What Is the MITRE ATT&CK Framework and How Does It Work?

TL;DR

The MITRE ATT&CK framework is an industry standard taxonomy that classifies cyberattacks by tactics, techniques, and procedures (TTPs). Mapping an attack, such as a phishing campaign that leads to stolen credentials, data exfiltration, and destruction, onto its tactics gives defenders a common language for describing, detecting, and mitigating intrusions, and threat management tools can do this mapping automatically.

Transcript

A "bad guy" just broke in and stole your data, leaving you empty handed. How did he do it? Let's take a look at the anatomy of an attack. How would something like this work? Well, let's say we've got a web server. And it's connected to a database. And we also have email server. And maybe some file sharing system that's out here. And now we have, in... Read More

Key Insights

• Tactics, techniques, and procedures (TTPs) describe how attackers operate: tactics are the sub-goals they pursue, techniques are how they achieve them, and procedures are the implementation details, including the specific tools used.
• MITRE ATT&CK stands for Adversarial Tactics, Techniques & Common Knowledge. It is an industry standard that serves as a common language and taxonomy for describing and classifying cyberattacks.
• A typical attack begins with a reconnaissance tactic, in which the attacker uses active scanning to discover which systems, such as web, email, file sharing, and database servers, exist in the target environment.
• Phishing is an initial access technique. A deceptive email with a link tricks a user into logging in to a fake site to verify details or accept an order, which hands their credentials to the attacker.
• Unsecured credentials, such as passwords kept in an unencrypted flat file or spreadsheet on a file sharing system, let an attacker move from a low-level account to a highly sensitive one, which is privilege escalation.
• The final stages of the example attack map to three ATT&CK tactics: collection gathers the critical data, exfiltration sends a copy to the attacker over the network, and impact destroys the original data.
• Each technique in the MITRE ATT&CK framework links to a detail page that explains the procedures involved, how to detect the technique, how to mitigate it, and references for further reading.
• Threat management tools such as SIEM and SOAR can map indicators of compromise, artifacts, and alarms onto the ATT&CK framework automatically and show exactly which tactics a given attack involved.

Questions & Answers

Q: What is the MITRE ATT&CK framework?

The MITRE ATT&CK framework is an industry standard created by MITRE that provides a common language and taxonomy for describing and classifying cyberattacks. ATT&CK stands for Adversarial Tactics, Techniques & Common Knowledge. It organizes attacker behavior into tactics and the techniques used under each one, so security professionals across the industry can describe an attack consistently and understand each other.

Q: What are tactics, techniques, and procedures (TTPs) in cybersecurity?

TTPs are a way of describing attacker behavior at three levels. Tactics are the sub-goals an attacker pursues, such as reconnaissance or a phishing campaign. Techniques are how the attacker carries out each tactic. Procedures are the detailed implementation, including which tools the attacker will use. Together, TTPs help defenders classify and understand what attackers are doing.

Q: How does a phishing attack steal user credentials?

A phishing attack sends an email containing a link and encourages an unsuspecting user to click it. The link leads to a website that asks the user to log in to verify their details, accept an order, or respond to a similar ruse. When the user enters their username and password, they hand those credentials to the attacker, who can then log in to their accounts.

Q: How does an attacker move from phishing to stealing critical data?

In the example scenario, the attacker first uses the phished credentials to access the victim's email. Next, the attacker tries the same credentials on the file sharing system and finds passwords stored in an unencrypted file, such as a spreadsheet. Those passwords unlock the database that holds critical data. The attacker then copies the data out and destroys the original.

Q: Which MITRE ATT&CK tactics apply to a typical data theft attack?

The example attack maps to seven tactics. Reconnaissance uses active scanning. Initial access uses phishing and valid accounts. Credential access exploits unsecured credentials. Privilege escalation uses a more powerful valid account. Collection gathers the sensitive data, exfiltration sends it to the attacker over the network, and impact destroys the data, leaving the victim with nothing.

Q: Why are unencrypted password files dangerous?

Passwords kept in a flat, unencrypted file, such as an Excel spreadsheet on a file sharing system, are convenient for the user but give an attacker easy credential access. In the example, an attacker who had only a low-level account found such a file and used the stored credentials to reach a highly sensitive database. This is privilege escalation, and it led to data theft.

Q: How can the MITRE ATT&CK framework help detect and mitigate attacks?

Every technique in the MITRE ATT&CK framework links to a detail page. Clicking the phishing technique, for example, opens information on the procedures involved, how to detect it, how to mitigate it, and references for further reading. This lets defenders classify an attack they have found, understand it better, and decide how to contain it and respond.

Q: How do SIEM and SOAR tools use the MITRE ATT&CK framework?

Threat management tools such as SIEM (security information and event management) and SOAR (security orchestration, automation, and response) can take incoming artifacts, indicators of compromise, and alarms and map them onto the ATT&CK framework. Instead of working through the full framework diagram by hand, analysts see exactly which tactics an attack involved, described in terms the whole industry understands.

Summary & Key Takeaways

• An example attack shows how a breach unfolds. The attacker scans the environment, phishes an employee for email credentials, reuses those credentials on a file server, finds passwords stored in an unencrypted file, logs in to the critical database, exfiltrates the data, and then destroys it.

• Attackers operate through tactics, techniques, and procedures. Tactics are sub-goals such as reconnaissance, techniques are how each goal is achieved, and procedures are the detailed implementation, including the tools used. The MITRE ATT&CK framework turns this into an industry standard taxonomy for classifying attacks.

• Mapped to ATT&CK, the example covers reconnaissance, initial access, credential access, privilege escalation, collection, exfiltration, and impact. Threat management tools can perform this mapping automatically. Defenders answer the attackers' TTPs with their own PPT: people, process, and technology.