2

My question is on Cyber Threat Intelligence (CTI). I want to know the difference between Attack Patterns (as in MITRE CAPEC) and Tactics, Techniques and Procedures (as in MITRE ATT&CK). They both seem to describe the behaviour and modus operandi of the adversary, so what is the difference really?

What is the difference between Tactics, Techniques and Procedures in the first place? I have heard that techniques and tactics don't belong to the same Threat Intelligence type. Technical CTI is at the same level as indicators of compromise (IoC) for example, whereas Tactical CTI refer to an higher analysis level, the "attack phase" (whatever it means). But then why do we only see "techniques" on MITRE ATT&CK webpage? Why is it called Tactics, Techniques and Procedures if there are only Techniques? And what are Procedures?

JacopoStanchi
  • 123
  • 3

1 Answers1

1

MITRE actually maintains a page describing the differences between the two and another page defining "tactics", "techniques", and "procedures". The rest of this answer is a series of direct quotes from the first page since this appears to be the primary focus of your question. I've avoided putting it all in block quotes to make it more readable with our formatting options.

CAPEC is focused on application security and describes the common attributes and techniques employed by adversaries to exploit known weaknesses in cyber-enabled capabilities. (e.g., SQL Injection, XSS, Session Fixation, Clickjacking)

  • Focus on application security
  • Enumerates exploits against vulnerable systems
  • Includes social engineering / supply chain
  • Associated with Common Weakness Enumeration (CWE)

ATT&CK is focused on network defense and describes the operational phases in an adversary’s lifecycle, pre and post-exploit (e.g., Persistence, Lateral Movement, Exfiltration), and details the specific tactics, techniques, and procedures (TTPs) that advanced persistent threats (APT) use to execute their objectives while targeting, compromising, and operating inside a network.

  • Focus on network defense
  • Based on threat intelligence and red team research
  • Provides contextual understanding of malicious behavior
  • Supports testing and analysis of defense options

How they are related ...

Many attack patterns enumerated by CAPEC are employed by adversaries through specific techniques described by ATT&CK. This enables contextual understanding of the attack patterns within an adversary’s operational lifecycle. CAPEC attack patterns and related ATT&CK techniques are cross referenced when appropriate between the two efforts.

Use CAPEC for:

  • Application threat modeling
  • Developer training and education
  • Penetration testing

Use ATT&CK for:

  • Comparing computer network defense capabilities
  • Defending against the Advanced Persistent Threat
  • Hunting for new threats
  • Enhancing threat intelligence
  • Adversary emulation exercises
Wrycu
  • 420
  • 4
  • 7
  • So could we say that CAPEC's attack patterns are like ATT&CK's procedures, as a procedure is the particular implementation of a given technique? As I'm writing this, I saw that the technique Exploit Public-Facing Application (https://attack.mitre.org/techniques/T1190) has procedures on SQL injections, which is an attack pattern (https://capec.mitre.org/data/definitions/66.html). – JacopoStanchi Nov 15 '20 at 21:46