MITRE ATT&CK Framework: How Modern SOCs Detect Attacker Behavior

What is the MITRE ATT&CK Framework?

Most organizations invest heavily in security controls, monitoring platforms, and defensive frameworks. Yet, a fundamental question often receives far less attention: What does an attack actually look like from the adversary’s perspective? ATT&CK was designed to answer that question.

The MITRE ATT&CK framework is a structured knowledge base that documents how real-world adversaries conduct cyber intrusions. Developed by MITRE in 2013, ATT&CK organizes observed attacker behaviors across three domains: Enterprise, Mobile, and Industrial Control System (ICS) environments.

Unlike traditional security approaches that focus on indicators of compromise (IOCs) or malware signatures, ATT&CK focuses on adversary behavior. The framework maps the tactics and techniques attackers use throughout an intrusion, helping defenders understand how threats gain access, establish persistence, escalate privileges, evade detection, move laterally, and access sensitive data.

For Security Operations Centers (SOCs), ATT&CK provides a common reference model for detection engineering, threat hunting, incident response, and security validation. Continuously updated through threat intelligence and real-world intrusion analysis, ATT&CK has become a widely adopted reference for modern security programs.

Understanding Tactics, Techniques, and Procedures

The MITRE ATT&CK framework is built around tactics, techniques, and procedures (TTPs), which describe how adversaries achieve their objectives during an intrusion.

• Tactics represent the attacker’s objective at a specific stage of an attack, such as Initial Access, Persistence, Privilege Escalation, Defense Evasion, or Exfiltration.
• Techniques describe the method used to achieve that objective. For example, phishing is mapped to a technique categorized under technique ID T1566, while credential dumping is mapped to T1003.
• Procedures refer to the specific implementation of a technique by a threat actor. These can vary based on the threat actor, malware family, target environment, and campaign objectives.

Example of a TTP: An attacker achieves Initial Access through the Spearphishing Attachment technique (T1566.001) by sending a weaponized Microsoft Word document that deploys a Cobalt Strike beacon on an employee workstation.

Understanding the relationship between tactics, techniques, and procedures helps SOC analysts move beyond individual alerts and evaluate attacker activity within the broader context of an intrusion.

What ATT&CK means for the Security Team

Traditional security programs often start with tools and controls, asking questions such as “What can we detect?” or “What can we block?” ATT&CK approaches the problem differently. Instead of starting with security technologies, it starts with adversary behavior and asks, “Can we detect this technique if it occurs in our environment?”

The ATT&CK Enterprise Matrix is organized into 14 tactics that represent an attacker’s objectives during various stages of an intrusion, from Reconnaissance and Initial Access to Exfiltration and Impact. Under each tactic are the techniques and sub-techniques adversaries use to achieve those objectives, creating a structured view of how real-world attacks unfold.

Importantly, ATT&CK is a descriptive framework rather than prescriptive. It does not tell organizations how to defend themselves. Instead, it documents the techniques attackers use, providing SOC teams with a common reference for understanding and tracking adversary behavior.

Applying MITRE ATT&CK in SOC Operations

1. Detection Engineering

One of the most practical ways in which SOC teams use ATT&CK is in detection engineering. Every SIEM correlation rule, EDR analytic, or behavioral alert should ideally indicate at least one ATT&CK technique. If a detection cannot be linked to an identifiable adversary behavior, it is worth questioning whether the alert provides meaningful security value or simply adds noise.

For example:

• PowerShell abuse detections may map to T1059.001 (PowerShell)
• Credential dumping alerts may map to T1003 (OS Credential Dumping)
• Suspicious remote service creation may map to T1021 (Remote Services)

This changes how detections are organized within the SOC. Instead of measuring visibility by a tool or log source, teams can assess coverage against known attacker techniques and identify areas where detection capabilities need improvement.

Mature detection engineering programs go beyond simply creating ATT&CK-aligned alerts. Detections require ongoing tuning, validation, and refinement to reduce false positives while maintaining visibility into attacker behavior. ATT&CK provides a consistent framework for organizing use cases, identifying detection gaps, and prioritizing new analytics based on techniques most relevant to the organization’s threat landscape.

2. Incident Response

During active incidents, ATT&CK helps responders look beyond the immediate alert. By mapping observed activity to known ATT&CK techniques, analysts can better understand the attacker’s objectives and anticipate likely next steps.

For example, if responders identify T1078 (Valid Accounts), T1021 (Remote Services), or T1055 (Process Injection), the SOC may reasonably expect lateral movement, privilege escalation, or credential theft activity to follow.

This enables proactive containment rather than reactive investigation. Instead of isolating a single host and waiting for additional alerts, responders can review authentication activity, hunt for related compromise, and increase monitoring of critical systems. This becomes particularly important during ransomware investigations, where delays in containment can significantly increase operational impact. ATT&CK also provides a consistent way to document attacker activity during and after an incident.

3. SOAR and Automation

ATT&CK also improves SOC automation and orchestration workflows. Modern SOAR platforms can map automated response actions directly to ATT&CK techniques, allowing playbooks to align with attacker behavior.

For example, a detection mapped to T1078 (Valid Accounts) may automatically trigger actions such as:

• Forcing MFA re-authentication
• Invalidating active user sessions
• Flagging the account for analyst review

By linking automation to known adversary techniques, organizations can reduce analyst workload, improve response consistency, and accelerate investigations during high-volume incidents. At Anzen, ATT&CK-aligned automation is integrated into SOC workflows to help analysts respond faster, streamline investigations, and improve overall operational efficiency.

4. Purple Teaming

ATT&CK provides red and blue teams with a common framework for testing security controls against realistic attacker behavior. Rather than conducting broad attack simulations, teams can emulate specific ATT&CK techniques and evaluate how effectively the SOC identifies, analyzes, and handles them.

For example, a purple team exercise may simulate:

• PowerShell abuse through T1059.001
• Credential dumping using T1003
• Lateral movement via T1021

As the red team executes these techniques, the blue team can verify whether the required telemetry is being collected, alerts are generated as expected, escalation procedures are followed correctly, and response playbooks perform as intended.

Validating ATT&CK Coverage

By mapping detections, investigations, and response playbooks to ATT&CK techniques, SOC leaders can assess which attacker behaviors are fully covered, partially covered, or unsupported. Tools such as ATT&CK Navigator are frequently used to visualize this coverage and identify areas where additional detection engineering or telemetry may be required.

Coverage should also be validated regularly. A technique being mapped to an SIEM rule does not necessarily mean it can be reliably detected during a real attack. Many mature SOCs use purple team exercises and adversary emulation to test high-priority techniques such as T1059, T1003, and T1078, helping measure detection effectiveness and track improvements over time.

Most Observed ATT&CK Techniques (2025-2026)

While ATT&CK contains hundreds of techniques and sub-techniques, not all are observed with the same frequency. Threat actors consistently rely on a relatively small set of techniques.

For security teams, the takeaway is straightforward. Effective cyber defense is not achieved by attempting to address every technique in the ATT&CK matrix at once. Instead, organizations should prioritize the behaviors most observed in intrusions and build maturity from there.

The techniques mentioned in the image above are based on attacker behaviors and trends consistently highlighted across threat detection reports, threat hunting observations, and breach investigation reports published during 2025-2026.

Key Threat Trends (2025–2026)

• Identity attacks continue to grow. Attackers increasingly rely on stolen credentials, session tokens, and valid accounts instead of malware, allowing them to blend into legitimate user activity and evade traditional security controls.
• Exploitation has overtaken phishing as the leading breach vector. Vulnerable internet-facing applications, VPN appliances, and exposed services are increasingly being targeted for initial access, making patch management and attack surface monitoring critical.
• Data theft is becoming more valuable than encryption. Many ransomware groups now prioritize data exfiltration and extortion over file encryption, creating greater demand for cloud visibility, identity monitoring, and data access controls.
• Cloud and hybrid environments remain primary targets. Misconfigured cloud services, third-party integrations, and identity platforms continue to create opportunities for attackers to establish and expand access.
• Persistence and Defense Evasion are receiving greater focus. Adversaries are spending more time maintaining access and avoiding detection through techniques such as token abuse, remote management tools, scheduled tasks, and account manipulation.

ATT&CK Technique Deep Dive

MITRE ATT&CK Technique	ATT&CK ID	Primary Tactic	Relative Frequency Index
Command and Scripting Interpreter	T1059	Execution	100
Valid Accounts	T1078	Initial Access / Persistence / Privilege Escalation / Defense Evasion	90
Exploit Public facing Application	T1190	Initial Access	82
OS Credential Dumping	T1003	Credential Access	68
Process Injection	T1055	Defense Evasion / Privilege Escalation	58
Ingress Tool Transfer	T1105	Command and Control	50
Data from Cloud Storage	T1530	Collection	36
Data Encrypted for Impact	T1486	Impact	28

The techniques listed provide a high-level view of attacker behaviors across enterprise environments. However, understanding ATT&CK requires looking beyond technique names and IDs. To show how ATT&CK supports detection, investigation, and response activities in practice, the example below breaks down one of the most observed techniques in modern SOC investigations.

Execution: Command and Scripting Interpreter (T1059)

Command and Scripting Interpreter (T1059) is one of the most widely used ATT&CK techniques because it enables attackers to execute commands directly on a compromised system using tools that already exist within the operating environment. Rather than deploying custom malware immediately, adversaries can leverage trusted scripting engines such as PowerShell, Command Prompt, Bash, Python, and JavaScript to perform actions that would otherwise require dedicated tooling.

T1059 often serves as the bridge between initial access and a post-compromise activity. Once access has been established, attackers use scripting interpreters to download payloads, execute malware, enumerate users and systems, modify security settings, establish persistence, access credentials, and automate lateral movement. As a result, T1059 frequently appears alongside techniques spanning Discovery, Credential Access, Persistence, Defense Evasion, and Lateral Movement.

Common sub-techniques include PowerShell (T1059.001), Windows Command Shell (T1059.003), Unix Shell (T1059.004), Python (T1059.006), and JavaScript (T1059.007). While each operates differently, they all provide attackers with a flexible method of interacting with compromised systems while blending into legitimate administrative activity. This combination of versatility, widespread availability, and legitimate business use makes T1059 one of the most challenging ATT&CK techniques for SOC teams to detect and investigate effectively.

Common Evasion Techniques

Attackers, instead of executing scripts in their simplest form, employ multiple evasion techniques designed to bypass detection and complicate analysis.

Common examples include:

• Base64-encoded PowerShell commands using the -enc parameter
• Obfuscated variables and string manipulation
• In-memory execution to avoid writing files to disk
• Anti-malware Scan Interface (AMSI) bypass techniques
• Use of trusted Windows binaries to launch scripts indirectly

These techniques can make malicious activities appear similar to legitimate administrative tasks, increasing the importance of behavioral detection.

Detection Opportunities

Effective detection requires visibility into both script execution and the surrounding process activity. Key telemetry sources include:

• PowerShell Script Block Logging (Event ID 4104)
• PowerShell Module Logging
• Sysmon Process Creation (Event ID 1)
• Sysmon Network Connections (Event ID 3)
• EDR process and command-line telemetry
• AMSI detections

Detection efforts should focus on identifying suspicious execution patterns. Indicators such as heavily obfuscated or encoded command lines, office applications spawning PowerShell or Command Prompt, PowerShell processes initiating outbound network connections, and scripting engines launched by unusual parent processes often warrant closer investigation. Security teams should also monitor for administrative tools that are being executed outside established baselines and attempts to disable logging or security controls.

Investigation Considerations

When investigating the T1059 activity, analysts should determine whether an interpreter was used for legitimate administration or malicious execution.

Key questions include:

• What process initiated the command interpreter?
• Which account executed the command?
• Was external content downloaded or executed?
• Were credentials accessed or exposed?
• Was persistence established following execution?
• Did the activity spread to additional systems?

Because command execution is often only one stage of an intrusion, investigators should examine preceding and subsequent ATT&CK techniques to understand the broader attack chain.

Response and Mitigation

When the T1059 activity is confirmed, the immediate priority is to contain execution before the attacker can establish persistence, escalate privileges, or move laterally. Response actions typically include isolating affected systems, terminating malicious processes through EDR controls, collecting relevant process and command-line artifacts, reviewing scheduled tasks and startup locations, and resetting potentially exposed credentials.

Investigation should not stop at the initial execution event but identify the full scope of activity because command and scripting interpreters are frequently used across multiple stages of an intrusion.

Following containment and remediation, organizations should review logging coverage, PowerShell security settings, endpoint visibility, and application control policies such as AppLocker or Windows Defender Application Control (WDAC). Additional controls, including PowerShell Constrained Language Mode and tighter privilege management, can further reduce opportunities for scripting abuse.

For many SOCs, T1059 serves as an early indicator of attacker activity. Strong visibility into command and scripting interpreters often provides an opportunity to detect and disrupt an intrusion before it progresses to credential theft, lateral movement, data exfiltration, or ransomware deployment.

Challenges in Implementing MITRE ATT&CK

Challenge 1: ATT&CK Coverage Does Not Equal Detection Coverage

Many organizations begin by mapping existing SIEM rules to ATT&CK techniques and assume they now have ATT&CK coverage.

However, technique mapping does not guarantee the ability to detect that behavior. A PowerShell detection mapped to T1059.001 may only trigger a handful of command-line patterns while missing encoded commands, AMSI bypasses, reflective loading, or obfuscated script execution creating a false sense of security where coverage metrics look strong despite limited visibility into real attacker activity.

Challenge 2: Required Telemetry Is Often Missing

Many ATT&CK techniques depend on telemetry that organizations do not collect or retain consistently.

For example:

• T1059.001 (PowerShell) benefits from Script Block Logging (Event ID 4104)
• T1003 (OS Credential Dumping) often requires Sysmon Process Access telemetry
• T1078 (Valid Accounts) depends heavily on identity provider logs
• T1098 (Account Manipulation) requires auditing of privilege changes, MFA enrollment, and OAuth grants

Without these data sources, the SOC lacks the evidence required to identify the activity.

Challenge 3: ATT&CK Techniques Are Not One-to-One Detections

A common misconception is that every ATT&CK technique can be detected with a single alert. In practice, techniques often require multiple analytics, telemetry sources, and correlation rules.

Credential dumping (T1003), for example, may require monitoring for:

• LSASS memory access
• Mimikatz execution patterns
• ProcDump abuse
• Suspicious handle requests
• EDR behavioral detections

Detecting the technique reliably requires combining multiple signals rather than relying on a single rule.

Challenge 4: ATT&CK Requires Analysts Who Understand Attack Chains

ATT&CK becomes significantly more valuable when analysts understand how techniques relate to one another. A detection for T1078 (Valid Accounts) may appear to be of low severity when viewed in isolation. However, when it is followed by T1021 (Remote Services), T1055 (Process Injection), and T1003 (Credential Dumping), it may indicate an active intrusion progressing through multiple attack stages.

The challenge is not simply detecting techniques. It is understanding how those techniques combine to reveal attacker intent.

Conclusion

The MITRE ATT&CK framework has become a foundational pillar of modern SOC programs. Instead of treating alerts as isolated signals, it enables security teams to correlate activity across systems, understand adversary intent, and investigate incidents with meaningful behavioral context.

At Anzen, ATT&CK is embedded across SOC operations, from detection engineering and threat hunting to incident response and automation, ensuring that analyst workflows remain consistent, structured, and aligned to real attacker behavior.

If your organization is looking to evaluate SOC maturity, validate detection coverage through ATT&CK-based purple teaming, or assess how effectively your telemetry and detection stack maps to real-world adversary techniques, Anzen can help identify coverage gaps and improve detection and response effectiveness across the kill chain.

Detection is only the beginning. Real security maturity depends on understanding how an intrusion unfolds, how adversaries navigate through environments, and how effectively that activity can be contained and eradicated. In the next blog, we will explore Digital Forensics and Incident Response (DFIR), and the investigative methods used to reconstruct attacks, assess impact, and drive effective containment decisions.

FAQ’s