📖 What is MITRE ATT&CK Framework?
The MITRE ATT&CK Framework is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It provides a standardized taxonomy for describing the various stages of a cyberattack, allowing teams to map defenses against specific, documented threat behaviors.
"Look for this when the question mentions 'mapping attacker behavior' or 'standardizing the description of TTPs' (Tactics, Techniques, and Procedures)."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of MITRE ATT&CK Framework?
- ▸ Tactics represent the 'why' of an attack, describing the adversary's strategic goals, such as Initial Access, Persistence, or Exfiltration, across the attack lifecycle.
- ▸ Techniques are the 'how,' detailing the specific methods used to achieve a tactic, such as using Spearphishing with a malicious attachment for access.
- ▸ Procedures are the most granular level, describing the specific sequence of actions or tools a particular threat actor uses to execute a technique.
- ▸ TTPs (Tactics, Techniques, and Procedures) provide a comprehensive behavioral profile of an adversary, allowing testers to emulate real-world threats during an engagement.
- ▸ The framework enables gap analysis by mapping existing security controls against known techniques to identify blind spots in an organization's detection and response capabilities.
🎯 How does MITRE ATT&CK Framework appear on the PT0-002 Exam?
You may be asked to identify the correct Tactic when a scenario describes an attacker creating a new local user account to ensure they can return to the system after a reboot.
A scenario might describe a requirement to emulate a specific APT group; you will need to use the framework to map that group's known TTPs to your test plan.
Expect questions where you must choose the best way to communicate technical findings to a client by mapping the attack path to a standardized industry taxonomy like MITRE ATT&CK.
❓ Frequently Asked Questions
What is the primary difference between a Tactic and a Technique?
A Tactic is the high-level objective the attacker wants to achieve (e.g., Lateral Movement), while a Technique is the specific method used to accomplish that objective (e.g., Pass-the-Hash).
How does MITRE ATT&CK differ from the Lockheed Martin Cyber Kill Chain?
The Kill Chain is a linear model of attack stages. In contrast, ATT&CK is a non-linear matrix of behaviors that can occur repeatedly or in any order during an intrusion.
Why should a penetration tester use this framework in their final report?
It provides a standardized, professional language that helps stakeholders understand the specific risks and behaviors observed, making it easier to prioritize remediation based on real-world threat data.