MITRE ATT&CK overview

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a public, globally accessible catalogue of how attackers actually behave once they are inside a system, built from real-world observations. It provides a common taxonomy for describing threats, grouping behaviour into tactics (the why - “persistence”, “privilege escalation”) and techniques (the how - “create or modify systemd service”, “abuse sudo”). AlertKick’s eBPF security pipeline tags every event with the relevant tactic and technique codes, so when an alert arrives you immediately know what part of the kill-chain it is on.

Framework structure

• Tactics - high-level objectives an adversary is trying to achieve during an attack
• Techniques - specific methods used to accomplish a tactical objective
• Sub-techniques - more specific variations of a technique (for example T1053.003 is “Cron” under T1053 “Scheduled Task/Job”)
• Mitigations - security controls that prevent or limit the effectiveness of a technique

Why this matters

A raw eBPF event by itself (“process X opened /etc/shadow”) is hard to triage without context. The same event might be a legitimate password tool, an attacker enumerating credentials, or a misconfigured monitoring agent. The MITRE mapping does not tell you which of those it is, but it does tell you:

• What stage of an attack this would be - early reconnaissance behaves very differently from late-stage exfiltration
• What to look for next - each technique has documented follow-ons in the catalogue
• Whether multiple events are related - events tagged with adjacent tactics on the same host within a short window suggest a chain, not noise

The shared vocabulary also makes security discussions, incident reports, and gap analysis of existing controls easier, because everyone is naming the same behaviour the same way.

How the mapping works

Every event that comes out of the agent’s eBPF probes is run through the detection ruleset. Matching rules contribute MITRE tactic/technique codes to the event, stored as:

{
  "mitre_tactics":    ["TA0003", "TA0004"],
  "mitre_techniques": ["T1543.002", "T1548.001"]
}

A single event can carry multiple tactics (it is normal for “persistence” and “privilege escalation” to co-occur). The dashboard renders tactic codes as short labels on each event; click one to filter the timeline to other events tagged with the same tactic.

Detection combines three sources:

• Rule-based detection for known attack patterns, shipped and maintained by AlertKick
• Custom rules for organisation-specific threats
• AI verdicts that rank each event so the on-call sees suspicious behaviour before benign noise

Security profiles applied to a host decide which probes and rules are active, so coverage of a given tactic depends on the profile in use. See eBPF security monitoring for configuring them.

The tactics, in plain English

Code	Tactic	What it means in practice
TA0001	Initial Access	First foothold - a successful exploit or stolen credential
TA0002	Execution	Running attacker code on the host
TA0003	Persistence	Surviving a reboot or a process kill
TA0004	Privilege Escalation	Going from a regular user to root (or root to kernel)
TA0005	Defense Evasion	Hiding from logging, AV, or auditing
TA0006	Credential Access	Stealing passwords, keys, or session tokens
TA0007	Discovery	Looking around - what is installed, who is logged in
TA0008	Lateral Movement	Hopping from one host to another
TA0009	Collection	Gathering files or data of interest
TA0010	Exfiltration	Sending the collected data out
TA0011	Command and Control	Talking to an external server for instructions
TA0040	Impact	Destruction, encryption, or disruption

Each tactic is covered in more depth on the tactics page.

Reading an event

A typical AlertKick eBPF event looks like:

Host:        api-prod-04
Process:     /usr/bin/cron -> /tmp/.x/runner (parent -> child)
User:        www-data (uid=33)
Tactics:     Persistence (TA0003), Defense Evasion (TA0005)
Techniques:  T1053.003 (Scheduled Task/Job: Cron),
             T1564.001 (Hide Artifacts: Hidden Files and Directories)
Verdict:     suspicious (AI)

The tactics narrow what the attacker is trying to do; the techniques describe the specific method. T1053.003 is “Cron” specifically - useful to know when writing a follow-up rule that only fires on crontab modifications from web-server users.

How to use this during an incident

1. Look at the tactic, not just the rule - a single rule firing tells you one thing happened. A cluster of events tagged “Discovery” -> “Lateral Movement” -> “Credential Access” on the same host inside ten minutes is the shape of an actual intrusion.
2. Filter by technique to find related events - click the technique chip in the event detail to surface every other event on every host that matched the same technique. Helpful for confirming whether one machine is compromised or several.
3. Cross-reference the MITRE site - every technique code links out to attack.mitre.org. The pages there have detection ideas, mitigations, and observed-in-the-wild examples that map cleanly to what you are seeing in AlertKick. The mitigations page summarises the controls most relevant to what the agent detects.

What is not tagged

Not every event gets a tactic. Things like “high CPU usage” or “disk full” are infrastructure signals, not attacker behaviour, and they intentionally do not get a MITRE label. If an event has no tactics but a high AI verdict, it is probably something the rule engine flagged for shape rather than for malicious intent - read the rule description for context.

Getting started

1. Understand the environment - identify critical assets and data, map the network, and note the security controls already in place.
2. Configure monitoring - install the agent, apply a security profile, and enable the eBPF security rules relevant to those assets so events start flowing.
3. Establish baselines - watch normal behaviour for a while, mark legitimate activity as such, and tune thresholds and rules before paging anyone on them.
4. Wire up response - route critical-tactic events through escalation policies so they reach the on-call, and keep runbooks for the tactics that matter most.

Next steps

• Tactics - detailed coverage of each tactic
• Techniques - specific detection methods
• Mitigations - security control implementation
• eBPF security monitoring - configure AlertKick for MITRE detection
• The consolidated view guide explains how MITRE chips appear on the dashboard

Resources

• MITRE ATT&CK website: https://attack.mitre.org/
• Custom security profiles: contact support at support [at] alertkick [dot] com