Mastering the Cyber Threat Landscape (Part 3)

MITRE ATT&CK Explained: The Common Language of Modern Cyber Threats

Author: Md. Fayjul Kabir

Category: Cyber Security | SOC | Blue Team | Threat Hunting | Detection Engineering

Introduction

Imagine receiving an alert that says:

"PowerShell executed from Microsoft Word."

Another analyst says:

"This is T1059."

A Threat Hunter replies:

"Looks like TA0002 followed by T1105."

Meanwhile, the Incident Response team starts mapping the attack to MITRE ATT&CK.

If you're new to cybersecurity, this conversation can sound confusing.

What do these numbers mean?

Why is everyone speaking in codes?

The answer is MITRE ATT&CK.

Today, almost every modern Security Operations Center (SOC) uses MITRE ATT&CK as the standard framework for understanding attacker behavior. Security vendors such as Microsoft Defender, CrowdStrike, Splunk, Elastic Security, Sentinel, IBM QRadar, Palo Alto Cortex XDR, Wazuh, and Google Chronicle all map their detections to MITRE ATT&CK.

Unlike the Cyber Kill Chain, which focuses on the overall stages of an attack, MITRE ATT&CK focuses on the specific tactics and techniques attackers use after gaining access.

Understanding this framework is one of the most valuable skills for SOC Analysts because it provides a common language for detection engineering, threat hunting, incident response, and threat intelligence.

What Is MITRE ATT&CK?

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a publicly available knowledge base that documents how real-world attackers compromise systems.

Instead of describing attacks theoretically, MITRE is built from observations of actual adversary behavior.

It answers questions such as:

• What are attackers trying to accomplish?
• Which techniques do they use?
• How can defenders detect those techniques?
• Which mitigations reduce risk?

Unlike proprietary frameworks, MITRE ATT&CK is freely available and continuously updated with contributions from security researchers worldwide.

Why MITRE ATT&CK Matters

Imagine your organization receives an alert showing that PowerShell was launched by Microsoft Word.

Without context, this appears to be just another process execution.

When mapped to MITRE ATT&CK:

• Tactic: Execution (TA0002)
• Technique: Command and Scripting Interpreter (T1059)

Immediately, analysts understand:

• The attacker has already gained initial access.
• Malicious code is executing.
• Additional techniques such as persistence or credential dumping may follow.

MITRE provides context that transforms isolated alerts into an attack narrative.

Understanding the ATT&CK Matrix

The Enterprise ATT&CK Matrix is organized into tactics and techniques.

Tactics

Tactics answer the question:

"What is the attacker trying to achieve?"

Examples include:

• Initial Access
• Execution
• Persistence
• Privilege Escalation
• Defense Evasion
• Credential Access
• Discovery
• Lateral Movement
• Collection
• Exfiltration
• Impact

Techniques

Techniques answer the question:

"How is the attacker accomplishing that objective?"

Example:

Tactic:

Initial Access

Technique:

Phishing

Sub-technique:

Spearphishing Attachment

Enterprise ATT&CK Tactics Explained

1. Initial Access (TA0001)

Every attack begins with gaining access to the target.

Common techniques include:

• Phishing Emails
• Drive-by Downloads
• Public-Facing Application Exploits
• Valid Accounts
• External Remote Services
• Supply Chain Compromise

Example

An attacker sends a malicious Microsoft Word document to an employee.

The user opens the attachment.

Initial Access achieved.

SOC Detection

• Email Gateway
• Defender for Office 365
• Attachment Sandbox
• Secure Email Gateway Logs

2. Execution (TA0002)

After gaining access, attackers execute malicious code.

Common techniques:

• PowerShell
• CMD
• Bash
• Python
• JavaScript
• Office Macros
• Scheduled Tasks

Example

WINWORD.exe

↓

powershell.exe

↓

Encoded PowerShell

↓

Malware Download

Detection

Sysmon Event ID 1

Microsoft Defender

EDR Process Tree

3. Persistence (TA0003)

Attackers want access even after reboot.

Persistence methods include:

Windows

• Registry Run Keys
• Scheduled Tasks
• Windows Services
• Startup Folder
• WMI Event Subscription

Linux

• Cron Jobs
• SSH Authorized Keys
• Systemd Services

Detection

Sysmon

Windows Registry Monitoring

EDR Alerts

4. Privilege Escalation (TA0004)

Normal user

↓

Administrator

↓

SYSTEM

↓

Domain Admin

Techniques

• Token Manipulation
• Exploiting Vulnerabilities
• DLL Hijacking
• Bypass UAC
• Service Misconfiguration

Why attackers do this

Higher privileges

↓

More control

↓

More damage

5. Defense Evasion (TA0005)

Attackers attempt to hide their activity.

Common methods

• Disable Antivirus
• Delete Event Logs
• Obfuscation
• Process Injection
• Living Off The Land (LOLBins)
• Rename Malware

Example

PowerShell executed with Base64 encoding.

Detection

• Command-line logging
• AMSI
• Script Block Logging

6. Credential Access (TA0006)

Stealing credentials is one of the most valuable objectives.

Techniques

• LSASS Dumping
• Keylogging
• Credential Dumping
• Browser Password Theft
• Kerberoasting
• Pass-the-Hash

Example

Mimikatz

↓

Extract Windows Credentials

Detection

• LSASS Memory Access
• Sysmon Event Logs
• Defender Credential Theft Alerts

7. Discovery (TA0007)

Attackers need to understand the environment.

Commands

whoami
ipconfig
net user
net group
hostname
systeminfo

whoami
ipconfig
net user
net group
hostname
systeminfo

Purpose

• Discover users
• Identify domain
• Find servers
• Map the network

Detection

PowerShell Logging

Sysmon

Command-line auditing

8. Lateral Movement (TA0008)

Once one machine is compromised, attackers move to others.

Common techniques

• PsExec
• SMB
• RDP
• WMI
• WinRM
• Remote PowerShell

Goal

Compromise Domain Controller

↓

Entire enterprise

Detection

• SMB Logs
• RDP Logs
• Windows Event IDs
• Firewall Logs

9. Collection (TA0009)

Gather valuable data.

Examples

• Documents
• Database Dumps
• Screenshots
• Clipboard
• Email Collection
• Browser Data

Detection

Large archive creation

ZIP files

RAR files

Screen capture utilities

10. Command & Control (TA0011)

The attacker controls compromised systems remotely.

Techniques

• HTTPS Beaconing
• DNS Tunneling
• Reverse Shell
• TOR
• VPN
• WebSockets

Detection

• Beacon intervals
• JA3 Fingerprints
• Unusual DNS
• Long-lived HTTPS sessions

11. Exfiltration (TA0010)

Attackers steal data.

Methods

• HTTPS Upload
• Cloud Storage
• FTP
• Dropbox
• OneDrive
• Google Drive

Detection

• Large outbound traffic
• Rare destinations
• Unusual upload activity

12. Impact (TA0040)

Final objective.

Examples

• File Encryption
• Disk Wiping
• Data Destruction
• Domain Takeover
• Service Shutdown

Real examples

LockBit

BlackCat

NotPetya

Detection

EDR

File Integrity Monitoring

Mass file rename alerts

MITRE vs Cyber Kill Chain

Cyber Kill ChainMITRE ATT&CKHigh-level attack stagesDetailed attacker behavior7 phasesHundreds of techniquesLinear modelFlexible attack pathsEasier for beginnersBetter for detection engineeringShows attack progressionShows attacker capabilities

Most organizations use both frameworks together.

MITRE in the SOC

Every alert investigated by a SOC analyst should be mapped to MITRE ATT&CK.

For example:

Alert:

PowerShell launched from Word

↓

Execution (TA0002)

↓

T1059

↓

Next hunting step:

Look for persistence

↓

Registry changes

↓

Scheduled tasks

↓

Credential dumping

↓

Lateral movement

MITRE helps analysts predict the attacker's next move.

Detection Engineering with MITRE

Security teams build detection rules around MITRE techniques.

Example Sigma Rule

title: Office Launching PowerShell
logsource:
  product: windows
detection:
  selection:
    ParentImage: WINWORD.EXE
    Image: powershell.exe
condition: selection

title: Office Launching PowerShell
logsource:
  product: windows
detection:
  selection:
    ParentImage: WINWORD.EXE
    Image: powershell.exe
condition: selection

Mapped Technique:

T1059 — Command and Scripting Interpreter

This standardization makes detections easier to share across different SIEM and EDR platforms.

Real-World Example

A phishing email delivers a malicious Office document.

1. Initial Access (TA0001): Spearphishing Attachment.
2. Execution (TA0002): Macro launches PowerShell.
3. Persistence (TA0003): Scheduled Task created.
4. Credential Access (TA0006): Mimikatz dumps credentials.
5. Lateral Movement (TA0008): PsExec spreads to servers.
6. Collection (TA0009): Sensitive files archived.
7. Exfiltration (TA0010): Data uploaded to attacker infrastructure.
8. Impact (TA0040): Ransomware encrypts systems.

Mapping each step to MITRE gives defenders a structured way to investigate and respond.

Key Takeaways

• MITRE ATT&CK is the industry-standard framework for describing adversary behavior.
• It organizes attacks into tactics and techniques based on real-world observations.
• SOC analysts use MITRE to investigate alerts, hunt threats, and build detections.
• Detection engineering often maps Sigma rules, SIEM analytics, and EDR alerts to ATT&CK techniques.
• Combined with the Cyber Kill Chain, MITRE ATT&CK provides a comprehensive view of modern cyber attacks.