AiVibeMITRE ATT&CK
A globally accessible knowledge base of adversary tactics and techniques based on real-world observations, used to describe attacker behaviour, map detection coverage and plan defences.
ATT&CK, short for Adversarial Tactics, Techniques and Common Knowledge, is maintained by the MITRE Corporation and organised as matrices. Columns represent tactics, the attacker's goals, such as initial access, persistence, privilege escalation, lateral movement and exfiltration. Entries are techniques and sub-techniques describing how those goals are achieved, each with an identifier, examples of use by known groups, detection ideas and mitigations. Separate matrices cover enterprise environments, mobile platforms and industrial control systems.
Security operations teams map detection rules and SIEM content to ATT&CK techniques to find gaps, threat intelligence analysts describe campaigns in its terms, and red teams use it to plan adversary emulation. Its shared vocabulary also helps organisations compare threat reports from different sources and communicate about coverage with vendors and auditors.
ATT&CK describes behaviour rather than prescribing controls, and complete coverage of every technique is neither realistic nor necessary; teams prioritise the techniques used by threats relevant to their sector. Related MITRE resources include D3FEND for defensive countermeasures and CAPEC for attack patterns against software. The knowledge base is updated regularly as new techniques are observed.
Key points
- Organises attacker behaviour into tactics, techniques and sub-techniques.
- Separate matrices exist for enterprise, mobile and ICS environments.
- Used to map detection coverage and plan adversary emulation.
- Built from observed real-world attacks and updated regularly.
Where AiVibe comes in
AiVibe is ISO/IEC 27001:2022 certified, and its security services include vulnerability assessment and penetration testing, code security analysis (SAST, DAST, IAST, SCA), compliance gap analysis and 24/7 monitoring; AiVedha.ai runs more than 170 automated website security checks.
Related terms
- Threat IntelligenceCybersecurity & Compliance
- Security Operations Centre (SOC)Cybersecurity & Compliance
- Security Information and Event Management (SIEM)Cybersecurity & Compliance
- Threat ModellingCybersecurity & Compliance
- Penetration TestingCybersecurity & Compliance
- IEC 62443 (ISA/IEC 62443)OT & Industrial Cybersecurity