Using MITRE ATT&CK Navigator to Strengthen Threat Modelling [PART: I]

Views: 19

Getting More Out of MITRE ATT&CK in Threat Modelling

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is an openly available knowledge base describing how cyber adversaries behave. The MITRE Corporation maintains it. Organisations use it to understand how attacks progress and to build defences that match real attacker behaviour.

The framework is a matrix. Tactics are the high-level objectives an attacker pursues, and techniques are the concrete methods used to achieve them. Every technique has descriptions, examples, and mitigations, which together show how threat actors operate and what tooling they rely on.

MITRE ATT&CK™ contains plenty of valuable information on:

• TTPs (Tactics, Techniques and Procedures)
• Groups (threat actors)
• Software (software used by threat actors)
• Data sources (visibility required for detection)
• Mitigations

The relationship between these types of information can be visualised using the following diagram:

🧩 10 Ways Teams Use MITRE ATT&CK in Practice

Splunk’s e-book 10 Ways to Take MITRE ATT&CK From Plan to Action (2020) argues that ATT&CK is useful well beyond the analyst. It gives different teams a shared language for describing attacker behaviour, the data needed to see it, and how well it is covered. The ten use cases:

1. 🧭 Head of Security Operations: set the strategy

ATT&CK helps a security leader move past prevention alone and build a prevent → detect → respond → improve cycle. The e-book cites Siemens’ EAGLE datacenter team. They prevent what they can, detect early what they can’t, investigate to learn from each case, and then tune the detection or add a preventive control. It also compares this loop to the NIST Cybersecurity Framework functions.

2. 🛠️ Security content developers / blue team: faster detections

When a new attack appears in the news, the team maps it to techniques, works out which data is needed, and writes analytics for several stages of the attack. The idea is to detect the whole operation, not one step of it. A Bank of England quote reports a turnaround as fast as two hours, versus waiting months for a vendor to add a feature.

3. 🗺️ SIEM architects: validate coverage

“Which systems send logs?” is not the same as “are we covered?”. Coverage also depends on whether the right actions produce events, and whether the active detection content looks for the right things. ATT&CK acts as the map for this. The e-book shows a matrix coloured by how much content is active, available, or still needs data (darker means more content).

4. 🔌 SOC engineers: justify data needs to IT operations

SOC engineers rarely own the systems they monitor, so they must explain why they need certain logs, such as scheduled task creation or PowerShell logging. Pointing to specific techniques makes that request concrete. It also lets IT operations choose the best collection method, for example a Sysmon configuration or an endpoint protection product.

5. 📋 IT security managers: document risk decisions

Standards such as ISO/IEC 27002 give general logging guidance. ATT&CK lets a manager make it measurable, for example: “X% of the techniques in the Initial Access tactic must be covered from event collection through correlation.” That makes the accepted level of risk explicit and recorded.

6. 💼 CISOs: prioritise and justify investment

Instead of one policy for everything, a CISO can link ATT&CK to the organisation’s own risks, past attacks, threat groups and APT reports. This reveals gaps and shapes a roadmap (more staff, more visibility, or new tools). Effort can then be focused on the techniques that protect the most critical assets.

7. 🚨 SOC analysts: risk-based alerting (RBA)

Many detections can overwhelm analysts with alerts. With RBA, each alert adds a risk score to an asset or user, based on the technique observed and optionally multiplied by how important the asset or user is. Analysts then investigate the highest-scoring entities first, which reduces alert fatigue.

8. 🧪 SIEM admins: data onboarding quality

Admins can use ATT&CK to check, during onboarding, that new data sources meet the SOC’s needs or whether extra tooling is required. Simulating attacker activity is another way to confirm the data is complete and usable.

9. 🔴 Pen testers and red teams: a common language

Beyond finding vulnerabilities, a red team should ask which of its actions the SOC failed to detect. Using ATT&CK as the shared vocabulary makes this easy to report, whether the testers are internal or a third party. The e-book also recommends simulating adversaries to confirm detections work end to end.

10. 🛒 Purchasing and IT leaders: define supplier requirements

Certificates such as ISO 27001 or NIST 800-53 show a vendor’s general posture, but not what data you can collect. ATT&CK helps define the specific event data a provider must supply. This matters most under a shared-responsibility model, where the provider has to allow automated collection of audit trails containing the right events.

⚡ Quick reference

A Worked Example: Exploit Public-Facing Application

The best way to understand ATT&CK is to open a technique page. Take Exploit Public-Facing Application (T1190). Every technique page follows the same five-part layout.

1. Technique name and details

The header block records the technique ID (T1190), notes that it has no sub-techniques, and places it under the Initial Access tactic. It lists the relevant platforms (Containers, IaaS, Linux, Network, Windows, macOS), the contributors, the version (2.4), and the creation and last-modified dates (April 2018 and April 2023).

The description explains that attackers target a weakness in an Internet-facing host or system to get their first foothold in a network. That weakness might be a software bug, a temporary glitch, or a misconfiguration. Typical targets include:

• Websites and web servers
• Databases such as SQL
• Standard services such as SMB or SSH
• Network device management protocols such as SNMP and Smart Install
• Any other system with an open, Internet-accessible socket

Depending on the flaw, the exploitation can also tie into Exploitation for Defense Evasion. In cloud or containerised environments, compromising the application can lead to the underlying instance or container. From there an attacker may reach cloud or container APIs, escape to the host, or abuse weak identity and access management policies. Edge network devices and appliances that lack strong host-based defences are also in scope. For web applications and databases, the page points to the OWASP Top 10 and CWE Top 25 as the lists of most common weaknesses.

2. Procedure examples

This section shows how real groups have used the technique:

3. Mitigations

Six mitigations are listed:

4. Detections

The page is candid that detecting software exploitation can be hard. Exploits may fail, or they may leave the targeted process unstable or crashed, so the signals are not always clean. Two data sources help:

• Application logs (DS0015): Web application firewalls may flag malformed or improper inputs that attempt exploitation.
• Network traffic content (DS0029): Deep packet inspection can look for exploit artefacts such as SQL injection strings or known payloads.

5. References

The final section collects outside material for further reading. For this technique it includes vulnerability database entries, advisories on state-sponsored actors targeting network infrastructure, and reports on incidents such as the exploitation of Microsoft Exchange zero-days.

Reading a technique page like this gives you insight into the specific methods an adversary uses. Applying the listed mitigations and detection ideas can then strengthen your overall security posture.

Plugging ATT&CK into Your Threat Modelling Process

ATT&CK slots into threat modelling by linking the threats and vulnerabilities you have identified to the framework’s tactics and techniques. The change to your methodology is one added step directly after “Identify Threats”:

1. Identify Threats. Work out which threats could affect your assets, including cyber attacks, physical attacks, social engineering, and insider threats.
2. Map to MITRE ATT&CK. Connect each identified threat to the matching tactics and techniques. For every technique you map, read its page (description, procedure examples, mitigations, and detection strategies) to understand more deeply what the threat means for your system.

Doing this gives you a more complete view of potential threats and makes it easier to apply the right countermeasures, which lowers your organisation’s overall risk.

Other Ways to Use ATT&CK

Threat modelling is one use among several. Depending on your needs, consider these three:

Identifying likely attack paths. Starting from your own infrastructure, the framework can map the routes an attacker might use to compromise you. If your organisation uses Office 365, for example, every technique attributed to that platform is relevant to your threat modelling.

Developing threat scenarios. ATT&CK attributes its tactics and techniques to known threat groups. You can use this to assess your organisation against the groups that are known to target your industry.

Prioritising vulnerability remediation. Each technique’s documentation helps you gauge how serious the impact could be if you suffered a similar attack. Your security team can use that to decide which vulnerabilities are most critical to fix first.

These examples are not exhaustive. How you use the framework is your decision.

Next Step

To refine the process further, the next step is to use and practice ATT&CK Navigator to map the identified threats.