mitre-attack-framework

name	mitre-attack-framework
description	Apply the MITRE ATT&CK framework for threat intelligence and detection. Provides a universal taxonomy of adversary tactics, techniques, and procedures (TTPs). Use when mapping threats, building detections, or assessing defensive coverage.
tags	mitre, attack-framework, ttps, tactics, techniques, detection, adversary, threat-model, defense, coverage

MITRE ATT&CK Framework⁠‍⁠​‌​‌​​‌‌‍​‌​​‌​‌‌‍​​‌‌​​​‌‍​‌​​‌‌​​‍​​​​​​​‌‍‌​​‌‌​‌​‍‌​​​​​​​‍‌‌​​‌‌‌‌‍‌‌​​​‌​​‍‌‌‌‌‌‌​‌‍‌‌​‌​​​​‍​‌​‌‌‌‌‌‍​‌​​‌​‌‌‍​‌‌​‌​​‌‍‌​‌​‌‌‌​‍​​‌​‌​​​‍‌‌‌​‌​‌‌‍​‌‌‌​‌​‌‍​​​​‌‌‌​‍‌‌‌‌‌‌​​‍‌​‌​‌​​‌‍​​​​‌​‌​‍‌​​‌​​‌​⁠‍⁠

Overview

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally-accessible knowledge base of adversary behavior based on real-world observations. Created by MITRE Corporation, it has become the universal language for describing how adversaries operate.

References

• Website: https://attack.mitre.org/
• Navigator: https://mitre-attack.github.io/attack-navigator/
• GitHub: https://github.com/mitre-attack

Core Philosophy

"Know your adversary."

"You can't defend against what you don't understand."

ATT&CK shifts the focus from IOCs (what attackers use) to TTPs (how attackers behave). This behavioral focus provides more durable detection strategies.

The ATT&CK Matrix Structure

Enterprise ATT&CK Matrix

TACTICS (The "Why" - Adversary Goals)
├── Reconnaissance        ← Gather information
├── Resource Development  ← Build infrastructure  
├── Initial Access        ← Get into the network
├── Execution             ← Run malicious code
├── Persistence           ← Maintain foothold
├── Privilege Escalation  ← Get higher privileges
├── Defense Evasion       ← Avoid detection
├── Credential Access     ← Steal credentials
├── Discovery             ← Learn the environment
├── Lateral Movement      ← Move through network
├── Collection            ← Gather target data
├── Command and Control   ← Communicate with implants
├── Exfiltration          ← Steal data
└── Impact                ← Damage or disrupt

TECHNIQUES (The "How" - Methods Used)
└── Each tactic contains multiple techniques
    └── Techniques may have sub-techniques
        └── Example: T1059.001 (PowerShell) under T1059 (Command and Scripting Interpreter)

Key Components

Component	Description	Example
Tactics	Adversary goals	Credential Access
Techniques	How goals are achieved	OS Credential Dumping (T1003)
Sub-techniques	Specific implementations	LSASS Memory (T1003.001)
Procedures	Real-world examples	APT28 uses Mimikatz
Mitigations	How to prevent	Credential Guard
Detections	How to find	Monitor LSASS access

When Implementing

Always

• Map detections to ATT&CK techniques
• Assess coverage across all tactics
• Use ATT&CK Navigator for visualization
• Reference technique IDs in alerts
• Track adversary groups and their TTPs
• Update mapping as ATT&CK evolves

Never

• Assume full coverage from a few detections
• Ignore techniques without current detections
• Treat ATT&CK as a compliance checklist
• Map inaccurately to inflate coverage
• Forget sub-techniques in analysis

Prefer

• Behavioral detection over signature matching
• Coverage breadth over depth initially
• Technique-based hunting hypotheses
• ATT&CK-aligned threat intelligence
• Continuous coverage assessment

Implementation Patterns

ATT&CK Coverage Assessment

# attack_coverage.py
# Assess and visualize ATT&CK coverage

from dataclasses import dataclass, field
from typing import List, Dict, Optional, Set
from enum import Enum
import json

class CoverageLevel(Enum):
    NONE = 0
    MINIMAL = 1      # Basic detection exists
    PARTIAL = 2      # Some variants covered
    SUBSTANTIAL = 3  # Most variants covered
    COMPREHENSIVE = 4 # Full coverage with validation

@dataclass
class Technique:
    """ATT&CK Technique representation"""
    id: str                          # e.g., "T1003.001"
    name: str                        # e.g., "LSASS Memory"
    tactic: str                      # e.g., "Credential Access"
    platforms: List[str]             # e.g., ["Windows"]
    data_sources: List[str]          # Required telemetry
    
    # Coverage tracking
    detections: List[str] = field(default_factory=list)
    coverage_level: CoverageLevel = CoverageLevel.NONE
    last_validated: [] = 
    

     () -> :
           .


 :
    
    name: 
    techniques: []           
    query: 
    platform:                    
    false_positive_rate: 
    validated:  = 

 :
    
    
     ():
        .techniques: [, Technique] = {}
        .detections: [Detection] = []
        .tactics = [
            , , ,
            , , ,
            , , ,
            , , ,
            , 
        ]
    
     ():
        
        
        
    
     ():
        
        .detections.append(detection)
        
         tech_id  detection.techniques:
             tech_id  .techniques:
                .techniques[tech_id].detections.append(detection.name)
                ._update_coverage_level(tech_id)
    
     ():
        
        tech = .techniques[tech_id]
        detection_count = (tech.detections)
        
         detection_count == :
            tech.coverage_level = CoverageLevel.NONE
         detection_count == :
            tech.coverage_level = CoverageLevel.MINIMAL
         detection_count < :
            tech.coverage_level = CoverageLevel.PARTIAL
         detection_count < :
            tech.coverage_level = CoverageLevel.SUBSTANTIAL
        :
            tech.coverage_level = CoverageLevel.COMPREHENSIVE
    
     () -> [, ]:
        
        results = {}
        
         tactic  .tactics:
            tactic_techs = [t  t  .techniques.values() 
                           t.tactic == tactic]
            
              tactic_techs:
                
            
            covered = (  t  tactic_techs 
                          t.coverage_level != CoverageLevel.NONE)
            
            results[tactic] = {
                : (tactic_techs),
                : covered,
                : (covered / (tactic_techs)) * ,
                : [t.  t  tactic_techs 
                         t.coverage_level == CoverageLevel.NONE]
            }
        
         results
    
     () -> [Technique]:
        
         [t  t  .techniques.values() 
                 t.coverage_level == CoverageLevel.NONE]
    
     () -> [Technique]:
        
        gaps = .identify_gaps()
        
        
        
        
        
        
        high_priority_tactics = [
            , , ,
            , 
        ]
        
        prioritized = (
            gaps,
            key= t: (
                t.tactic  high_priority_tactics,  
                (t.data_sources)                  
            ),
            reverse=
        )
        
         prioritized
    
     () -> :
        
        layer = {
            : ,
            : ,
            : ,
            : ,
            : []
        }
        
        color_map = {
            CoverageLevel.NONE: ,
            CoverageLevel.MINIMAL: ,
            CoverageLevel.PARTIAL: ,
            CoverageLevel.SUBSTANTIAL: ,
            CoverageLevel.COMPREHENSIVE: 
        }
        
         tech  .techniques.values():
            layer[].append({
                : tech.,
                : color_map[tech.coverage_level],
                : 
            })
        
         layer

Technique-Based Detection

# technique_detection.py
# Build detections aligned to ATT&CK techniques

from dataclasses import dataclass
from typing import List, Dict

@dataclass
class ATTACKDetection:
    """Detection rule with full ATT&CK context"""
    
    # ATT&CK mapping
    technique_id: str
    technique_name: str
    tactic: str
    
    # Detection details
    name: str
    description: str
    query: str
    platform: str
    
    # Quality metrics
    severity: str
    confidence: str
    false_positive_guidance: str
    
    # Data requirements
    data_sources: List[str]
    
    # Response
    recommended_response: List[str]
    
    def to_sigma(self) -> str:
        """Export as Sigma rule"""
        return f"""
title: {self.name}
id: {self.technique_id.lower().replace('.', '-')}-detection
status: experimental
description: {self.description}
references:
    - https://attack.mitre.org/techniques/{self.technique_id}/
author: Security Team
date: 2024/01/01
tags:
    - attack.{self.tactic.lower().replace(' ', )}
    - attack.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        # Detection logic here
    condition: selection
falsepositives:
    - 
level: 
"""



lsass_detection = ATTACKDetection(
    technique_id=,
    technique_name=,
    tactic=,
    name=,
    description=
                ,
    query=,
    platform=,
    severity=,
    confidence=,
    false_positive_guidance=,
    data_sources=[],
    recommended_response=[
        ,
        ,
        ,
        
    ]
)

Threat Group Tracking

# threat_groups.py
# Track adversary groups and their TTPs

from dataclasses import dataclass
from typing import List, Set, Dict

@dataclass
class ThreatGroup:
    """Known adversary group with TTPs"""
    
    id: str                          # e.g., "G0007"
    name: str                        # e.g., "APT28"
    aliases: List[str]               # e.g., ["Fancy Bear", "Sofacy"]
    
    # Attribution
    suspected_origin: str
    target_sectors: List[str]
    target_regions: List[str]
    
    # TTPs
    techniques: List[str]            # ATT&CK technique IDs
    
    # Intelligence
    first_seen: str
    last_seen: str
    active: bool
    
    def technique_overlap(self, other: 'ThreatGroup') -> Set[str]:
        """Find common techniques with another group"""
        return set(self.techniques) & set(other.techniques)
    
    def unique_techniques() -> []:
        
        other_techniques = ()
         group  all_groups:
             group. != .:
                other_techniques.update(group.techniques)
        
         (.techniques) - other_techniques


 :
    
    
     ():
        .groups: [, ThreatGroup] = {}
    
     () -> [ThreatGroup]:
        
         [
            g  g  .groups.values()
             (sector  g.target_sectors    g.target_sectors) 
               (region  g.target_regions    g.target_regions) 
               g.active
        ]
    
     () -> [, ]:
        
        relevant = .relevant_groups(sector, region)
        
        technique_counts = {}
         group  relevant:
             tech  group.techniques:
                technique_counts[tech] = technique_counts.get(tech, ) + 
        
        
         ((
            technique_counts.items(),
            key= x: x[],
            reverse=
        ))
    
     () -> []:
        
        priority_techs = .priority_techniques(sector, region)
        
        
        gaps = [
            tech  tech, count  priority_techs.items()
             tech   current_coverage  count >= 
        ]
        
         gaps[:]  

Hunt Hypothesis Generation

# hypothesis_generator.py
# Generate hunt hypotheses from ATT&CK

from dataclasses import dataclass
from typing import List

@dataclass
class HuntHypothesis:
    """ATT&CK-based hunt hypothesis"""
    
    technique_id: str
    technique_name: str
    tactic: str
    
    hypothesis: str
    rationale: str
    
    data_requirements: List[str]
    hunt_query: str
    
    expected_findings: List[str]
    success_criteria: str


def generate_hypotheses(technique_id: str, 
                       technique_data: dict) -> List[HuntHypothesis]:
    """Generate hunt hypotheses for a technique"""
    
    hypotheses = []
    
    # Hypothesis 1: Direct technique detection
    hypotheses.append(HuntHypothesis(
        technique_id=technique_id,
        technique_name=technique_data['name'],
        tactic=technique_data['tactic'],
        hypothesis=f"Adversaries are using {technique_data['name']} "
                   f"in our environment",
        rationale=f"This technique is commonly used by threat groups "
                  f"targeting our sector",
        data_requirements=technique_data['data_sources'],
        hunt_query=technique_data.get('detection_query', ''),
        expected_findings=[
            ,
            ,
            
        ],
        success_criteria=
                        
    ))
    
    
     technique_data.get():
        hypotheses.append(HuntHypothesis(
            technique_id=technique_id,
            technique_name=technique_data[],
            tactic=technique_data[],
            hypothesis=
                       ,
            rationale=,
            data_requirements=technique_data[],
            hunt_query=,
            expected_findings=[, ],
            success_criteria=
        ))
    
     hypotheses

Mental Model

MITRE ATT&CK practitioners ask:

1. What tactic is this? Understand adversary goal
2. What technique? Identify specific method
3. Do we detect this? Assess coverage
4. Who uses this? Threat group attribution
5. What's the gap? Prioritize improvements

Signature ATT&CK Moves

• Technique IDs in all detections and alerts
• Navigator layers for coverage visualization
• Threat group TTP tracking
• Gap analysis by tactic
• Hypothesis generation from techniques
• Continuous coverage assessment