MITRE ATT&CK (attack techniques)

Forensic reports increasingly write T1078 (Valid Accounts) or T1486 (Data Encrypted for Impact) where they once wrote a sentence. Those codes come from MITRE ATT&CK, the knowledge base of attacker tactics and techniques maintained by MITRE, a U.S. nonprofit, and made public in 2015. The Enterprise matrix lays out 14 tactics, from reconnaissance to impact, through initial access, persistence, lateral movement and exfiltration. Under each sit techniques and sub-techniques, documented from observed cases and linked to the groups that use them. For the insurance market, the payoff is a shared vocabulary. Security vendors and some underwriters map an insured's controls to the techniques they block or detect: EDR answers one set, multi-factor authentication shuts down another, segmentation slows lateral movement. After a loss, the post-mortem is written technique by technique, which lets the carrier see where the chain gave way and compare it with what the application said. Matrix coverage is hard to measure, though: a box checked by a vendor says a detection rule exists, and rarely that it held up against a real attacker. Not to be confused with the cyber kill chain, the seven-stage model Lockheed Martin published in 2011, which is more linear, or with CVE and CVSS, which catalog and score software vulnerabilities. ATT&CK describes what the attacker does once the door is found; the CVE names the door.