Difference between revisions of "MITRE ATT&CK"
| Line 1: | Line 1: | ||
| − | '''MITRE ATT&CK''' is a free framework | + | '''MITRE ATT&CK''' is a free framework that outlines all of the possible approaches cyber threat actors make take. The knowledge base, which is based entirely on real-world observations, offers a foundation for the development of specific threat models and methodologies for private, government, and [[Cybersecurity]] sectors.<ref>[https://attack.mitre.org/ About MITRE Attack, MITRE]</ref> The framework has one component for enterprise IT networks and clouds, and another for mobile devices. |
==History== | ==History== | ||
| Line 13: | Line 13: | ||
Procedures refer to the actual implementation of the techniques. | Procedures refer to the actual implementation of the techniques. | ||
| − | [[File:ATT&CK_Enterprise_Matrix_Version_9_Overview.png|thumbnail| | + | [[File:ATT&CK_Enterprise_Matrix_Version_9_Overview.png|thumbnail|1200px|Screenshot of [https://attack.mitre.org/matrices/enterprise/ MITRE ATT&CK Enterprise Matrix Version 9.0]]] |
| + | |||
| + | |||
| + | |||
==References== | ==References== | ||
Revision as of 15:41, 28 July 2021
MITRE ATT&CK is a free framework that outlines all of the possible approaches cyber threat actors make take. The knowledge base, which is based entirely on real-world observations, offers a foundation for the development of specific threat models and methodologies for private, government, and Cybersecurity sectors.[1] The framework has one component for enterprise IT networks and clouds, and another for mobile devices.
History
In 2013, the Mitre Corporation, an American nonprofit managing federally funded research and development centers, started ATT&CK to document common tactics, techniques, and procedures that Advanced Persistent Threats (APT)s use against Windows enterprise networks. It began as a documentation research project called "FMX," which investigated endpoint telemetry data and analytics usage with the aim of improving post-compromise detection. ATT&CK became the basis for testing the efficacy of sensors and analytics and is now the common language of cybersecurity offense and defense teams.[2]
Tactics
Tactics refer to the purpose behind an ATT&CK technique. It is the goal for performing the action, such as stealing credentials or gaining remote access.
Techniques
Techniques encompass the conceptual method for achieving the tactical goal in question.
Procedures
Procedures refer to the actual implementation of the techniques.
