MITRE ATT&CK Framework
Type: Adversary behavior knowledge base / cybersecurity framework
Maintained by: MITRE Corporation (nonprofit R&D organization)
URL: attack.mitre.org
Key Facts
- Structured taxonomy of adversary Tactics, Techniques, and Procedures (TTPs) organized by attack lifecycle phases
- Enterprise ATT&CK: 14 tactics (Reconnaissance → Initial Access → Execution → Persistence → Privilege Escalation → … → Impact)
- Each tactic contains multiple techniques; techniques contain sub-techniques; each links to observed real-world threat actor campaigns
- Complementary matrices: Mobile ATT&CK, ICS ATT&CK (critical infrastructure), PRE-ATT&CK (pre-compromise)
- APT tracking: each known threat actor (APT28, Lazarus Group, etc.) is mapped to their observed ATT&CK techniques
OSINT Application
- Malware analysis: extract techniques from vendor reports, VirusTotal/MalwareBazaar runs, and map to ATT&CK IDs (T1059, T1003, etc.)
- Attribution: overlap of ATT&CK technique clusters across incidents is one input (not sole determinant) in threat actor attribution
- Detection engineering: defenders build detection rules per ATT&CK technique IDs
Threat Actor Coverage — Selected APT Profiles
ATT&CK’s threat actor database is one of its most analytically valuable components for intelligence work. Examples:
| Actor | ATT&CK ID | Known techniques (selection) | Primary state sponsor |
|---|---|---|---|
| APT28 / Fancy Bear | G0007 | T1566 (Phishing), T1071 (C2 over web protocols), T1059 (PowerShell) | Russia (GRU) |
| APT41 | G0096 | T1078 (Valid accounts), T1195 (Supply chain compromise), T1090 (Proxy) | China (MSS) |
| Lazarus Group | G0032 | T1486 (Ransomware encryption), T1090 (Multi-hop proxy), T1566 | DPRK (RGB) |
| Sandworm | G0034 | T1561 (Disk wipe), T1059 (Script interpreters), T1489 (Service stop) | Russia (GRU) |
Cross-referencing incident reports against these profiles is a standard threat intelligence workflow: if a newly observed campaign shares ATT&CK technique clusters with a known actor, it contributes to attribution (though is not, by itself, conclusive — technique sharing can result from shared tooling, procurement, or deliberate false flagging).
Integration into OSINT Intelligence Workflows
- Malware triage: When analyzing a malware sample (from VirusTotal, MalwareBazaar, or captured payload), extract behavioral indicators and map to ATT&CK technique IDs → identify actor cluster
- Vendor report cross-referencing: Commercial threat intelligence reports (Mandiant, CrowdStrike, Recorded Future) now uniformly map findings to ATT&CK — allows cross-vendor comparison using a common vocabulary
- Detection gap mapping: Compare your defensive coverage (which techniques you can detect) against an actor’s known technique profile → identify blind spots
- Red team planning: ATT&CK Navigator (att&ck.mitre.org/matrices) allows visualization of technique coverage; used in adversary emulation exercises
Key Connections
- Cyber Threat Intelligence — ATT&CK is the standard vocabulary for CTI reports and threat actor profiling
- Advanced Persistent Threats — APT profiles in ATT&CK are the operational cross-reference for state-actor technique attribution
- Attribution — technique-cluster overlap is one of multiple attribution inputs
- Stuxnet — mapped to ATT&CK ICS matrix as a canonical industrial-control-system attack case
- 05 — Analysis Without Institutional Support — ATT&CK referenced as framework for independent analyst cyber assessment
Sources
- MITRE Corporation. ATT&CK for Enterprise knowledge base (attack.mitre.org), continuously updated. Fact, High — primary reference.
- Strom, Blake E., et al. MITRE ATT&CK: Design and Philosophy. MITRE Technical Report, 2018. Fact, High — design rationale and framework architecture documentation.