# Every finding in a pen test or red-team report should cite ATT&CK IDs:
#   - Helps blue team prioritise
#   - Maps to existing detections + mitigations
#   - Creates language across teams

# ===== When ATT&CK wins =====
# - Coverage gap analysis
# - Common vocabulary between red + blue + execs
# - Threat-informed defence
# - Detection engineering prioritisation

# ===== Patterns to internalise =====
# - Tag every detection rule with the ATT&CK IDs it covers
# - Track heatmap coverage and improve it quarterly
# - Use ATT&CK in reports as the lingua franca
# - Combine with D3FEND for the defensive countermeasure side

# ===== Pitfalls =====
# - Treating coverage as boolean (covered / not) rather than depth
# - Mapping rules to too many IDs and gaming the heatmap
# - Ignoring sub-techniques; they are where most detections actually fire
# - Buying products that 'cover ATT&CK' without verifying with detection tests

# MITRE ATT&CK = curated catalogue of real-world attacker techniques.
# Use it to:
#   - frame findings ("T1190 Exploit Public-Facing App")
#   - drive purple-team exercises
#   - map detections in your SIEM
# Reference: attack.mitre.org