31. SOC, SIEM and Incident Response
31.9 MITRE ATT&CK
Example first. When WannaCry hit in 2017, defenders described it in short codes. It spread with an SMB bug: T1210, Exploitation of Remote Services. It locked files: T1486, Data Encrypted for Impact. These codes come from MITRE ATT&CK. Any SOC in the world reads them the same way.
Why it matters
Different teams describe the same attack in different words. That causes confusion. ATT&CK gives everyone one shared list. It also shows which attacker moves you can detect and which you cannot.
What it is
MITRE ATT&CK is a free, public list of how real attackers behave. MITRE is a US non-profit. It builds the list from real attacks. It is laid out as a big table called a matrix.
| Word | Simple meaning |
|---|---|
| Tactic | The attacker's goal at a step. The why. Example: Initial Access, getting in. |
| Technique | The way they reach that goal. The how. Example: T1566 Phishing. |
| Sub-technique | A more exact version. Example: T1110.003 Password Spraying, under T1110 Brute Force. |
| Matrix | The table: tactics are columns, techniques sit under them. |
| Coverage | Which techniques your tools can detect. |
| Tactic (goal) | Technique example | ID |
|---|---|---|
| Initial Access | Phishing | T1566 |
| Execution | PowerShell | T1059.001 |
| Credential Access | Password Spraying | T1110.003 |
| Defense Evasion / Persistence | Valid Accounts | T1078 |
| Impact | Data Encrypted for Impact | T1486 |
The Enterprise matrix has 14 tactics, from Reconnaissance at the start to Impact at the end.
How to use it
- Read an incident report or alert.
- For each step, ask: what was the goal? That is the tactic.
- Ask: how did they do it? Find the technique and its ID.
- Tag your SIEM rules with these IDs.
- Colour the techniques you detect in the free ATT&CK Navigator tool.
- The empty boxes are your gaps. Build rules for the most common ones first.
Worked examples
Worked example 1: Tag one alert
Alert: "10 users failed login from one IP, one password each."
- Goal: get passwords. Tactic = Credential Access.
- Method: one password, many users. Technique = T1110.003 Password Spraying (Chapter 22.8).
- Add the tag
T1110.003to the SIEM rule.
Worked example 2: Map WannaCry (2017)
| Step | Tactic | Technique |
|---|---|---|
| Attacked the SMB service on port 445 | Lateral Movement | T1210 Exploitation of Remote Services |
| Encrypted files and asked for Bitcoin | Impact | T1486 Data Encrypted for Impact |
| Deleted Windows shadow copies | Impact | T1490 Inhibit System Recovery |
Worked example 3: Map the Microsoft email attack (2024)
- Password spraying on a test account: T1110.003.
- Logged in with the found account: T1078 Valid Accounts.
- Read email: Collection tactic.
- Fix list: MFA blocks T1110.003; alerts on odd logins catch T1078.
In short
- ATT&CK = a free shared list of real attacker behaviour.
- Tactic = goal (why). Technique = method (how), with an ID like T1566.
- Map alerts and incidents to IDs.
- Use the Navigator to find detection gaps.