Each of these Tactics has additional information about it, providing a deep drive into the methods that a cyberattacker can use to carry out their goals.
Introduction to MITRE ATT&CK framework techniques
The MITRE ATT&CK framework is organized hierarchically. At the top level are the Tactics, which describe the goals that an attacker may need to achieve during the cyberattack lifecycle, such as evading defenses and gaining access to user credentials. Below this level are the Techniques. Techniques are particular methods by which an attacker can achieve the goal outlined in a particular Tactic. For example, the Credential Access Tactic in the Enterprise Matrix includes techniques like Brute Force and OS Credential Dumping.
MITRE ATT&CK framework PRE-ATT&CK techniques
PRE-ATT&CK used to be its own standalone matrix that rivaled the Enterprise matrix in size. Now, it has been condensed to two Tactics within the Enterprise matrix: Reconnaissance and Resource Development. Each of these Tactics has a number of Techniques. Reconnaissance’s ten Techniques are focused on using both active and passive techniques for collecting information about a target environment. Resource Development’s six Techniques are intended to outline the steps that an attacker may take to build the capabilities needed to carry out an attack.
MITRE ATT&CK framework enterprise techniques
The MITRE ATT&CK Enterprise Matrix has twelve different Tactics, not including the two from PRE-ATT&CK. These twelve Tactics each have several Techniques:
Initial Access (9) Execution (10) Persistence (18) Privilege Escalation (12) Defense Evasion (37) Credential Access (15) Discovery (25) Lateral Movement (9) Collection (17) Command and Control (16) Exfiltration (9) Impact (13)
These numbers give some idea of the complexity of protecting against each of these Tactics, but the comparison is not exact. For example, Discovery has more than twice as many Techniques as Privilege Escalation (25 vs. 12). However, the structure of MITRE ATT&CK – and the existence of Sub-Techniques – hides the fact that there are more than twice as many ways of accomplishing Privilege Escalation as Discovery.
MITRE ATT&CK framework mobile techniques
The MITRE ATT&CK Mobile matrix is structured similarly to the Enterprise matrix. It lacks the PRE-ATT&CK Tactics now included in the Enterprise matrix, but shares the same other Tactics. The two matrices differ significantly in terms of the Techniques that they contain. Mobile Techniques are largely focused on attack vectors unique to mobile devices, of which there are fewer than the Enterprise matrix. However, many of the Techniques described in the Enterprise matrix apply to mobile devices as well.
MITRE ATT&CK framework sub-techniques
MITRE ATT&CK Techniques outline a particular way to achieve the goal of a Tactic. A MITRE ATT&CK Technique may also include Sub-Techniques. These are particular ways to carry out the action outlined in the Technique. For example, the Brute Force Technique for Credential Access in the Enterprise Matrix has four Sub-Techniques:
Password Guessing Password Cracking Password Spraying Credential Stuffing
All of these Sub-Techniques are ways to carry out the main Technique (i.e. a brute-force password guessing attack), but take advantage of different mechanisms to do so.
MITRE ATT&CK framework procedures
While they don’t appear in the matrices themselves, the MITRE ATT&CK Framework also has the concept of Procedures. These Procedures can be viewed by clicking on a particular Technique or Sub-Technique in the matrix. These Procedures detail known implementations of a particular Technique or Sub-Technique. This may include malware variants known to use that particular method or threat actors whose TTPs include the Technique or Sub-Technique.
How are MITRE ATT&CK framework sub-techniques and procedures different?
Sub-Techniques and Procedures both describe a particular method of performing a Technique to accomplish the goals of a Tactic. However, these two concepts are distinct in MITRE ATT&CK. A Sub-Technique describes a “how” for a particular Technique. It is a process or mechanism for accomplishing the goal of a Tactic. For example, Password Spraying is a type of Brute Force attack for accomplishing Credential Access. A Procedure is a “what”. An example of a Procedure for Credential Access would be a password cracking tool like Hashcat or John the Ripper. A Procedure may use multiple different Sub-Techniques, and many different Procedures may implement the same Sub-Technique.
Sources
MITRE ATT&CK, MITRE MITRE ATT&CK Enterprise Matrix, MITRE MITRE ATT&CK Mobile Matrix, MITRE
