Understanding MITRE Frameworks ATT&CK and D3FEND

The MITRE ATT&CK framework provides comprehensive information for organizations looking to defend against cyberthreats and beef up their cybersecurity strategies. The acronym ATT&CK, according to TechTarget, stands for Adversarial Tactics, Techniques, and Common Knowledge.

This framework and knowledgebase are used to evaluate common cyber adversary behavior and categorize the phases of an adversary’s attack lifecycle and preferred platform targets. The ATT&CK framework also provides a taxonomy related to adversary tactics and techniques from both an offensive and defensive viewpoint.

Essentially, ATT&CK focuses on how adversaries breach and infiltrate various types of computer information systems and communication networks. Originally a project to systematically categorize adversary behavior against Microsoft Windows systems, the framework has grown to include multiple systems, such as Linux and macOS, alongside varying environments, such as mobile devices, cloud-based systems, and industrial control systems. According to MITRE themselves, the ATT&CK behavioral model consists of the following core components:

• “Tactics, denoting short-term, tactical adversary goals during an attack;
• Techniques, describing how adversaries achieve tactical goals;
• Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and
• Documented adversary usage of techniques, their procedures, and other metadata.”

These tactics and techniques, as well as their relationships to one another, are visualized as the ATT&CK Matrix.

The MITRE ATT&CK Matrix is a way to visualize phases in the attack chain from entry or “Initial Access” to an outcome or “Impact,” as well as to explore the tactics and techniques associated with each phase. MITRE themselves claim their ATT&CK matrices visualize the relationship between tactics, techniques, and sub-techniques. For example, the ATT&CK Matrix for Enterprise appears so:

Under the column for “Credential Access,” for example, the potential tactics used to achieve this objective are listed, and include “brute force,” “man-in-the-middle,” and “unsecured credentials.” Essentially, this column tries to explain all of the tactics and techniques that an adversary could use to execute an effective account takeover.

There are 12 tactics/objectives covered by the Enterprise ATT&CK Matrix:

1. Initial Access: This is when adversaries first attempt to enter your systems.
2. Execution: The adversary will run some kind of malicious code, like ransomware.
3. Persistence: Once in your system, adversaries work to remain there by disabling or altering code meant to shut them out.
4. Privilege Escalation: When adversaries breach your system, they may only have low-level access; they will try to gain higher-level access by escalating the compromised user account’s privileges.
5. Defense Evasion: Malware and suspicious behavior can be masked and hidden in trusted processes, representing one way adversaries evade defenses.
6. Credential Access: Whether through technological means or social engineering, adversaries try to gain usernames and passwords to breach the system.
7. Discovery: Adversaries attempt to peruse target networks and systems in the same way a cat burglar might scope a building for access and loot.
8. Lateral Movement: If an adversary gets ahold of the right credentials, they may be able to move through multiple systems and environments in your organization.
9. Collection: Data scraping and collection by the adversary might include personal or private information or secondary data to help complete the adversary’s goal.
10. Command and Control: This is when an adversary communicates with a target system to control that system.
11. Exfiltration: After collecting data, an adversary will likely move it to a secure location for them. This is the stealing of data.
12. Impact: This is the theft, manipulation, or destruction of systems and data.

Some of these techniques contain sub-techniques, helping to explain in greater detail how adversaries achieve their objectives.

‍

The MITRE D3FEND framework is based on and works as a partner to ATT&CK tactics and frameworks and focuses solely on defensive countermeasures and prevention solutions. Funded by the NSA, D3FEND is also presented as a matrix that mirrors ATT&CK to a certain extent. It presents defensive tactics and techniques based on common MITRE ATT&CK tactics, including:

• ‍Harden: Further split into four sub-categories that include application, credential, message, and platform hardening, these represent techniques that further secure your systems against intrusion and brute force attacks, such as “Dead Code Elimination” in your applications or “Biometric Authentication” for credentials.
• ‍Detect: Detection is split into sub-categories that include analysis of files, messages, identifiers, network traffic, processes, user behavior, and platform monitoring. As the name would suggest, these are techniques used to detect breaches and suspicious behavior both as they occur and after the fact.
• Isolate: Execution isolation and network isolation are countermeasure tactics that aim to eliminate and mitigate the number of potential attack vectors in a network or system. Techniques here include “IO Port Restriction” and “Encrypted Tunnels.”
• ‍Deceive: The tactic of deception in cybersecurity defense revolves around decoy objects or environments made to look like the real deal. Colloquially called “honey pots,” MITRE suggests decoy files and network resources as defensive techniques, as well as connected, integrated, and standalone honeynet environments.
• ‍Evict: The smallest part of the D3FEND matrix and split into subcategories “Credential Eviction” and “Process Eviction,” this tactic is concerned with ending rogue processes once identified and locking intruder accounts.

Each of the defensive techniques found in the D3FEND matrix contains a summary and cross-references the specific ATT&CK-based tactics and techniques it is meant to defend against.