[Day 4] 2. MITRE Att&ck Framework

What is it?

• MITRE ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge.
• A knowledge base of real-world adversary behaviour used to improve cybersecurity.

Purpose

• Helps organisations understand and defend against cyber-attacks by mapping attacker behaviour to specific tactics and techniques.

Key Points for Interviews

1. Tactics:

   • What attackers aim to achieve (their goals).
   • Example: Initial Access, Privilege Escalation, Data Ex-filtration.

2. Techniques:

   • How attackers accomplish their goals (methods or strategies).
   • Example: Phishing, Exploiting Public-Facing Applications.

3. Sub-Techniques:

   • More granular descriptions of techniques.
   • Example: Spear Phishing via Service (under Phishing).

4. Threat Intelligence:

   • Maps tactics and techniques to real-world threat groups (e.g., APT groups).

5. Enterprise Matrix:

   • A structured representation of tactics and techniques across an attack life-cycle.

Why is it Important?

• Assists in identifying gaps in security controls.
• Used for threat modelling, red teaming, and incident response.
• Widely adopted in cybersecurity tools (e.g., SIEMs, EDR).