Understand how adversaries operate to defend against them
MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. It's organized into tactics (the "why" of an attack) and techniques (the "how").
Understanding these patterns helps defenders prioritize security controls, write better detection rules, and respond to incidents more effectively.
Adversaries send phishing messages to gain access to victim systems. Phishing can be targeted (spearphishing) or sent to large numbers of recipients.
Adversaries may attempt to take advantage of a weakness in an Internet-facing computer or program using software, data, or commands.
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces include PowerShell, Bash, Python, and more.
Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence.
Adversaries may abuse elevation control mechanisms like UAC bypass to gain higher privileges without prompting users.
Adversaries may attempt to make payloads difficult to discover or analyze by encoding, encrypting, or obfuscating contents.
Click any technique to learn more about it