What Is MITRE ATT&CK?
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. For SOC teams, it is the definitive reference for understanding how threat actors operate.
Why SOC Teams Need ATT&CK
Traditional security monitoring relies on indicators of compromise (IOCs) such as IP addresses and file hashes. These are ephemeral — attackers rotate them constantly. ATT&CK shifts the focus to behaviours, which are significantly harder to change.
By mapping detections to ATT&CK techniques, your SOC gains:
- Coverage visibility — understand which attack phases you can detect vs. which are blind spots
- Hunt prioritisation — focus effort on high-frequency techniques used by relevant threat groups
- Incident correlation — link disparate alerts into coherent attack narratives
Key Tactics to Prioritise
For most enterprise SOC teams, these tactics deserve immediate attention:
1. Initial Access (TA0001) Spearphishing attachments (T1566.001) remain the most common entry vector. Ensure you have email gateway logging feeding into your SIEM.
2. Execution (TA0002) PowerShell abuse (T1059.001) and Windows Management Instrumentation (T1047) are heavily used by ransomware operators. Enable PowerShell script block logging.
3. Persistence (TA0003) Scheduled tasks (T1053.005) and registry run keys (T1547.001) are the most common persistence mechanisms. Baseline your environment and alert on changes.
4. Lateral Movement (TA0008) Pass-the-Hash (T1550.002) and WMI remote execution (T1021.006) allow attackers to spread across your network. Monitor for unusual authentication patterns.
5. Exfiltration (TA0010) Data staged in compressed archives (T1560) and exfiltrated over HTTPS (T1048.002) is difficult to detect without DLP controls.
Building ATT&CK-Aligned Detections in Sentinel
Microsoft Sentinel includes ATT&CK alignment in its built-in analytics rules. Here is how to extend coverage:
// Detect PowerShell encoded command execution (T1059.001)
SecurityEvent
| where EventID == 4688
| where CommandLine has_any ("-EncodedCommand", "-enc ", "-ec ")
| project TimeGenerated, Computer, Account, CommandLine
| order by TimeGenerated desc
Measuring Your Coverage
Use the ATT&CK Navigator tool to visualise your detection coverage. Assign a score (0–3) to each technique based on your detection confidence:
- 0: No coverage
- 1: Alert exists but untested
- 2: Alert tested and validated
- 3: Automated response in place
Review your heatmap quarterly and share it with leadership to demonstrate SOC maturity.
Getting Started
- Download the ATT&CK Navigator from the MITRE website
- Import your existing Sentinel analytics rules and map them to techniques
- Identify your top three blind spots by technique frequency
- Build hunt queries for each blind spot using KQL
The ATT&CK framework is not a checklist to complete — it is a living tool for continuous improvement. Begin with the techniques most relevant to your industry and threat landscape.