Data Structure
Networking
RDBMS
Operating System
Java
MS Excel
iOS
HTML
CSS
Android
Python
C Programming
C++
C#
MongoDB
MySQL
Javascript
PHP
Physics
Chemistry
Biology
Mathematics
English
Economics
Psychology
Social Studies
Fashion Studies
Legal Studies
- Selected Reading
- UPSC IAS Exams Notes
- Developer's Best Practices
- Questions and Answers
- Effective Resume Writing
- HR Interview Questions
- Computer Glossary
- Who is Who
What is MITRE ATT&CK Security Framework?
MITRE ATT&CK stands for MITRE Adversarial Tactics, Techniques, and Common Knowledge, and it is a trademark of MITRE (ATT&CK).
The MITRE ATT&CK framework is a curated knowledge base and model for cyber adversary behavior, representing the many stages of an adversary's attack lifecycle as well as the platforms they are known to target.
The model's tactics and methods abstraction creates a standard taxonomy of specific adversary operations that both the offensive and defensive sides of cybersecurity can understand. It also assigns a proper level of classification to adversary behavior and precise techniques to counteract it.
MITRE ATT&CK was born out of MITRE's Fort Meade Experiment (FMX). Researchers imitated both attacker and defense behavior to enhance post-compromise threat detection via telemetry sensing and behavioral analysis.
"How well are we performing at recognizing recorded adversary behavior?" the researchers wanted to know. The researchers created ATT&CK as a method to characterize adversary behavior in order to answer that issue.
The Goal of MITRE ATT&CK
The Mitre security initiative's purpose is to compile a complete catalog of known adversary tactics and methods that can be utilized during a cyberattack. It should be able to collect a wide, and preferably thorough, variety of assault stages and sequences because it is open to government, education, and commercial groups.
MITRE ATT&CK is a standard taxonomy designed to make inter-organizational communications more precise. ATT&CK was born out of a requirement to categorize opponent activity in a systematic way as part of MITRE's Fort Meade Experiment research environment's organized adversary simulation activities.
The Three Matrices of the ATT&CK Framework
Attackers behave differently depending on the target of their attack. For example, they employ distinct TTPs to compromise business systems vs. mobile devices or industrial control systems.
To accommodate these various contexts, MITRE provides three unique "matrices." These three matrices make up the ATT&CK framework, which MITRE refers to as a whole.
The Enterprise matrix covers operating systems like Windows, macOS, Linux, and others and something termed "PRE," which simply refers to measures conducted before an attack or in preparation for one.
The Mobile matrix is for Android and iOS devices.
The ICS matrix is for industrial control systems.
Although the three matrices share several strategies (for example, Initial Access and Persistence), the particular approaches for each strategy might differ depending on the situation.
The essential components of the behavioral model proposed by ATT&CK are as follows:
Techniques that describe how the adversaries achieve tactical goals. Describe the "how", that is the techniques used by attackers to carry out a tactic. Each matrix's strategies have several methods.
The Enterprise matrix further divides some techniques into sub-techniques.
The Phishing approach attackers use to get Initial Access is an example of this (a tactic). Spearphishing Attachment, Spearphishing Link, and Spearphishing through a Service are the three sub-techniques of phishing.
Tactics denoting short-term, tactical adversary goals during an attack. It describes the attackers' immediate technical goals (the "what"), such as acquiring Initial Access, sustaining Persistence, or establishing Command and Control. In order to conduct an attack successfully, attackers must always employ numerous strategies.
Procedures − It might refer to individual malware or other tools used by the attackers. It can also describe the specific implementations of tactics and the related sub-techniques.
The Enterprise ATT&CK matrix's most recent version (version 9) comprises the following strategies stated in a logical order, suggesting various attack stages −
Reconnaissance − It is the collection of information in advance of an attack.
Resource Development − It involves the creation, purchase, compromise, or theft of resources required for an attack.
Access − Obtaining first access to a victim's network or systems
Execution − It refers to the act of running malicious code on a network or system that has been infiltrated.
Persistence − It entails keeping access to the network or systems in question.
Privilege Escalation − Attempting to get higher-level privileges is known as privilege escalation.
Defense Evasion − It entails taking steps to avoid being discovered.
Credential Access − It involves attempting to obtain account names and passwords.
Discovery − Gathering knowledge about the harmed environment is known as discovery.
Command and Control − Establishing control over systems in the victim's network and/or connecting with compromised systems from outside the network.
Exfiltration − It is the act of taking information from a person.
Damage, destruction, or other means of rendering networks, systems, and/or data inaccessible to the victim.
363 Views
