📖 What is MITRE ATT&CK Framework?
The MITRE ATT&CK Framework is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It provides a common taxonomy for describing how attackers behave, helping analysts map observed activity to known threat actor patterns.
"Study the difference between 'Tactics' (the attacker's goal, like Persistence) and 'Techniques' (how they achieve it, like Registry Run Keys)."
📚 Certification: CompTIA Cybersecurity Analyst+ (CS0-003)
🔑 What are the Key Concepts of MITRE ATT&CK Framework?
- ▸ Tactics represent the 'why' of an attack, describing the adversary's strategic goal, such as achieving Initial Access or maintaining Persistence within a network.
- ▸ Techniques describe the 'how,' detailing the specific methods attackers use to achieve a tactic, such as using Phishing to gain Initial Access.
- ▸ Sub-techniques provide a more granular level of detail, breaking down a general technique into specific implementations for more precise detection and mapping.
- ▸ The framework uses Matrices organized by platform, such as Enterprise or Mobile, allowing analysts to tailor their threat models to specific environments.
- ▸ Mapping observed adversary behavior to the framework helps organizations identify visibility gaps and prioritize the implementation of missing security controls.
🎯 How does MITRE ATT&CK Framework appear on the CS0-003 Exam?
You may be asked to categorize a specific attacker action, such as creating a new local user account, into the correct Tactic, which in this case would be Persistence.
A scenario might describe a security team analyzing a breach report; you will need to explain how mapping these actions to ATT&CK helps identify gaps in current logging.
Expect questions where you must differentiate between a Tactic and a Technique when reviewing a threat intelligence feed to determine the attacker's ultimate objective.
❓ Frequently Asked Questions
How does MITRE ATT&CK differ from a CVE or CAPEC?
CVEs identify specific software vulnerabilities, and CAPECs describe attack patterns. ATT&CK focuses on the post-exploitation behavior and the overall lifecycle of an adversary's campaign.
Can the framework be used for proactive threat hunting?
Yes. Analysts use the framework to hypothesize which techniques an attacker might use based on their profile, then search logs for those specific behavioral indicators.