English
Menu

What is MITRE ATT&CK?

A knowledge base, published by the US non-profit research organization MITRE, of attacker techniques observed in real attacks. It organizes them into "tactics", which represent the attacker's goals (initial access, persistence, privilege escalation, lateral movement, exfiltration and so on), and "techniques", which represent the concrete methods for achieving them, and gives each technique an identifier. Defenders use it to check which techniques their detections and controls cover and to describe techniques in common terms in threat intelligence reports.

Japanese name: MITRE ATT&CK

MITRE ATT&CK appears in 3 practice questions across 1 topic, including Cyber Attacks and Defense in Practice.

Field: Cyber Attacks and Defense in Practice

Try it: questions about MITRE ATT&CK

MITRE ATT&CK is a knowledge base that organizes the methods observed in real attacks into "tactics", which represent the attacker's goals, and "techniques", which represent the concrete methods for achieving those goals. Which of the following correctly pairs an observed action with the tactic it falls under?

  1. ARemotely connecting to another internal server with stolen administrator credentials falls under exfiltration
  2. BCompressing internal files and sending large amounts of them to external cloud storage falls under initial access
  3. CRegistering itself as an OS service so that it runs automatically even after a reboot falls under persistence
Show answer and explanation

Answer: C. Registering itself as an OS service so that it runs automatically even after a reboot falls under persistence

ATT&CK tactics express "why" an attacker takes an action (the goal) and techniques express "how"; for example, the persistence tactic includes techniques such as registering a service, scheduled tasks and changing settings that run at startup. Extending connections to other servers falls under the lateral movement tactic, and sending data outside falls under the exfiltration tactic. Defenders map which techniques their detections and controls cover onto ATT&CK to find weak spots. Because techniques have identifiers, threat intelligence reports and detection rules can refer to the same method by the same number.

MITRE ATT&CK in the explanations

Questions that mention MITRE ATT&CK (3)

  1. MITRE ATT&CK is a knowledge base that organizes the methods observed in real attacks into "tactics", which represent the attacker's goals, and "techniques", which represent the concrete methods for achieving those goals. Which of the following correctly pairs an observed action with the tactic it falls under?
  2. The Cyber Kill Chain presented by Lockheed Martin in 2011 divides the flow of a targeted attack into seven stages. Which of the following gives the stages in the correct order?
  3. Which of the following correctly describes the differences between vulnerability scanning, penetration testing and red team exercises as ways of checking an organization's defenses?

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

Comparisons that include this term

Related terms

Lateral movement Cyber Kill Chain Penetration testing Digital forensics EDR (endpoint detection and response) Incident response Indicator of compromise (IoC) Intrusion detection system (IDS) SBOM (software bill of materials) Security operations center

Back to the glossary