MITRE ATT&CK : Guide for Beginner In Cybersecurity

CyberDefender 8 mins0

MITRE mapping is simply the practice of connecting your security alerts, detections, incidents, controls, and threat intel to the MITRE ATT&CK framework.
By doing this, you create a consistent way to describe what attackers are doing and clearly see how well your defenses actually cover those behaviors.

1. Reconnaissance

What it is:

Attackers gather information before engaging the target. This includes scanning the internet, scraping employee info, and learning about the organization.

How attackers use it:

  • Identify potential weaknesses (open ports, outdated software).
  • Discover employees to phish.
  • Gather data for social engineering.

Examples:

  • Searching LinkedIn for employee names.
  • Enumerating cloud storage buckets or exposed APIs.
  • Running mass-port scans or DNS enumeration.

Defensive view:

  • Monitor for abnormal external scanning.
  • Detect large volumes of requests to public-facing endpoints.

2. Resource Development

What it is:

Attackers prepare the tools, infrastructure, and access they need before launching an attack.

How attackers use it:

  • Buy or register domains for phishing.
  • Create malware, payloads, or obfuscated scripts.
  • Acquire compromised accounts.

Examples:

  • Purchasing VPS servers for C2.
  • Creating phishing email templates.
  • Developing malicious macros.

Defensive view:

Mostly intel-driven: track malicious infrastructure before it targets you.

3. Initial Access

What it is:

The adversary’s first entry into your environment.

How attackers use it:

  • Phishing emails
  • Exploiting public-facing vulnerabilities
  • Compromising valid credentials
  • Drive-by downloads / watering-hole attacks

Examples:

  • Phishing with a .docm payload (T1566.001)
  • Exploiting an unpatched VPN (T1190)

Defensive view:

  • Email security, MFA, patching, perimeter monitoring.

4. Execution

What it is:

Running attacker-controlled code in your environment.

How attackers use it:

  • Use scripts (PowerShell, Python, Bash).
  • Execute malware or payloads after initial compromise.

Examples:

  • PowerShell with encoded commands (T1059.001)
  • Running a malicious DLL.

Defensive view:

  • Monitor script engines, process creation anomalies.
  • Restrict macro execution, enforce application control.

5. Persistence

What it is:

Methods used to stay inside a system even after reboots or password changes.

How attackers use it:

  • Create new scheduled tasks.
  • Add registry run keys.
  • Install backdoors.
  • Abuse valid accounts.

Examples:

  • Startup folder backdoor (T1547)
  • New local admin user created.
  • Cloud access tokens reused.

Defensive view:

  • Monitor new services, tasks, accounts, and registry changes.

6. Privilege Escalation

What it is:

Gaining higher-level permissions (moving from user → admin → root).

How attackers use it:

  • Exploit kernel/vulnerability.
  • Abuse misconfigurations.
  • Token manipulation.

Examples:

  • Bypassing UAC (T1548).
  • Exploiting a local Windows privilege escalation bug.

Defensive view:

  • Detect unusual service creation.
  • Monitor access token manipulation and privilege changes.

7. Defense Evasion

What it is:

Techniques to avoid detection or bypass security tools.

How attackers use it:

  • Obfuscation, encryption of payloads.
  • Deleting logs.
  • Disabling antivirus.
  • Masquerading processes.

Examples:

  • Script obfuscation (T1027).
  • Clearing event logs (T1070).
  • Rename malware as “svchost.exe”.

Defensive view:

  • Integrity monitoring, EDR tamper protection, alert on service stops.

8. Credential Access

What it is:

Stealing usernames/passwords, hashes, tokens, cookies, etc.

How attackers use it:

  • Dump credentials from memory (LSASS).
  • Keylogging.
  • Password spraying or brute force.
  • Browser credential theft.

Examples:

  • LSASS dumping with procdump (T1003.001).
  • Stealing browser cookies for session hijacking.

Defensive view:

  • Monitor memory reads of LSASS.
  • Enforce MFA.
  • Detect authentication anomalies.

9. Discovery

What it is:

Understanding the target environment after intrusion.

How attackers use it:

  • Identify other systems.
  • Learn network layout.
  • Discover admin accounts.
  • Enumerate software, services, permissions.

Examples:

  • net user, net group, net view commands.
  • AD enumeration tools like SharpHound.

Defensive view:

  • Monitor command-line reconnaissance.
  • Detect excessive LDAP/AD queries.

10. Lateral Movement

What it is:

Moving from one compromised machine/account to another.

How attackers use it:

  • Leverage SMB, RDP, SSH.
  • Use stolen credentials.
  • Remote execution tools.

Examples:

  • Pass-the-Hash (T1550).
  • RDP from a non-standard host.
  • Using PsExec for remote execution.

Defensive view:

  • Monitor remote logins.
  • Detect credential reuse anomalies.
  • Restrict lateral movement paths.

11. Collection

What it is:

Collecting the data the attacker came to steal.

How attackers use it:

  • Taking screenshots.
  • Searching for sensitive files.
  • Copying databases.
  • Recording keystrokes.

Examples:

  • Keylogging (T1056).
  • Zipping sensitive folders.

Defensive view:

  • Alert on large file archives.
  • Detect tools that monitor input/output.

12. Command and Control (C2)

What it is:

Communication between attacker and compromised systems.

How attackers use it:

  • Use web protocols (HTTPS) to blend in with normal traffic.
  • Use DNS tunneling.
  • Use custom encrypted channels.

Examples:

  • HTTPS beaconing to a C2 server (T1071.001).
  • DNS TXT record tunneling.

Defensive view:

  • Detect unusual outbound traffic patterns.
  • Analyze user-agent strings and JA3 TLS fingerprints.

13. Exfiltration

What it is:

Stealing data from the environment and sending it out.

How attackers use it:

  • Upload to cloud storage.
  • Exfiltrate data over C2 channel.
  • Use compression and encryption.

Examples:

  • Exfiltration over HTTPS (T1041).
  • Exfiltration via cloud accounts (OneDrive, Google Drive).

Defensive view:

  • Detect unusual outbound data volume.
  • Monitor for uploads to untrusted destinations.

14. Impact

What it is:

Actions intended to disrupt, damage, or destroy — often the end goal in ransomware attacks.

How attackers use it:

  • Encrypt files (ransomware).
  • Destroy backups.
  • Wipe systems.
  • Deface websites.

Examples:

  • Data encryption for impact (T1486).
  • Disk wiping malware (Shamoon, NotPetya).

Defensive view:

  • Immutable backups.
  • Early ransomware behavior detection.
  • Rapid isolation capabilities.

CyberDefender