Procedure
In the MITRE ATT&CK framework, a procedure is a specific implementation or set of steps an adversary uses for a technique or subtechnique.
Azure Security
A highly detailed description of the specific steps and implementation details of a bad actor's technique.
- How it is used
- Uses detailed attacker behavior to help defenders anticipate compromise and strengthen security practices.
- How deep it goes
- Defines procedures within the goal-tactic-technique hierarchy but stops short of describing a specific attack implementation.
- Examples
- Uses repeated exercise-machine steps as an analogy for executing a technique.
- What you can do after
- Evaluate attacker behavior in greater detail and use it to anticipate threats and improve preparedness.
Cyber Threat Hunting
A procedure in the ATT&CK framework is a specific implementation an adversary uses for a technique or subtechnique.
- How it is used
- Supports threat-hunting plans by tying known adversary implementations to ATT&CK techniques and subtechniques.
- How deep it goes
- Descends from tactical goals through techniques and subtechniques to named implementations, without detailing investigative execution.
- Examples
- Uses APT41 PowerShell, cmd.exe, batch-file persistence, and certutil download examples.
- What you can do after
- Apply via MITRE ATT&CK to organize known adversary behavior and plan investigations.
Related concepts
- subtechniqueimplements · A subtechnique is a more specific behavioral subdivision of an adversary technique in a threat-behavior taxonomy.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.