Applying ATT&CK to NOC environments

When looking at the ATT&CK framework, you can see that there are Enterprise, Mobile, and Industrial Control System frameworks for different purposes. Under the Enterprise matrices is Network matrix version 12, with the following sub-techniques:

• Initial Access:
  • Exploit Public-Facing Application
  • Valid Accounts
• Execution:
  • Command and Scripting Interpreter:
    • Network Device CLI
• Persistence:
  • Modify Authentication Process:
    • Network Device Authentication
  • Pre-OS Boot:
    • ROMMONkit
    • TFTP Boot
  • Server Software Component:
    • Web Shell
  • Traffic Signaling:
    • Port Knocking
• Privilege Escalation:
  • Valid Accounts
• Defense Evasion:
  • Impair Defenses:
    • Impair Command History Logging
  • Indicator Removal on Host:
    • Clear Command History
    • Clear Network Connection History and Configurations
  • Modify Authentication Process:
    • Network Device Authentication
  • Modify System Image:
    • Patch System Image
    • Downgrade System Image
  • Network Boundary Bridging:
    • Network Address Translation Traversal
  • Pre-OS Boot...