![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt530eb1f4e672eb44/653a71690e92cc040a3e9d6d/Dark_Reading_Logo_TheEdge_0.png?width=700&auto=webp&quality=80&disable=upscale)
Cybersecurity In-Depth: Getting answers to questions about IT security threats and best practices from trusted cybersecurity professionals and industry experts.
How Should My Security Analyst Use the MITRE ATT&CK Framework?
As a curated knowledge base for adversary behavior, the MITRE ATT&CK framework can guide defenders on how to conduct an investigation and the order of things to look for.
![Silhouette of a person looking through binoculars into the distance, during sunset. Silhouette of a person looking through binoculars into the distance, during sunset.](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blte112fe453e8a5213/64f1181511a9e57404193085/Slide1_Intro_Look-Ahead_Courtney-Keating_iStock_74215873_LARGE.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Question: How should my security analyst use the MITRE ATT&CK Framework?
Yair Manor, Co-Founder and CTO, CardinalOps: As an analyst, ATT&CK lets you reason and communicate in a structured way about what an attacker may be trying to achieve and where they are in the kill chain. For example, is a particular alert related to an attacker establishing initial access or are they already exfiltrating data? Use ATT&CK as a standard language for communicating with your peers during investigations.
Use ATT&CK to guide your thinking on what to investigate next. If you see a Discovery technique being used, you may want to look for a Lateral Movement technique on that same machine. Or perhaps look for Credential Access or Execution to understand how the attacker got onto the machine in the first place. Map each of your security tools and log sources to ATT&CK so you know the best tools to use for each asset type and each step in the kill chain.
Start by making sure you have detections for your most critical “crown jewel” assets and associated data sources, such as Windows, Linux, and the cloud. You can’t check the box for “Persistence,” for example, until you’ve implemented coverage for all of them. If your organization is focusing on zero trust, make sure you’re also covering identity sources, such as Active Directory and Okta. You can also prioritize detections based on techniques employed by specific APT and cybercriminal groups that target your industry.
Remember that new and emerging techniques don’t always map directly to the MITRE framework, so be sure to also monitor threat intelligence sources and implement detections as quickly as possible for the latest attack types (like Log4Shell). Regularly report your current ATT&CK coverage to stakeholders and focus on continuous improvement over time, based on reducing risk to your crown jewel assets.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024