ATT&CK mapping decisions for detection engineering

Q1. How do the attached sources describe ATT&CK at a high level?
- A globally-accessible knowledge base of adversary tactics and techniques based on real-world observations
- A catalog of only malware hashes and file signatures
- A framework that lists only vulnerability severity scores
- A patch-management system for enterprise software
Answer: A globally-accessible knowledge base of adversary tactics and techniques based on real-world observations
Q2. According to the attached sources, what does an ATT&CK technique represent?
- The 'how' of an adversary's action
- A list of vendors affected by an incident
- A numeric score for exploitability
- A defensive control baseline
Answer: The 'how' of an adversary's action
Q3. For detection engineering, what mapping approach do the sources support when an observed behavior could fit more than one ATT&CK entry?
- Map it to the technique that best matches the action and use a sub-technique when the behavior is more specific
- Avoid mapping until the adversary confirms intent
- Always map every event to the broadest tactic only
- Create a new technique name for each incident
Answer: Map it to the technique that best matches the action and use a sub-technique when the behavior is more specific
Q4. Which statement best reflects the limitation noted in the attached sources about recurring behaviors such as privilege escalation, persistence, active scanning, account manipulation, and exfiltration-related activity?
- The sources support mapping those behaviors, but do not name exact ATT&CK technique IDs for them
- The sources provide exact technique IDs for each of those behaviors
- The sources say those behaviors should never be mapped to ATT&CK
- The sources only discuss malware families, not behaviors
Answer: The sources support mapping those behaviors, but do not name exact ATT&CK technique IDs for them

common language for threat actor analysis.

ATT&CK mapping decisions for detection engineering

Explore related topics