Skip to main content
Back to path

Welcome to a Grasp lesson

Create a free account to keep studying and create your own study path.

Lesson 8

Mapping Adversary Behaviors to MITRE ATT&CK

Recommended resources

Welcome to the final lesson of our first module. In our previous lesson, we examined the Cyber Kill Chain, which gave us a high-level, strategic map of the phases of a cyberattack. We saw how it models the "what" and "when" of an attack campaign. However, as we noted, modern defense requires a more detailed understanding of specific adversary actions.

This lesson introduces the MITRE ATT&CK® framework, a globally recognized knowledge base that catalogs the "how" of adversary behavior. Where the Kill Chain provides the strategic sequence, ATT&CK provides the granular, tactical and technical details. Your goal is to understand its structure and learn the fundamental process of mapping an adversary's actions to the framework's tactics and techniques. For you as an aspiring SOC Analyst, this is not just vocabulary—it's the language you will use daily to describe, detect, and respond to threats.

From Kill Chain to ATT&CK: A Deeper Dive

The Cyber Kill Chain is an excellent model for understanding an attack's lifecycle, but it doesn't describe the specific actions an adversary might take within each phase. For example, the "Exploitation" phase could involve a dozen different methods. This is where ATT&CK shines. It's a comprehensive library of those methods, observed in real-world intrusions.

The video below offers a great introduction to why this framework is so critical for a security analyst. It explains the core concepts and shows how ATT&CK helps you move from looking at isolated alerts to understanding the full story of an attack.

How to Actually Use MITRE ATT&CK as a Beginner (Not Just Memorize It)

This video from the MyDFIR channel explains the purpose of the ATT&CK framework and provides a simple, practical example of its use.

Please watch from the beginning to the end of the example. Pay close attention to the distinction between Tactics (the "why") and Techniques (the "how"), and notice how the framework provides specific, actionable information for detection and mitigation.

The Structure of ATT&CK

As the video highlighted, ATT&CK is built on a hierarchy that allows analysts to describe adversary behavior with increasing levels of specificity. Understanding this structure is key to using the framework effectively. Let's formalize these concepts using the official best practices guide from CISA.

[PDF] Best Practices for MITRE ATT&CK Mapping - CISA

This document from CISA provides authoritative guidance on using the ATT&CK framework. This section breaks down its hierarchical structure.

Please read the section titled "ATT&CK Levels" (page 4). Focus on the definitions of the four levels: Tactics, Techniques, Sub-techniques, and Procedures.

To summarize and visualize this hierarchy:

This infographic provides a comprehensive overview of the MITRE ATT&CK framework, including its structure, a mapping process, and common pitfalls. We will refer back to it throughout the lesson.

As you can see in the "Understanding the ATT&CK® Framework" pyramid on the left of the infographic, the structure is:

  • Level 1: Tactics (The "Why"): These are the adversary's technical goals. Examples include Privilege Escalation, Lateral Movement, and Exfiltration. There are 14 tactics in the Enterprise matrix.
  • Level 2: Techniques (The "How"): These describe how an adversary achieves a tactical goal. For example, to achieve Credential Access (a tactic), an adversary might use the OS Credential Dumping technique.
  • Level 3: Sub-techniques (The Granular "How"): These provide a more specific description of how a technique is performed. OS Credential Dumping (T1003) has sub-techniques like LSASS Memory (T1003.001) or Security Account Manager (T1003.002).
  • Level 4: Procedures (The "What"): These are the specific, in-the-wild implementations of techniques and sub-techniques. For example, using the tool mimikatz to perform LSASS memory dumping is a procedure.

This structured vocabulary allows a SOC analyst to communicate precisely. Instead of saying "the attacker moved around," you can say, "the attacker performed lateral movement (TA0008) using Remote Services: RDP (T1021.001)." This is an unambiguous, actionable statement for your team.

The Mapping Process: From Evidence to Insight

Now that we understand the structure, how do we apply it? Mapping is the process of taking information about an adversary's behavior—from a finished intelligence report or raw log data—and associating it with specific ATT&CK tactics and techniques.

The CISA guide outlines a formal, six-step process for this, which is also visualized in the infographic above.

[PDF] Best Practices for MITRE ATT&CK Mapping - CISA

This section details a step-by-step methodology for mapping a CTI report to the ATT&CK framework.

Read the section "MAPPING MITRE ATT&CK INTO FINISHED REPORTS" (pages 7-10). As you read, focus on the logical flow from finding a behavior to identifying the specific sub-technique.

The six steps are:

  1. Find the behavior: Shift from looking for static IOCs (like file hashes) to adversarial actions.
  2. Research the behavior: Build context using original sources.
  3. Translate to a Tactic: Identify the adversary's goal (the "why").
  4. Identify the Technique: Drill down into the technical details (the "how").
  5. Pinpoint the Sub-technique: Get as specific as possible.
  6. Compare with Peers: Collaborate to increase accuracy and reduce bias.

A Practical Example: Mapping a Linux Intrusion

Reading about the process is one thing; seeing it in action is another. The following video from an ATT&CK conference shows an expert analyst walking through a Linux intrusion, mapping the attacker's command-line actions to the framework in real time. This is exactly the kind of analysis you'll do as a SOC analyst.

Mapping to MITRE ATT&CK - ATT&CKcon 3.0 Day 1

In this segment, Jason Wood from CrowdStrike's OverWatch team dissects a Linux intrusion, command by command, and maps each action to a specific ATT&CK technique.

Watch the segment from the start of the intrusion walkthrough. Don't worry about catching every single detail. Instead, focus on the process of how the analyst takes a command line and translates it into a technique. For instance, notice how he maps the find command, the wget command, and the chmod command.

Let's recap the analyst's thought process from the video, which is a perfect example of mapping raw data:

  • Behavior: Adversary runs find . -name "*.properties".
    • Analyst's Thought: They are looking for files on the system.
    • Mapping: File and Directory Discovery (T1083), under the Discovery tactic.
  • Behavior: Adversary uses wget to download a tool from a remote site.
    • Analyst's Thought: They are transferring a tool from an external source onto the compromised host.
    • Mapping: Ingress Tool Transfer (T1105), under the Command and Control tactic.
  • Behavior: Adversary runs chmod +x on the downloaded file.
    • Analyst's Thought: They are changing file permissions to make it executable. The video doesn't explicitly map this, but it could be seen as part of Execution (TA0002) preparation or even a defense evasion technique if it's to bypass execution policies. This shows how one action can sometimes relate to multiple ideas.
  • Behavior: Adversary tries to execute the tool, fails, and then tries to set up a reverse shell using bash -i >& /dev/tcp/....
    • Analyst's Thought: They are using a built-in shell to create a C2 channel on a non-standard port.
    • Mapping: Command and Scripting Interpreter: Unix Shell (T1059.004) and Non-Standard Port (T1571).

This is the core workflow of a SOC analyst: taking raw technical evidence and giving it meaning and context through a structured framework.

Common Mistakes and Best Practices

As with any analytical skill, there are common pitfalls to avoid. Being aware of them will help you make your mappings more accurate and valuable.

MITRE ATT&CK: Mapping Real Alerts to Tactics ...

This blog post from CyberDefenders provides practical advice from a SOC perspective. This section lists common mistakes teams make when starting with ATT&CK.

Read the section titled "Common mistakes SOC teams make with ATT&CK". Pay particular attention to Mistake #1 (Mapping to tactics instead of techniques) and Mistake #2 (Over-Mapping Execution).

Here are some key mistakes to avoid, combining insights from our resources:

  • Mapping to Tactics Only: Saying an alert is "Execution" is not helpful. You must map to the specific technique (e.g., T1059.001: PowerShell).
  • Leaping to Conclusions: Don't map without sufficient evidence. Malware using port 443 isn't automatically Web Protocols (T1071.001); you must confirm it's actually using HTTP/S.
  • Miscategorization: Understand the nuances. Deleting files for Defense Evasion (T1070.004) is different from deleting them for Impact (T1485: Data Destruction). The tactic (the "why") is different even if the action looks similar.
  • Ignoring Sub-techniques: Be as specific as your data allows. "Credential Dumping" (T1003) is good, but "Credential Dumping: LSASS Memory" (T1003.001) is better if you have evidence for it.

Conclusion

In this lesson, you've moved beyond the strategic overview of the Cyber Kill Chain into the technical details of the MITRE ATT&CK framework. You've learned how it provides a common language for describing adversary actions, which is a cornerstone of modern security operations.

Here are the key takeaways:

  • The MITRE ATT&CK framework is a knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations.
  • It is structured hierarchically: Tactics are the "why," Techniques are the "how," Sub-techniques are the granular "how," and Procedures are the specific implementations.
  • Mapping is the analytical process of translating evidence of adversary behavior into the ATT&CK framework.
  • This skill is crucial for SOC analysts to accurately analyze alerts, document incidents, and communicate threats in a standardized way.

This lesson concludes our first module on Cybersecurity Fundamentals. We've established a strong conceptual foundation, covering everything from the CIA triad and threat actors to the structured frameworks used to analyze their attacks.

What's Next?

To detect the tactics and techniques we've just discussed, you must understand the environment where they occur. Most attacks, from initial access to data exfiltration, traverse a network. Therefore, our next module, Network Foundations, will shift focus to the underlying infrastructure of digital communication. We will begin by dissecting the fundamental OSI and TCP/IP models, which describe how data moves from one computer to another across the globe. A deep understanding of networking is non-negotiable for a skilled SOC analyst.

End of Module,Exit lesson