ATT&CK mapping decisions for detection engineering

Q1. How do the attached sources describe ATT&CK at a high level?
- A globally-accessible knowledge base of adversary tactics and techniques based on real-world observations
- A catalog of only malware hashes and file signatures
- A framework that lists only vulnerability severity scores
- A patch-management system for enterprise software
Answer: A globally-accessible knowledge base of adversary tactics and techniques based on real-world observations[[cite:1]][[cite:2]]
Q2. According to the attached sources, what does an ATT&CK technique represent?
- The 'how' of an adversary's action
- A list of vendors affected by an incident
- A numeric score for exploitability
- A defensive control baseline
Answer: The 'how' of an adversary's action[[cite:3]]
Q3. For detection engineering, what mapping approach do the sources support when an observed behavior could fit more than one ATT&CK entry?
- Map it to the technique that best matches the action and use a sub-technique when the behavior is more specific
- Avoid mapping until the adversary confirms intent
- Always map every event to the broadest tactic only
- Create a new technique name for each incident
Answer: Map it to the technique that best matches the action and use a sub-technique when the behavior is more specific[[cite:4]]
Q4. Which statement best reflects the limitation noted in the attached sources about recurring behaviors such as privilege escalation, persistence, active scanning, account manipulation, and exfiltration-related activity?
- The sources support mapping those behaviors, but do not name exact ATT&CK technique IDs for them
- The sources provide exact technique IDs for each of those behaviors
- The sources say those behaviors should never be mapped to ATT&CK
- The sources only discuss malware families, not behaviors
Answer: The sources support mapping those behaviors, but do not name exact ATT&CK technique IDs for them[[cite:5]][[cite:6]]

common language for threat actor analysis.

ATT&CK mapping decisions for detection engineering

Explore related topics