ATT&CK But Better
A proof of concept for a more opinionated approach to adversary technique modelling, grounded in the D3FEND ontology and designed to yield detection and mitigation ratings that are derivable from the technique definition rather than assigned heuristically.
Key ideas
Ontological definitions
Every technique is defined as an action on a D3FEND artifact class. If you cannot define the artifact being acted on, the technique is not well-formed.
Medium as a dimension
The channel an attacker uses (PowerShell, HTTP, SMB) is an Execution Medium, not a sub-technique. Execution Medium–scoped detection rules have a hard STP 3 ceiling.
Environment-dependent entities
Some technique targets are organisation-specific. Orgs instantiate
their own sub-techniques (e.g. T1213.github) rather than
relying on MITRE to enumerate all platforms.
Derived STP ratings
Detection and mitigation robustness ratings are derivable from the ontological definition. Invariant fields yield STP 5 rules; attacker-controlled fields yield STP 1–2; Execution Medium–scoped rules have a hard STP 3 ceiling.
Techniques
View all →T1078 Valid Accounts fails the criteria for a technique.
T1059 The sub-techniques of T1059 (PowerShell, Bash, Python, VBScript, etc.
T1055 Write attacker-controlled executable code into the address space of a running process not owned by the attacker.
T1055.001 Write a DLL or shellcode into a target process's address space and execute it by spawning a remote thread via CreateRemoteThread.
T1055.004 Write shellcode into a target process's address space and execute it by queueing an Asynchronous Procedure Call to an alertable thread via QueueUserAPC.
T1055.012 Create a new process in suspended state, unmap its legitimate image via NtUnmapViewOfSection, write attacker code into the vacated address space, and resume execution.
T1213 Read attacker-relevant data from an organisational information repository not intended for the attacker's use.
T1003.001 Read credential material from the memory segment of the Local Security Authority Subsystem Service (LSASS) process.
T1547.001 Create or modify a Windows registry autostart key to cause attacker-controlled code to execute at boot or logon.
T1098 Modify properties of an existing user account to maintain access or escalate privilege.
T1053 Create a scheduled job entry that causes attacker-controlled code to execute at a specified time or interval.
T1105 Transfer an attacker-controlled file from an external source to a target system under attacker control.
T1553.002 Execute a file carrying a cryptographically valid digital signature produced with a stolen, fraudulently issued, or otherwise illegitimately obtained code-signing certificate, so that operating system and security controls trust it as though it came from the certificate's legitimate owner.
T1071 Transmit command-and-control communications over a standard application layer protocol to blend with legitimate traffic.
T1190 Exploit a vulnerability in a public-facing application to cause it to execute attacker-controlled code or expose data beyond its intended scope.
T1548.002 Invoke a Windows elevation mechanism through a method that bypasses User Account Control consent prompts to gain elevated privilege without user interaction.