MITRE ATT&CK and detection engineering

MITRE ATT&CK is a map of attacker behaviour, built from real intrusions. It gives defenders a shared vocabulary for coverage, gaps and detection ideas.

Tactics and techniques

Tactics are the attacker's goal: initial access, persistence, privilege escalation, credential access, lateral movement, exfiltration. Techniques are how they achieve it, such as phishing, scheduled tasks, LSASS memory access or remote services.

A technique entry describes:

• what the attacker does;
• the platforms it applies to;
• the telemetry it may leave;
• real-world procedure examples.

Do not treat the framework as a checklist to "complete". Use it to ask which behaviours matter for your environment.

From behaviour to detection

A detection hypothesis has four parts:

1. Technique — what behaviour are we trying to catch?
2. Telemetry — which source would record it?
3. Logic — what pattern distinguishes malicious from benign?
4. Test — how will we prove it fires and measure noise?

Example: Suspicious PowerShell

• Technique: T1059.001, command and scripting interpreter.
• Telemetry: process creation with command line, PowerShell script block logs.
• Logic: Office process spawns PowerShell with an encoded command.
• Test: run a benign simulation and a known-good admin script; compare.