MITRE ATT&CK Framework

Type: Adversary behavior knowledge base / cybersecurity framework
Maintained by: MITRE Corporation (nonprofit R&D organization)
URL: attack.mitre.org

Key Facts

  • Structured taxonomy of adversary Tactics, Techniques, and Procedures (TTPs) organized by attack lifecycle phases
  • Enterprise ATT&CK: 14 tactics (Reconnaissance → Initial Access → Execution → Persistence → Privilege Escalation → … → Impact)
  • Each tactic contains multiple techniques; techniques contain sub-techniques; each links to observed real-world threat actor campaigns
  • Complementary matrices: Mobile ATT&CK, ICS ATT&CK (critical infrastructure), PRE-ATT&CK (pre-compromise)
  • APT tracking: each known threat actor (APT28, Lazarus Group, etc.) is mapped to their observed ATT&CK techniques

OSINT Application

  • Malware analysis: extract techniques from vendor reports, VirusTotal/MalwareBazaar runs, and map to ATT&CK IDs (T1059, T1003, etc.)
  • Attribution: overlap of ATT&CK technique clusters across incidents is one input (not sole determinant) in threat actor attribution
  • Detection engineering: defenders build detection rules per ATT&CK technique IDs

Threat Actor Coverage — Selected APT Profiles

ATT&CK’s threat actor database is one of its most analytically valuable components for intelligence work. Examples:

ActorATT&CK IDKnown techniques (selection)Primary state sponsor
APT28 / Fancy BearG0007T1566 (Phishing), T1071 (C2 over web protocols), T1059 (PowerShell)Russia (GRU)
APT41G0096T1078 (Valid accounts), T1195 (Supply chain compromise), T1090 (Proxy)China (MSS)
Lazarus GroupG0032T1486 (Ransomware encryption), T1090 (Multi-hop proxy), T1566DPRK (RGB)
SandwormG0034T1561 (Disk wipe), T1059 (Script interpreters), T1489 (Service stop)Russia (GRU)

Cross-referencing incident reports against these profiles is a standard threat intelligence workflow: if a newly observed campaign shares ATT&CK technique clusters with a known actor, it contributes to attribution (though is not, by itself, conclusive — technique sharing can result from shared tooling, procurement, or deliberate false flagging).

Integration into OSINT Intelligence Workflows

  1. Malware triage: When analyzing a malware sample (from VirusTotal, MalwareBazaar, or captured payload), extract behavioral indicators and map to ATT&CK technique IDs → identify actor cluster
  2. Vendor report cross-referencing: Commercial threat intelligence reports (Mandiant, CrowdStrike, Recorded Future) now uniformly map findings to ATT&CK — allows cross-vendor comparison using a common vocabulary
  3. Detection gap mapping: Compare your defensive coverage (which techniques you can detect) against an actor’s known technique profile → identify blind spots
  4. Red team planning: ATT&CK Navigator (att&ck.mitre.org/matrices) allows visualization of technique coverage; used in adversary emulation exercises

Key Connections

Sources

  • MITRE Corporation. ATT&CK for Enterprise knowledge base (attack.mitre.org), continuously updated. Fact, High — primary reference.
  • Strom, Blake E., et al. MITRE ATT&CK: Design and Philosophy. MITRE Technical Report, 2018. Fact, High — design rationale and framework architecture documentation.