Skip to main content
Core Security Logo Core Security Logo
  • Contact Us
  • Support
  • All Fortra Products
  • FREE TRIALS
  • Contact Us
  • Support
  • All Fortra Products
  • FREE TRIALS
  • Cyber Threat

      Products

      • Core Impact Penetration testing software
      • Cobalt Strike Red team software
      • Outflank Security Tooling (OST) Evasive attack simulation
      • Event Manager Security information and event management
      • Powertech Antivirus Server-level virus protection
      • Product Bundles

      Solutions

      • Penetration Testing
      • Penetration Testing Services
      • Offensive Security
      • Threat Detection
      • Security Information and Event Management
    • Penetration Testing Services Security consulting services
  • Identity

      Products

      • Access Assurance Suite User provisioning and governance
      • Core Password & Secure Reset Self-service password management
      • Core Privileged Access Manager (BoKS) Privileged access management (PAM)

      Solutions

      • Privileged Access Management
      • Identity Governance & Administration
      • Password Management
    • See How to Simplify Access in Your Organization | Request a Demo
  • Industries
    • Healthcare
    • Financial Services
    • Federal Government
    • Retail
    • Utilities & Energy
    • Higher Education
    • Compliance
  • Resources
    • Upcoming Webinars & Events
    • Blogs
    • Case Studies
    • Videos
    • Datasheets
    • Guides
    • Ecourses
    • Compliance
    • All Resources
  • CoreLabs
    • Advisories
    • Exploits
    • Publications
    • Articles
    • Open Source Tools
  • About
    • Partners
    • Careers
    • Press Releases
    • Contact Us
  1. Home
  2. Blog
  3. What is the MITRE ATT&CK® Framework?

What is the MITRE ATT&CK® Framework?

The MITRE ATT&CK Framework was created in 2013 to create a comprehensive document of tactics, techniques, and procedures that cyber attackers were regularly using to breach the defenses of individuals and organizations. Since then, it has grown to be a global knowledge base that has helped to standardize defensive security and remains accessible to all security professionals.

This framework continues to be regularly updated and helps to bring together the intelligence of cybersecurity experts around the world in order to better defend against the ever-growing threat landscape. In this blog, we’ll take a closer look at the different aspects of MITRE ATT&CK and how it can be incorporated into your security practices.

The Components of the MITRE ATT&CK® Framework

The ATT&CK Matrix consists of two main parts: tactics and techniques.

Tactics are the high-level categories of attacks and focus on the primary goal of the attack. There are currently 14 types of tactics:

  • Reconnaissance – Gathering information about a target
  • Resource Development – Gathering assets that can be leveraged for an attack, such as infrastructure, accounts, or capabilities
  • Initial Access – Gaining a foothold within an IT environment
  • Execution – Running malicious code
  • Persistence – Establishing long-term compromise of an IT environment
  • Privilege Escalation – Gaining additional access through higher permissions
  • Defense Evasion – Avoiding detection
  • Credential Access – Stealing account names and passwords
  • Discovery – Observing and mapping a target IT environment
  • Lateral Movement – Pivoting within an IT environment
  • Collection – Gathering targeted data to either steal or manipulate
  • Command and Control – Communicating with compromised systems
  • Exfiltration – Stealing data gathered during collection
  • Impact – Changing or destroying data gathered during collection

Techniques are the way in which tactics are achieved. Techniques are sometimes further broken down into sub-techniques in order to clarify different approaches to a technique. For example, a threat actor may want to compromise an account (technique), but they may go through a social media account or an email account (sub-techniques).

Clicking on a technique or sub-technique within the ATT&CK Matrix will provide a detailed description, including guidance on mitigation or detection. Additionally, it offers examples of different types of procedures an attacker has used to execute the technique. For example, the threat group DarkHydrus achieved forced authentication through template injection.

MITRE ATT&CK® Groups

In addition to the MITRE ATT&CK framework, MITRE also has a comprehensive list of groups, which are sets of related attack activities that are associated with one or more threat or cyber espionage groups. For example, Magic Hound is an Iranian-sponsored threat group that conducts intensive, long-term cyber espionage activities.

How Do You Use MITRE ATT&CK®?

There are many ways to use this dynamic framework, including detection, analytics, and threat intelligence. It is particularly useful for assessing the security of an organization. For example, it is an excellent resource for Red Teaming, providing a resource library of potential ways to emulate an adversary. Additionally, it can be used in penetration testing engagements, identifying particular areas of weakness and guiding remediation. Knowing the tactics or techniques for which your organization needs to improve defenses can help determine the type of tool or procedure needed to successfully bolster security.

MITRE ATT&CK® and Core Impact

Core Impact, an automated penetration testing tool that enables security teams to assess the security of their environment, uncovering and exploiting security weaknesses. The MITRE ATT&CK Framework perfectly complements these testing engagements, as it can map and categorize every Core Impact engagement, highlighting which attack types their organization may be most vulnerable to. Core Impact has two reporting options that utilize the MITRE ATT&CK Navigator layer output.

The ATT&CK Navigator Report

Based on the techniques executed during an engagement, this report uses the MITRE layer to classify and prioritize risk. It also includes the option of exporting results with the ATT&CK Navigator JSON format.

The NIST 800 Navigator Report

Building on the impressive work being done by MITRE’s Center for Threat-Informed Defense, this report offers a modified JSON output for organizations who want to align their activities with both ATT&CK and NIST’s catalog of security and privacy controls, known as NIST 800-53.

Contributing to MITRE ATT&CK®

As threat actors continue to evolve, the MITRE framework will also need to follow suit. In order to continue to make this resource as effective as possible, cybersecurity professionals can help by contributing information—whether it be a new technique seen in the wild or simply sharing if you’ve discovered a new way that MITRE can be used to help with defensive security. You can reach out directly to ATT&CK to contribute.

Related Products
Core Impact
Related Content
Core Impact 21.2
Blog
Core Impact 21.2: Incorporating the MITRE ATT&CK™ Framework and Attack Map Enhancements
Why Do Ransomware Attacks Keep Happening?
Blog
Why Do Ransomware Attacks Keep Happening?
Performance gears
Blog
The Truth About Pen Testing Automation
Core Impact Use Cases
Guide
How to Assess Your Security: A Pen Testing Use Case Guide

Want to see MITRE ATT&CK® and Core Impact in action?

CTA Text

Watch a demo of Core Impact to see how a penetration test can be mapped to MITRE as well as other features of this powerful pen testing tool.

WATCH THE DEMO
  • Email Core Security Email Us
  • Twitter Find us on Twitter
  • LinkedIn Find us on LinkedIn
  • Facebook Find us on Facebook

Products

  • Access Assurance Suite
  • Core Impact
  • Cobalt Strike
  • Event Manager
  • Browse All Products

Solutions

  • Identity Governance

  • PAM
  • IGA
  • IAM
  • Password Management
  • Vulnerability Management
  • Compliance
  • Cyber Threat

  • Penetration Testing
  • Red Team
  • Phishing
  • Threat Detection
  • SIEM

Resources

  • Upcoming Webinars & Events
  • Corelabs Research
  • Blog
  • Training

About

  • Our Company
  • Partners
  • Careers
  • Accessibility

Support

Privacy Policy

Contact

Impressum

Copyright © Fortra, LLC and its group of companies. All trademarks and registered trademarks are the property of their respective owners.