Significance of MITRE ATT&CK framework
                     Significance of MITRE ATT&CK
 framework
www.infosectrain.com | [email protected]
ATT&CK is a framework introduced by MITRE corporation in 2013 that describes the adversary’s 
attack cycle phases. ATT&CK is an abbreviation of Adversarial Tactics, Techniques & common 
knowledge. The framework provides a globally accessed knowledge base classifying the known 
adversarial attacks and compiling them into tactics and techniques. It gives red teams, the blue 
team, and security analysts a common language to address adversaries’ behavior.
www.infosectrain.com | [email protected]
The ATT&CK framework helps organizations to the risks after the security incident has 
occurred. Security teams can determine the sequence of steps adversaries may follow 
to break in and how they operate within the network infrastructure. The threat 
hunters and defenders use these tactics and techniques for evaluating the 
vulnerabilities in an organization.
Understanding MITRE ATT&CK framework
It is essential to have a brief overview of matrices to understand the MITRE ATT&CK 
framework, techniques, and sub techniques stated in the ATT&CK framework.
Matrices of ATT&CK Framework  
ATT&CK Framework describes three matrices that consist of tactics and techniques 
associated with them. The three matrices of the ATT&CK framework are:
•Enterprise: Enterprise matrix deals with the tactics and techniques for the Windows, 
macOS, and Linux platforms.
•Mobile: Mobile matrix deals with the tactics and techniques for the android and iOS 
platforms.
•PRE-ATT&CK: The PRE-ATT&CK matrix describes the tactics and techniques used by an 
attacker before attacking a target organization.
www.infosectrain.com | [email protected]
Core components of ATT&CK framework 
Tactics: Tactics are the short-term goals that the adversary wants to 
achieve during an attack. ATT&CK Framework has eleven tactics:
•Initial Access
•Execution
•Persistence
•Privilege Escalation
•Defense Evasion
•Credential Access
•Discovery
•Lateral Movement
•Collection
•Exfiltration   
www.infosectrain.com | [email protected]
Techniques and Sub-techniques: Techniques outlines how adversaries can 
achieve their objectives. Sub-techniques further describe how the behavior 
is used to achieve a goal.
Applications of MITRE ATT&CK framework?
Applications of MITRE ATT&CK framework are as follows:
•Integration of MITRE ATT&CK with different tools
The integration of ATT&CK’s tactics and techniques with different tools and 
services can strengthen the security posture. It is already integrated into 
automated SIEM solutions. IBM QRadar, Sentinal, Alienvault USM are already 
getting integrated with tactics and techniques of ATT&CK Framework.
•Information sharing
Whenever addressing any threat actor, attack, or group security analysts, 
defenders, and IR teams can use ATT&CK tactics and techniques as a 
common language.
www.infosectrain.com | [email protected]
•The blue team can use MITRE for creating a defensive 
strategy
Blue teams can understand the tactics and techniques used by 
adversaries to target an organization and employ defense strategies 
and mitigation strategies accordingly.
•The red team use it for planning attacks
The red team can plan strategies to test their security posture by 
following the adversarial emulation plan and modeling different 
tactics. The ATT&CK framework can also help red teams develop new 
techniques that cannot be identified by common defenses.
www.infosectrain.com | [email protected]
•Using ATT&CK with cyber threat intelligence
ATT&CK comes of great use in problem-solving when clubbed with threat 
intelligence. It provides an organized way to explain the tactics, 
techniques, and behavior of the adversaries. Both defender and security 
analysts can get benefitted from ATT&ck Framework and create a 
response program to thwart potential threats.
•Used in improving the efficiency of SOC
A security operations center (SOC) team can use the tactics and 
techniques of ATT&CK to improve its efficiency. The team can anticipate 
attackers’ behavior by observing their techniques, tactics, and procedures 
used in the past. It also helps them evaluate their defensive strength and 
unravel misconfigurations and operational concerns.
www.infosectrain.com | [email protected]
Why do we need a MITRE ATT&CK training course?
Mitre ATT&CK provides a common standardized language for organizations, 
government agencies, and security professionals to share threat intelligence. 
ATT&CK training helps candidates to validate their skills to prevent or address 
any potential cyber attack. After completing the training course, candidates 
will be able to:
•Setting up the appropriate environment to implement the ATT&CK 
framework
•Documenting the adversarial behavior
•Detecting and investigating attacks after post compromising
•Understanding the importance of ATT&ck for cyber threat intelligence
•Analyzing threat intelligence using ATT&ck
•Recommending security measures after CTI analysis
•Storing the mapped data of the ATT&CK Framework
www.infosectrain.com | [email protected]
MITRE ATT&CK training with Infosec Train
Infosec Train is among the pioneers in advanced IT security 
training providers whose trainings and security services are 
trusted by consumers worldwide. Our MITRE ATT&CK training is 
an excellent opportunity for candidates to learn from industry 
experts about implementing the ATT&CK framework to 
strengthen their organization’s overall security infrastructure.
Get yourself enrolled today!
www.infosectrain.com | [email protected]
About InfosecTrain
• Established in 2016, we are one of the finest 
Security and Technology Training and 
Consulting company
• Wide range of professional training programs, 
certifications & consulting services in the IT 
and Cyber Security domain
• High-quality technical services, certifications 
or customized training programs curated with 
professionals of over 15 years of combined 
experience in the domain
www.infosectrain.com | [email protected]
Our Endorsements
www.infosectrain.com | [email protected]
Why InfosecTrain Global Learning Partners
Certified and Flexible modes Access to the 
Experienced Instructors of Training recorded 
sessions
Post training Tailor Made 
completion Training
www.infosectrain.com | [email protected]
Our Trusted Clients
www.infosectrain.com | [email protected]

Contact us
Get your workforce reskilled 
by our certified and 
experienced instructors!
IND: 1800-843-7890 (Toll Free) / US: +1 657-221-
1127  / UK : +44 7451 208413
[email protected]
www.infosectrain.com