MITRE ATT&CK Tactics

MITRE ATT&CK Tactics Overview

MITRE ATT&CK tactics represent the “why” of an attack - the adversary’s tactical goals during different phases of their operation. Understanding these tactics helps security teams focus their monitoring and defense efforts.

Tactic 1: Initial Access (TA0001)

Description

Initial Access consists of techniques that use various entry vectors to gain their initial foothold within a network.

Key Techniques

• Phishing (T1566) - Spearphishing, service, attachment
• Exploit Public-Facing Application (T1190) - Web applications, services
• External Remote Services (T1133) - VPN, RDP, SSH
• Supply Chain Compromise (T1195) - Software supply chain attacks
• Trusted Relationship (T1199) - Partner, vendor access

AlertKick Detection Methods

Network Monitoring

# eBPF security rule for suspicious external connections
- rule: Suspicious External Connection
  desc: Detect connections to suspicious external IPs
  condition: >
    outbound and
    (fd.sport in (80, 443, 8080, 8443)) and
    not fd.sip in (trusted_networks)
  output: >
    Suspicious external connection detected
    (user=%user.name command=%proc.cmdline connection=%fd.name)

File System Monitoring

# eBPF security rule for suspicious file downloads
- rule: Suspicious File Download
  desc: Detect downloads of suspicious file types
  condition: >
    open_write and
    (fd.name contains ".exe" or fd.name contains ".scr" or fd.name contains ".bat")
  output: >
    Suspicious file download detected
    (user=%user.name file=%fd.name)

Recommended Mitigations

• Network segmentation and access controls
• Email security solutions and user training
• Application security testing and hardening
• Supply chain security assessments

Tactic 2: Execution (TA0002)

Description

Execution consists of techniques that result in adversary-controlled code running on a local or remote system.

Key Techniques

• Command and Scripting Interpreter (T1059) - PowerShell, bash, cmd
• Scheduled Task/Job (T1053) - Cron jobs, scheduled tasks
• System Services (T1569) - Service installation and execution
• Windows Management Instrumentation (T1047) - WMI commands

AlertKick Detection Methods

Process Monitoring

# eBPF security rule for suspicious process execution
- rule: Suspicious Process Execution
  desc: Detect execution of suspicious processes
  condition: >
    proc.name in (suspicious_processes) or
    (proc.cmdline contains "powershell" and proc.cmdline contains "-enc") or
    (proc.cmdline contains "cmd" and proc.cmdline contains "/c")
  output: >
    Suspicious process execution detected
    (user=%user.name process=%proc.name command=%proc.cmdline)

Scheduled Task Monitoring

# eBPF security rule for suspicious scheduled tasks
- rule: Suspicious Scheduled Task
  desc: Detect creation of suspicious scheduled tasks
  condition: >
    (proc.name = "schtasks" or proc.name = "at") and
    (proc.cmdline contains "create" or proc.cmdline contains "add")
  output: >
    Suspicious scheduled task creation
    (user=%user.name command=%proc.cmdline)

Recommended Mitigations

• Application whitelisting and execution controls
• Script execution policies and restrictions
• User training on social engineering
• System hardening and configuration management

Tactic 3: Persistence (TA0003)

Description

Persistence consists of techniques that adversaries use to maintain access to systems across restarts, changed credentials, and other interruptions.

Key Techniques

• Boot or Logon Autostart Execution (T1547) - Registry, startup folders
• Scheduled Task/Job (T1053) - Cron jobs, scheduled tasks
• Create or Modify System Process (T1543) - Service installation
• Event Triggered Execution (T1546) - WMI, event subscriptions

AlertKick Detection Methods

Registry Monitoring

# eBPF security rule for suspicious registry modifications
- rule: Suspicious Registry Modification
  desc: Detect modifications to startup registry keys
  condition: >
    (reg.key contains "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" or
     reg.key contains "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run") and
    (reg.type = "set" or reg.type = "create")
  output: >
    Suspicious registry modification detected
    (user=%user.name key=%reg.key value=%reg.value)

Service Monitoring

# eBPF security rule for suspicious service creation
- rule: Suspicious Service Creation
  desc: Detect creation of suspicious services
  condition: >
    (proc.name = "sc" or proc.name = "net") and
    (proc.cmdline contains "create" or proc.cmdline contains "start")
  output: >
    Suspicious service creation detected
    (user=%user.name command=%proc.cmdline)

Recommended Mitigations

• System hardening and configuration management
• User account management and monitoring
• Service monitoring and whitelisting
• Regular security assessments

Tactic 4: Privilege Escalation (TA0004)

Description

Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network.

Key Techniques

• Exploitation for Privilege Escalation (T1068) - Kernel exploits, service exploits
• Access Token Manipulation (T1134) - Token theft, impersonation
• Abuse Elevation Control Mechanism (T1548) - UAC bypass, sudo abuse
• Process Injection (T1055) - DLL injection, process hollowing

AlertKick Detection Methods

Process Monitoring

# eBPF security rule for privilege escalation attempts
- rule: Privilege Escalation Attempt
  desc: Detect attempts to escalate privileges
  condition: >
    (proc.name = "sudo" or proc.name = "su" or proc.name = "runas") and
    (proc.cmdline contains "root" or proc.cmdline contains "administrator")
  output: >
    Privilege escalation attempt detected
    (user=%user.name command=%proc.cmdline)

System Call Monitoring

# eBPF security rule for suspicious system calls
- rule: Suspicious System Call
  desc: Detect suspicious system calls that may indicate privilege escalation
  condition: >
    (syscall.name = "setuid" or syscall.name = "setgid" or syscall.name = "setreuid")
  output: >
    Suspicious system call detected
    (user=%user.name syscall=%syscall.name)

Recommended Mitigations

• Regular patching and vulnerability management
• User account controls and monitoring
• System hardening and configuration management
• Privilege management and least privilege principles

Tactic 5: Defense Evasion (TA0005)

Description

Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise.

Key Techniques

• Impair Defenses (T1562) - Disable security tools, logging
• Indirect Command Execution (T1202) - Scripts, encoded commands
• Masquerading (T1036) - File, process, service masquerading
• Obfuscated Files or Information (T1027) - Encoding, encryption

AlertKick Detection Methods

Security Tool Monitoring

# eBPF security rule for security tool tampering
- rule: Security Tool Tampering
  desc: Detect attempts to disable or tamper with security tools
  condition: >
    (proc.name in (security_tools) and proc.cmdline contains "stop") or
    (proc.name in (security_tools) and proc.cmdline contains "disable")
  output: >
    Security tool tampering detected
    (user=%user.name tool=%proc.name command=%proc.cmdline)

Log Monitoring

# eBPF security rule for log tampering
- rule: Log Tampering
  desc: Detect attempts to tamper with log files
  condition: >
    (fd.name contains "/var/log" or fd.name contains "/var/audit") and
    (proc.cmdline contains "rm" or proc.cmdline contains "truncate")
  output: >
    Log tampering detected
    (user=%user.name file=%fd.name command=%proc.cmdline)

Recommended Mitigations

• Security tool protection and monitoring
• Log integrity monitoring and protection
• System hardening and configuration management
• User training on security awareness

Tactic 6: Credential Access (TA0006)

Description

Credential Access consists of techniques for stealing credentials like account names and passwords.

Key Techniques

• Brute Force (T1110) - Password spraying, credential stuffing
• Credentials from Password Stores (T1555) - Keychain, credential manager
• Credentials from Web Browsers (T1555) - Browser password stores
• Network Sniffing (T1040) - Network traffic interception

AlertKick Detection Methods

Authentication Monitoring

# eBPF security rule for brute force attacks
- rule: Brute Force Attack
  desc: Detect multiple failed authentication attempts
  condition: >
    (proc.name = "ssh" or proc.name = "su" or proc.name = "login") and
    (proc.cmdline contains "failed" or proc.cmdline contains "denied")
  output: >
    Brute force attack detected
    (user=%user.name attempts=%proc.cmdline)

Network Monitoring

# eBPF security rule for credential theft
- rule: Credential Theft
  desc: Detect attempts to steal credentials
  condition: >
    (proc.name = "keychain" or proc.name = "credential") and
    (proc.cmdline contains "dump" or proc.cmdline contains "extract")
  output: >
    Credential theft attempt detected
    (user=%user.name command=%proc.cmdline)

Recommended Mitigations

• Multi-factor authentication implementation
• Password policy enforcement and monitoring
• Credential management and protection
• Network monitoring and segmentation

Tactic 7: Discovery (TA0007)

Description

Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network.

Key Techniques

• System Information Discovery (T1082) - System enumeration, configuration
• Network Service Scanning (T1046) - Port scanning, service enumeration
• System Network Configuration Discovery (T1016) - Network configuration, routing
• Process Discovery (T1057) - Process enumeration, task listing

AlertKick Detection Methods

System Enumeration Monitoring

# eBPF security rule for system enumeration
- rule: System Enumeration
  desc: Detect system enumeration activities
  condition: >
    (proc.name = "whoami" or proc.name = "id" or proc.name = "uname") or
    (proc.name = "ps" or proc.name = "top" or proc.name = "htop")
  output: >
    System enumeration detected
    (user=%user.name command=%proc.cmdline)

Network Scanning Monitoring

# eBPF security rule for network scanning
- rule: Network Scanning
  desc: Detect network scanning activities
  condition: >
    (proc.name = "nmap" or proc.name = "netstat" or proc.name = "ss") or
    (proc.name = "ping" or proc.name = "traceroute")
  output: >
    Network scanning detected
    (user=%user.name command=%proc.cmdline)

Recommended Mitigations

• Network segmentation and access controls
• System hardening and configuration management
• User monitoring and behavior analysis
• Security awareness training

Tactic 8: Lateral Movement (TA0008)

Description

Lateral Movement consists of techniques that adversaries use to enter and control remote systems on a network.

Key Techniques

• Remote Services (T1021) - RDP, SSH, VNC
• Pass the Hash (T1550) - NTLM hash reuse
• Pass the Ticket (T1550) - Kerberos ticket reuse
• Remote System Discovery (T1018) - Network discovery, host enumeration

AlertKick Detection Methods

Remote Access Monitoring

# eBPF security rule for lateral movement
- rule: Lateral Movement
  desc: Detect lateral movement activities
  condition: >
    (proc.name = "ssh" or proc.name = "rdesktop" or proc.name = "vncviewer") or
    (proc.name = "psexec" or proc.name = "wmic")
  output: >
    Lateral movement detected
    (user=%user.name command=%proc.cmdline)

Network Traffic Monitoring

# eBPF security rule for suspicious network connections
- rule: Suspicious Network Connection
  desc: Detect suspicious network connections
  condition: >
    (fd.sport in (22, 3389, 5900)) and
    (not fd.sip in (trusted_networks))
  output: >
    Suspicious network connection detected
    (user=%user.name connection=%fd.name)

Recommended Mitigations

• Network segmentation and access controls
• Multi-factor authentication for remote access
• Privilege management and least privilege
• Network monitoring and traffic analysis

Tactic 9: Collection (TA0009)

Description

Collection consists of techniques adversaries may use to gather information and the sources information is collected from.

Key Techniques

• Data from Local System (T1005) - File system, registry
• Data from Network Shared Drive (T1039) - Network shares, file servers
• Data from Information Repositories (T1213) - Databases, knowledge bases
• Screen Capture (T1113) - Screenshot tools, screen recording

AlertKick Detection Methods

Data Access Monitoring

# eBPF security rule for data collection
- rule: Data Collection
  desc: Detect data collection activities
  condition: >
    (proc.name = "find" or proc.name = "grep" or proc.name = "search") or
    (proc.name = "copy" or proc.name = "cp" or proc.name = "robocopy")
  output: >
    Data collection detected
    (user=%user.name command=%proc.cmdline)

File System Monitoring

# eBPF security rule for suspicious file access
- rule: Suspicious File Access
  desc: Detect access to sensitive files
  condition: >
    (fd.name contains "/etc/passwd" or fd.name contains "/etc/shadow") or
    (fd.name contains "config" or fd.name contains "secret")
  output: >
    Suspicious file access detected
    (user=%user.name file=%fd.name)

Recommended Mitigations

• Data classification and access controls
• File system monitoring and protection
• User behavior analysis and monitoring
• Data loss prevention solutions

Tactic 10: Command and Control (TA0011)

Description

Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a network.

Key Techniques

• Application Layer Protocol (T1071) - HTTP, HTTPS, DNS
• Web Service (T1102) - OneDrive, Dropbox, GitHub
• Remote Access Software (T1219) - TeamViewer, VNC, RDP
• Proxy (T1090) - Internal proxy, external proxy

AlertKick Detection Methods

Network Protocol Monitoring

# eBPF security rule for command and control
- rule: Command and Control
  desc: Detect command and control communications
  condition: >
    (fd.sport in (80, 443, 53)) and
    (not fd.sip in (trusted_networks)) and
    (proc.cmdline contains "curl" or proc.cmdline contains "wget")
  output: >
    Command and control detected
    (user=%user.name connection=%fd.name)

DNS Monitoring

# eBPF security rule for DNS tunneling
- rule: DNS Tunneling
  desc: Detect potential DNS tunneling
  condition: >
    (proc.name = "nslookup" or proc.name = "dig") and
    (proc.cmdline contains "suspicious_domain")
  output: >
    DNS tunneling detected
    (user=%user.name domain=%proc.cmdline)

Recommended Mitigations

• Network monitoring and traffic analysis
• DNS filtering and monitoring
• Proxy controls and monitoring
• Network segmentation and access controls

Tactic 11: Exfiltration (TA0010)

Description

Exfiltration consists of techniques that adversaries may use to steal data from your network.

Key Techniques

• Automated Exfiltration (T1020) - Scheduled data theft
• Data Transfer Size Limits (T1030) - Small data transfers
• Exfiltration Over Alternative Protocol (T1048) - DNS, ICMP
• Exfiltration Over Physical Medium (T1052) - USB, removable media

AlertKick Detection Methods

Data Transfer Monitoring

# eBPF security rule for data exfiltration
- rule: Data Exfiltration
  desc: Detect potential data exfiltration
  condition: >
    (proc.name = "scp" or proc.name = "rsync" or proc.name = "ftp") and
    (proc.cmdline contains "large_file" or proc.cmdline contains "sensitive_data")
  output: >
    Data exfiltration detected
    (user=%user.name command=%proc.cmdline)

Network Traffic Monitoring

# eBPF security rule for suspicious data transfer
- rule: Suspicious Data Transfer
  desc: Detect suspicious data transfers
  condition: >
    (fd.sport in (21, 22, 80, 443)) and
    (not fd.sip in (trusted_networks)) and
    (proc.cmdline contains "upload" or proc.cmdline contains "send")
  output: >
    Suspicious data transfer detected
    (user=%user.name connection=%fd.name)

Recommended Mitigations

• Data loss prevention solutions
• Network monitoring and traffic analysis
• User behavior analysis and monitoring
• Data classification and access controls

Tactic 12: Impact (TA0040)

Description

Impact consists of techniques that adversaries use to disrupt availability or compromise integrity by manipulating business and operational processes.

Key Techniques

• Data Destruction (T1485) - File deletion, disk wiping
• Data Encrypted for Impact (T1486) - Ransomware, disk encryption
• Service Stop (T1489) - Service termination, system shutdown
• System Shutdown/Reboot (T1529) - System restart, shutdown

AlertKick Detection Methods

System Impact Monitoring

# eBPF security rule for system impact
- rule: System Impact
  desc: Detect system impact activities
  condition: >
    (proc.name = "shutdown" or proc.name = "reboot" or proc.name = "halt") or
    (proc.name = "rm" or proc.name = "del" or proc.name = "format")
  output: >
    System impact detected
    (user=%user.name command=%proc.cmdline)

Service Monitoring

# eBPF security rule for service manipulation
- rule: Service Manipulation
  desc: Detect service manipulation activities
  condition: >
    (proc.name = "systemctl" or proc.name = "service") and
    (proc.cmdline contains "stop" or proc.cmdline contains "disable")
  output: >
    Service manipulation detected
    (user=%user.name command=%proc.cmdline)

Recommended Mitigations

• Backup and recovery procedures
• System monitoring and alerting
• User access controls and monitoring
• Incident response procedures

Next Steps

• MITRE Techniques - Detailed technique analysis
• MITRE Mitigations - Security control implementation
• Security Monitoring Setup - Configure AlertKick for MITRE detection