Mitre 2022: ATT&CK Enterprise Matrix
The MITRE ATT&CK® Matrix for Enterprise contains tactics and techniques for various platforms. They cover the following areas:
- Reconnaissance
- Resource Development
- Initial Access
- Execution
- Persistence
- Privilege Escalation
- Defense Evasion
- Credential Access
- Discovery
- Lateral Movement
- Collection
- Command and Control
- Exfiltration
- Impact
Please follow the link below for the full enterprise matrix.
The easy stuff
Each tactic contains multiple techniques, of various difficulty levels. Below there is an overview containing one simple and easy technique of each category.
Reconnaissance
Searching Open Websites/Domains refers to searching of publicly available websites and domains for intelligence, which can then be used for possible attacks or targeting. This includes social media, news, business reports, job postings, etc.
Resource Development
Establishing Accounts refers to creating of accounts which are then used for the targeting or an attack. As example, this could be in the way of building a persona and social engineering.
Initial Access
Exploit Public-Facing Application refers to using weaknesses in public-facing systems for an attack. As example this could be a websites content management system which is outdated and not properly secured.
Execution
Exploitation for Client Execution refers to the exploitation of software vulnerabilities which allow us to execute malicious code.
Persistence
Create Account refers to creation of an account in the target system to maintain access and persistence. This could be local, domain accounts, etc.
Privilege Escalation
Valid Accounts refers to the takeover or abuse of legitimate account credentials as a base for an attack.
Defense Evasion
Hide Artifacts refers to hiding artifacts related to an attack to evade detection. This could mean hiding files, various activities etc. to remain undetected.
Credential Access
Unsecured Credentials refers to credentials which are insecurely stored. This could be as simple as production server credentials stored in a text document on a software engineers machine.
Discovery
File and Directory Discovery refers to the searching of information in files and directories on a target system or network.
Lateral Movement
Internal Spearphishing refers to target phishing of information from within the target environment. As example we might have control of the general managers account and send in his name a payload to another target within the environment.
Collection
Data from Local System refers to the search and collection of target data on a local system.
Command and Control
Web Service refers to the usage of a external web service to relay data and instructions to and from the target system.
Exfiltration
Transfer Data to Cloud Account refers to the exfiltration of data with the help of a cloud service to avoid more traditional detection.
Impact
System Shutdown/Reboot refers to the shutdown of a target system to either interrupt access, cause damage or delays.
Techniques, Subtechniques, Tactics and Procedures
To make things a bit more clear in the context of the topic, lets have a quick look at the explanation of each of the following terms, together with some examples.
Techniques refer to how a tactical goal is achieved through an action. As example, active scanning of a target via network traffic.
Subtechniques are as the name implies subcategories of techniques. The technique Account Discovery might as example have subtechniques such as local account, domain account, etc.
Tactics describe the overall goal of the therein contained techniques and subtechniques. As example the tactic Execution contains techniques such as "Native API".
Procedures are the approaches to execute the technique or subtechnique. As example a procedure could be the use of the Calisto trojan to open a backdoor on a macOS target.
