MITRE ATT&CK for Defenders

What Is MITRE ATT&CK?

In the previous lesson, you learned two frameworks for understanding attacks: the Kill Chain (sequence) and the Diamond Model (components). Now we introduce the framework that every modern SOC uses daily: MITRE ATT&CK.

ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge. It's a globally accessible, continuously updated knowledge base of adversary behavior based on real-world observations. Developed and maintained by The MITRE Corporation (a US federally funded non-profit), ATT&CK catalogs how attackers operate — not theoretically, but based on documented intrusions.

ATT&CK is the universal language of cyber defense. When a SOC analyst in Tokyo says "T1059.001," an analyst in London knows exactly what that means: PowerShell execution.

Here's what makes ATT&CK different from the Kill Chain:

ATT&CK doesn't replace the Kill Chain — it supercharges it. While the Kill Chain tells you "the attacker is in the Exploitation stage," ATT&CK tells you "the attacker used T1566.001 (Spearphishing Attachment) to deliver a macro-enabled document that executes T1059.001 (PowerShell)."

The ATT&CK Matrix: Structure and Navigation

The ATT&CK Matrix is organized as a table where columns are Tactics (the "why") and cells within columns are Techniques (the "how"). Understanding this structure is the key to fluency.

Click to enlarge

Tactics: The Adversary's Goals

Tactics represent the adversary's objective at each stage of an operation. There are 14 Enterprise tactics, and they roughly follow the progression of an attack (though attackers don't always follow them in order):

Techniques: The Specific Methods

Under each tactic, Techniques describe the specific methods attackers use to achieve that goal. Each technique has a unique ID starting with T followed by a four-digit number.

For example, under the Initial Access tactic (TA0001):

Sub-Techniques: The Precise Variant

Many techniques have Sub-techniques that describe more specific variants. Sub-techniques use the parent technique ID plus a decimal and a three-digit number.

T1566 — Phishing breaks down into:

This three-level hierarchy — Tactic → Technique → Sub-technique — gives you the precision to describe any adversary behavior. When you write "T1566.001" in an escalation note, every analyst in the world knows you mean a targeted phishing email with a malicious attachment.

Click to enlarge

Reading an ATT&CK Technique Page

Every technique in ATT&CK has a detailed page on attack.mitre.org that provides critical context. Learning to read these pages is an essential analyst skill.

Key Sections of a Technique Page

Let's walk through T1059.001 — Command and Scripting Interpreter: PowerShell as an example:

1. Description A plain-language explanation of what the technique is and how adversaries use it. For PowerShell, this explains that attackers abuse the legitimate scripting engine to execute commands, download payloads, and interact with system APIs.

2. Sub-techniques Lists all variants. T1059 (Command and Scripting Interpreter) has sub-techniques for PowerShell (.001), AppleScript (.002), Windows Command Shell (.003), Unix Shell (.004), Python (.005), JavaScript (.007), and more.

3. Procedure Examples Real-world cases where threat groups used this technique. For T1059.001, you'll see entries like:

• APT29 used PowerShell to download and execute Cobalt Strike payloads
• FIN7 executed PowerShell scripts to steal payment card data
• Lazarus Group used encoded PowerShell commands to establish C2

4. Mitigations Recommended defenses. For PowerShell: enable Script Block Logging, use Constrained Language Mode, restrict PowerShell execution policies, deploy application whitelisting.

5. Detection Specific data sources and methods to detect this technique. For PowerShell:

• Monitor Process Creation events where powershell.exe or pwsh.exe spawns
• Enable and collect Script Block Logging (Event ID 4104)
• Watch for encoded commands (-EncodedCommand or -enc parameter)
• Correlate with parent process — PowerShell spawned by Word is suspicious

How SOC Analysts Use ATT&CK Daily

ATT&CK isn't an academic exercise — it's a practical tool you'll use every shift. Here's how it fits into daily SOC operations:

1. Alert Triage: Identifying the Technique

When an alert fires, one of the first things you do is identify the ATT&CK technique. Many SIEMs already map alerts to techniques:

ALERT: Suspicious PowerShell Activity
Rule: Wazuh Rule 92000 — PowerShell with encoded command detected
ATT&CK: T1059.001 (Execution — PowerShell)
Severity: High

Source: WORKSTATION-PC42
User: john.smith
Process: powershell.exe -enc SQBFAFgAIAAoAE4AZQB3AC0ATw...
Parent Process: WINWORD.EXE

The ATT&CK mapping immediately tells you:

• Tactic = Execution — the attacker is trying to run malicious code
• Technique = T1059.001 — specifically using PowerShell
• Parent process = WINWORD.EXE — Word spawning PowerShell is a classic indicator of a malicious macro (ties back to T1566.001 Spearphishing Attachment for Initial Access)

Without ATT&CK, this is just "a PowerShell alert." With ATT&CK, you instantly have context, know what to investigate next, and can predict what the attacker will do after (likely T1105 — Ingress Tool Transfer to download additional tools).

2. Escalation: Speaking ATT&CK

When you escalate to L2, ATT&CK gives you a precise vocabulary:

Without ATT&CK:

"Hey, there's a weird PowerShell alert on PC42. Word opened and then PowerShell did something encoded. Looks suspicious."

With ATT&CK:

"PC42 triggered T1059.001 (PowerShell execution) with an encoded command, spawned by WINWORD.EXE, suggesting initial access via T1566.001 (Spearphishing Attachment). User john.smith in finance. Recommend investigating for T1105 (Ingress Tool Transfer) and T1547 (Boot/Logon Autostart Execution) for persistence. Escalating as likely true positive — early-stage compromise."

The second version tells L2 exactly what happened, what techniques were involved, and what to look for next. This is the difference between a junior analyst and a professional.

3. Detection Coverage Assessment

ATT&CK lets you measure your SOC's detection coverage against the full matrix. Using the ATT&CK Navigator (which is part of CyberBlueSOC), you can create a heatmap:

• Green cells — techniques you have detection rules for
• Yellow cells — partial coverage (some sub-techniques detected)
• Red/empty cells — no detection capability

This visual gap analysis shows leadership exactly where the organization is blind. It's also how L3 detection engineers prioritize which new Sigma/YARA rules to write.

Click to enlarge

4. Threat Intelligence Enrichment

When you receive a threat intelligence report about a new threat group targeting your industry, ATT&CK provides a common mapping:

APT28 (Fancy Bear) — associated techniques: T1566.001, T1059.001, T1053.005, T1078, T1070.004, T1071.001, T1027, T1083

You can immediately overlay this on your Navigator heatmap to answer: "Do we detect APT28's known techniques?" If you find gaps, you know exactly which detection rules to build before they target you.

5. Incident Reporting

Every incident report should include ATT&CK mappings. This standardizes reporting across the organization and makes trends visible:

INCIDENT REPORT — INC-2026-0142
Date: 2026-02-15
Severity: High

ATT&CK Techniques Observed:
  - T1566.001 — Spearphishing Attachment (Initial Access)
  - T1059.001 — PowerShell (Execution)
  - T1105   — Ingress Tool Transfer (Command and Control)
  - T1053.005 — Scheduled Task (Persistence)
  - T1003.001 — LSASS Memory Dump (Credential Access)
  - T1021.001 — Remote Desktop Protocol (Lateral Movement)

Kill Chain Stage Reached: Lateral Movement (Stage 6 of 7)
Dwell Time: 4.5 hours (detected at C2 stage)
Outcome: Contained before exfiltration

ATT&CK Beyond Enterprise

While this course focuses on the Enterprise matrix (Windows, Linux, macOS, Cloud, Network, Containers), MITRE maintains additional matrices:

Each matrix has its own tactics and techniques tailored to the environment. For this course, we focus exclusively on Enterprise, but the concepts transfer directly.

Common ATT&CK Techniques Every Analyst Must Know

You don't need to memorize all 200+ techniques on day one. But these are the ones you'll see every week in a SOC:

Initial Access

Execution

Persistence

Credential Access

Lateral Movement

Hands-On: Mapping an Alert to ATT&CK

Let's practice the core skill. Here's a real alert — map it to ATT&CK:

ALERT: New Scheduled Task Created
Time: 2026-02-15 03:42:17 UTC
Host: SRV-WEB-01
User: NT AUTHORITY\SYSTEM
Event: schtasks.exe /create /tn "WindowsUpdate" /tr 
  "powershell.exe -w hidden -enc <base64>" /sc daily /st 03:30
Parent Process: w3wp.exe (IIS Worker Process)

Step 1: Identify the primary technique A scheduled task is being created → T1053.005 — Scheduled Task/Job: Scheduled Task (Tactic: Persistence)

Step 2: Identify supporting techniques The task runs PowerShell with a hidden window and encoded command → T1059.001 — PowerShell (Tactic: Execution) The -w hidden flag hides the window → T1564.003 — Hidden Window (Tactic: Defense Evasion)

Step 3: Identify the parent process context Created by w3wp.exe (IIS web server) → This suggests T1505.003 — Web Shell (Tactic: Persistence) or T1190 — Exploit Public-Facing Application (Tactic: Initial Access)

Step 4: Build the attack narrative The web server was likely compromised (Initial Access via T1190 or web shell T1505.003). The attacker used the web server's SYSTEM privileges to create a scheduled task (Persistence via T1053.005) that runs encoded PowerShell daily (Execution via T1059.001) with a hidden window (Defense Evasion via T1564.003).

Step 5: Predict what comes next After establishing persistence, expect: T1003 (Credential Access) to dump credentials, T1007 (Discovery) to enumerate the environment, and T1021 (Lateral Movement) to reach other systems.

What's Next

You now have the three foundational frameworks that every SOC analyst needs: the Kill Chain (attack sequence), the Diamond Model (attack components), and MITRE ATT&CK (attack specifics). In the next lesson — Your Weapon System: CyberBlueSOC — you'll get a hands-on walkthrough of every tool in the platform and see how they integrate to give you visibility across the entire ATT&CK matrix. That lesson sets you up for Module 2, where you dive deep into the SIEM.