MITRE ATT&CK in practice
Oct 31st, 2022 by Jesper Kråkhede
Back in 2018 I wrote about MITRE Att@ck, as I spelled it then, and how it lets you reuse a very thorough analysis of how attackers actually work. Four years later it has become the common language of the whole industry, so a short summary is in order.
MITRE ATT&CK is a knowledge base of attacker behaviour based on real world observations. It is organised as tactics, the attacker´s goals like initial access, credential access or lateral movement, and techniques, the ways to achieve those goals. Each technique has examples of groups that use it, ideas on how to detect it and how to mitigate it.
How do you use it technically? First, map your detections. Take the alerts and rules in your SOC and mark which techniques they cover. The gaps are your blind spots. Second, use it for threat hunting. Pick a technique used by groups targeting your industry and go look for it in your logs. Third, use it when you test. Red team exercises and attack simulations can be planned and reported per technique, so you know exactly what was detected and what wasn´t. Fourth, use it in incident response. Mapping what the attacker did makes it easier to understand the attack and to share the findings.
Most modern security tools, including the Defender stack, already tag their alerts with ATT&CK techniques. Use that.
Know the playbook your opponent uses.