Operationalizing
the MITRE ATT&CK® Framework

The MITRE ATT&CK® framework is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. Cymulate uses this framework to create realistic attack scenarios, allowing customers to assess and improve their security controls in production environments.

Book a Demo

14 Tactics of the ATT&CK Framework

The ATT&CK Matrix for Enterprise describes the cyber kill chain in 14 tactics, each with numerous techniques and sub-techniques. Implementing a single technique can have thousands of variations. For example, validating email security against spear phishing requires thousands of unique emails to identify those that bypass security controls undetected.

Reconnaissance

Techniques that involve adversaries actively or passively gathering information that can be used to support targeting.

Resource Development

Techniques that involve adversaries creating, purchasing, or compromising/ stealing resources that can be used to support targeting.

Initial Access

Techniques that use various entry vectors to gain their initial foothold within a network.

Execution

Techniques that result in adversary-controlled code running on a local or remote system.

Persistence

Techniques that adversaries use to keep access to systems across restarts,
changed credentials, and other interruptions that could cut off their access.

Privilege Escalation

Techniques that adversaries use to gain higher-level permissions on a system or network.

Defense Evasion

Techniques that adversaries use to avoid detection throughout their compromise.

Credential Access

Techniques for stealing credentials like account names and passwords.

Discovery

Techniques an adversary may use to gain knowledge about the system and internal network.

Lateral Movement

Techniques that adversaries use to enter and control remote systems on a network.

Collection

Techniques adversaries may use to gather information and the sources information is collected from that are relevant to following through on the adversary’s objectives.

Command and Control

Techniques that adversaries may use to communicate with systems under their control within a victim network.

Exfiltration

Techniques that adversaries may use to steal data from your network.

Impact

Techniques that adversaries use to disrupt availability or compromise
integrity by manipulating business and operational processes.

Mapping Vectors to MITRE ATT&CK Tactics

Cymulate maps ATT&CK tactics to attack vectors to assess security layers against real-world scenarios. Each attack vector implements multiple tactics, and the same tactics are used across different vectors, simulating actual attacks. For instance, the Recon vector includes techniques from both Reconnaissance and Resource Development, while Lateral Movement techniques are tested in both Endpoint and Lateral Movement vectors. This approach allows customers to independently assess and optimize each security layer against techniques used by threat actors.

ATTACK TacticsCymulate Attack Vectors and Modules
ReconWeb
Gateway		Email
Gateway		Web
Application
Firewall		Phishing
Awareness		Endpoint
Security		Lateral
Movement		Data
Exfiltration		Full Kill
Chain APT		Immediate
Threats
Intelligence		Purple
Team
Reconnaissance
Resource Development
Initial Access
Execution
Persistence
Privilege Escalation
Defense Evasion
Credential Access
Discovery
Lateral Movement
Collection
Command and Control
Exfiltration
Impact

Operationalize threat intelligence
& the MITRE ATT&CK framework

To continuously challenge, assess and optimize security operations.

MITRE ATT&CK Implementation
Threat Intelligence Assessments
Custom Scenarios
Attack simulations
IT, Cloud, and
Security Infrastructure
Logs
SIEM
SOAR
Correlated Findings

via API
Cymulate Portal
Output
Custom SIEM
Queries
Sigma Rules,
IoCs and IoBs
Detection and Mitigations
Guidance
SIEM/SOAR optimization

Mapping the Results

The MITRE ATT&CK® framework provides a comprehensive knowledge base and common taxonomy for the cyber-attack kill chain, allowing security professionals to use a shared language when describing attacks and vulnerabilities. Cymulate aligns with this framework, mapping assessments and results to it, and providing a heat map that highlights strengths and weaknesses in security architecture.

Mitre Attack framework

Featured Resources

View More Resources
image
Data Sheet

Cymulate Exposure Validation

Learn how Exposure Validation is the foundation for continuous automated red teaming. 

Read More
image
Report

2024 State of Exposure Management & Security Validation

2024 report on exposure management and security validation trends, gaps, and control effectiveness insights.

Learn More
Exposure Validation: Continuous Testing Should Drive Continuous Improvement
blog

Exposure Validation: Continuous Testing Should Drive Continuous Improvement

What’s your end goal? How exactly does this security project make you more secure?  Like any technology initiative, those two

Read More

GET A PERSONALIZED DEMO

Ready to see Cymulate in action?

Book a Demo