Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

Reference

ATT&CK index

Everything published here, arranged by the technique it teaches rather than by the topic it belongs to. Tactics run in kill-chain order, because that order is the thing worth internalising.

New to this? Start with what ATT&CK actually is.

Reconnaissance

Looking at you from outside, before anything has been touched.

What to do when reconnaissance shows up: every technique in this stage with the mitigations that reduce it and the detection guidance that finds it.

Nothing here yet. If you have worked one of these, write it up.

Resource Development

Building the infrastructure they will use on you. Mostly invisible until afterwards.

What to do when resource development shows up: every technique in this stage with the mitigations that reduce it and the detection guidance that finds it.

Initial Access

How they got in. The single most valuable thing to establish, because everything downstream reopens if you miss it.

What to do when initial access shows up: every technique in this stage with the mitigations that reduce it and the detection guidance that finds it.

Execution

Running code on your estate. Usually the first thing a control actually sees.

What to do when execution shows up: every technique in this stage with the mitigations that reduce it and the detection guidance that finds it.

Persistence

Surviving a reboot, and surviving you. Eviction fails when this is missed.

What to do when persistence shows up: every technique in this stage with the mitigations that reduce it and the detection guidance that finds it.

Privilege Escalation

Getting the rights they actually wanted. Often the step between a nuisance and an incident.

What to do when privilege escalation shows up: every technique in this stage with the mitigations that reduce it and the detection guidance that finds it.

Stealth

Staying unseen. ATT&CK split the old Defense Evasion tactic, and this is the half about not being noticed.

What to do when stealth shows up: every technique in this stage with the mitigations that reduce it and the detection guidance that finds it.

Defense Impairment

Turning your controls off. The other half of the old Defense Evasion, and a reliable sign that somebody is preparing to finish.

What to do when defense impairment shows up: every technique in this stage with the mitigations that reduce it and the detection guidance that finds it.

Credential Access

Taking the keys. A successful login by a malicious actor starts here, and it is why eviction has to include credentials.

What to do when credential access shows up: every technique in this stage with the mitigations that reduce it and the detection guidance that finds it.

Discovery

Learning the estate. Noisy, and the cheapest stage to catch.

What to do when discovery shows up: every technique in this stage with the mitigations that reduce it and the detection guidance that finds it.

Lateral Movement

Getting from the first host to the one that mattered.

What to do when lateral movement shows up: every technique in this stage with the mitigations that reduce it and the detection guidance that finds it.

Collection

Gathering what they came for, usually staged before it leaves.

What to do when collection shows up: every technique in this stage with the mitigations that reduce it and the detection guidance that finds it.

Command and Control

Talking to the outside. The channel that has to exist for any of the rest to be driven.

What to do when command and control shows up: every technique in this stage with the mitigations that reduce it and the detection guidance that finds it.

Exfiltration

Data leaving. The question the business will ask first and the hardest one to answer honestly.

What to do when exfiltration shows up: every technique in this stage with the mitigations that reduce it and the detection guidance that finds it.

Impact

Destruction, encryption, denial. The part everybody notices.

What to do when impact shows up: every technique in this stage with the mitigations that reduce it and the detection guidance that finds it.