MITRE ATT&CK for Beginners, With a Ransomware Example

The MITRE ATT&CK framework organizes known adversary behaviors into tactical phases representing the lifecycle of an intrusion. Rather than focusing on brittle indicators like hash sums, defensive engineering models attacker technique primitives.

1. Tactics vs. Techniques

A Tactic represents the adversary’s operational objective (e.g., Initial Access, Persistence, Defense Evasion, Impact).

A Technique represents the specific mechanism used to achieve that tactic (e.g., T1059 Command and Scripting Interpreter).

2. Modeling a Ransomware Intrusion Chain

To visualize how ATT&CK informs detection logic, trace a standard ransomware sequence:

1. Initial Access (T1566): Malicious attachment executed by an end user.
2. Execution (T1059.001): PowerShell script spawns hidden subprocesses to download secondary payloads.
3. Defense Evasion (T1070): Windows Security event logs cleared via wevtutil.exe.
4. Impact (T1486): High-speed cryptographic encryption targeting shared network drives and local data repositories.

3. Engineering Detections from ATT&CK Data Sources

Effective detection begins by mapping available telemetry (such as Process Creation Event ID 4688 or Sysmon Event 1) against the specific command line parameters adversaries rely upon.