MITRE ATT&CK® framework
Lets understand MITRE ATT&CK framework in simple way.
What is MITRE ATT&CK ?
It was developed and released by MITRE Corporation.A non-profit organization in 2015.Acronym ATT&CK stands for Adversarial Tactics, Techniques and Common Knowledge.It acts as a central resource for organizations for enhancing their cyber security posture.It also helps in understanding and defending against cyber threats.
Whats inside the framework ?
Tactics :- It answers "why" behind the attack.Some of the common tactics are :
Initial Access
Execution
Persistence
Privilege Escalation
Defense Evasion
Lateral Movement
Exfiltration
Techniques :- It answers "how" attacker accomplishes tactics.
Sub-techniques :- It provides additional granularity within techniques. For example Spear phishing
Procedures :- It describes implementation of techniques and sub-techniques.
How can organisations leverage the MITRE ATT&CK framework :-
Threat Detection and Response
Threat Hunting.
Red Teaming.
Security Gap Analysis.