analysing-attack

Analysing ATT&CK Tactics and Techniques

Overview

This document provides best practices and resources for use when mapping ATT&CK tactics and techniques to threat detections, threat models, security risks or cyber threat intelligence.

Contains information on v18.1 (latest) version of Mitre ATT&CK

Available Resources

Resources folder contains LLM optimised and token-efficient content. Read whole file for broad context or grep or glob for specfic keywords or IDs. Use index files for quick reference keyword searches.

Tactics are abreviated: REC=Reconnaissance, RD=Resource Development, IA=Initial Access, EX=Execution, PE=Persistence, PRV=Privilege Escalation, DE=Defense Evasion, CA=Credential Access, DIS=Discovery, LM=Lateral Movement, COL=Collection, C2=Command and Control, EXF=Exfiltration, IMP=Impact

Searching Examples

By keyword (recommended for discovery): grep -i "cron\|bash\|/proc/\|cryptocurrency" resources/attack_keywords.idx

By technique ID (for validation): grep "T1053" resources/attack_techniques.md

By tactic abbreviation (find all persistance techniques): grep "PE" resources/attack_techniques.md

Resource Files

ATT&CK Technique Keyword Index: Index file for quick keyword searching to identify suitable ATT&CK IDs for further research. Sorted alphabetically and fomatted as keyword:technique_ids (comma seperated when multiple). See -> resources/attack_keywords.idx

ATT&CK Technique List: Markdown table containing ATT&CK ID, name, keywords, description and platforms. Sorted by ID. Use when researching techniques, valdiating IDs, searching for up-to-date descriptions or filtering by platform. See -> resources/attack_techniques.md

ATT&CK Version Changelog: Reference for v15->v18.1 changes including deprecated techniques, renamed platforms, and the v18 detection model overhaul. Use when analysing older reports or understanding structural changes. See -> resources/attack_version_changelog.md

Best Practice

Use your judgment alongside these guidelines to generate high-quality ATT&CK analysis.

• Do not assume your knowledge is 100% complete or up to date. Use the resources provided
• Carefully read any supplied information, perform deep analysis line by line if needed
• Search broadly for keywords, you may need to iterate multiple times to find every correct technique
• Think about the specific procedure being performed and consider the attacker (or defender) intent before determining appropriate tactic, technique or sub-technique
• Some techniques are part of multiple tactics (for ex. T1078 Valid Accounts) and may appear different for each tactic
• Other techniques are similar but distinct depending on tactic (for ex. T1213.003 and T1593.003 are both Code Respositories)
• Map to the most specific sub-technique when possible

When Analysing CTI Reports

• IMPORTANT: Read the whole report fully, including tables of IOCs, appendixes or linked STIX files
• Screenshots contain valuable intelligence, ensure they are processed
• Break down the report into granular procedures when mapping to techniques
• Think about attacker objectives. What did they take that action? What did they hope to achieve?
• Avoid infering techniques that are not contained in the report
• Once initial analysis is complete, perform a second analysis to valdiate your findings and idenitify any missed techniques

When Analysing Detections

• Detection logic may detect multiple techniques, map all that are applicable
• Analyse detection log sources and fields, these can help determine distinct tactics or techniques
• Consider the intent (hypothesis) of the detection, what was the engineers objective?

Commonly Missed Techniques

Command-Line Indicators

-windowstyle hidden|-w hidden -> T1564.003 Hidden Window -encodedcommand|-enc|base64 -> T1027.010 Command Obfuscation