What Is the ATT&CK Framework?

This chapter will outline the evolution of the ATT&CK Framework and the various different high-level configurations for types of systems (i.e., cloud, mobile, Windows, etc.). It will also be the first introduction to related use cases. We will cover the following topics:

• A brief history and evolution of ATT&CK
• Overview of the various ATT&CK models

A brief history and evolution of ATT&CK

The ATT&CK Framework is obviously the main portion of the book, so let’s start with the basics and learn about the history, purpose, categories, and overview of different models within this chapter.

The MITRE ATT&CK Framework was founded in 2015. It started off as a total of 9 tactics and 96 techniques and quickly gained traction for how threats and attacks were categorized and organized in security. It currently stands at version 11, released in April 2022, which has 14 tactics, 191 techniques, 386 sub-techniques, and 134 groups, and covers 680 pieces of software. It remains one of the top comprehensive knowledge bases out there. Over the years, it has included specific operating systems and different types of infrastructures and environments, making it a more practical framework for categorizing threats against your environment as a whole. The growth from 2015 to 2022 alone shows the amount of work that has gone into identifying...

Overview of the various ATT&CK models

As mentioned, the MITRE ATT&CK Framework has evolved to include multiple different models based on operating systems and environments. Currently, these are the following models:

• Windows
• macOS
• Linux
• Network
• Containers
• Office 365
• Azure AD
• Google Workspaces
• Software as a Service (SaaS)
• Infrastructure as a Service (IaaS)
• Android
• iOS
• Industrial Control System (ICS)

These models are meant to be used in a pick-and-choose manner so that, as an end user, you are able to select the techniques and matrices that apply to your environment and mix and match options as needed. We’ll take a deep-dive into quite a few of the different models by looking at the types of techniques and comparison of the different models through future chapters. However, from a basic point of view, they are all initially based on a version of the Cyber Kill Chain framework. The Cyber Kill Chain framework...

Summary

The MITRE ATT&CK Framework is important to understand and have as part of your foundation of information for a career in information security. The building blocks, such as how the matrices are used, how to build detections ranging from novice to expert in the depth of understanding, and learning new techniques due to the continued evolution of the matrices, keep you current in this industry.

In the next chapter, we’ll begin our first of multiple deep-dives by looking at the enterprise-level matrices. We’ll cover a large sampling of techniques, sub-techniques, detections, and mitigations. We’ll also talk through real-world examples of implementing those detections and mitigations and the risks that can be associated with those techniques if they were to be exploited.