MITRE ATT&CK

The MITRE ATT&CK framework categorizes known attack techniques into 14 tactics and hundreds of techniques/sub-techniques.

MITRE developed the ATLAS framework, which systematically categorizes attack techniques facing AI systems into phases such as reconnaissance, resource development, initial access, execution, and persistence, similar to the ATT&CK matrix.

The MITRE ATT&CK framework lists lateral movement as an independent tactic category

MITRE ATT&CK systematically categorizes known attack techniques, providing defenders with an encyclopedia of attacker behavior.

The MITRE ATT&CK framework lists lateral movement as a distinct tactic category, documenting dozens of specific techniques including Pass-the-Hash and Kerberoasting.

ATT&CK extraction is essentially an entity linking task that aligns unstructured text to a controlled ontology.

ARBITRA is a new framework that achieves robust document-level ATT&CK extraction through multi-expert argumentation.

Existing sentence-level pipeline methods decompose reports into sentences and extract entities sentence by sentence, sacrificing the document's global context and causing cross-sentence relational information to be lost.

On the ATT&CK extraction benchmark, ARBITRA achieves a stronger precision-oriented operating point than sentence-level pipelines, recent LLM-based extraction systems, and frontier models including GPT-5.5.

Forensic and retrospective outputs worth attention after an incident disclosure for financial institutions include the initial access vector, traces of AI-generated phishing or social engineering, whether detection rules failed, and technique mapping under the MITRE ATT&CK framework.

An academic benchmark specifically for testing agentic AI coding editors used 314 different attack payloads mapped to 70 MITRE ATT&CK techniques and found that these editors can be reliably hijacked to execute unauthorized terminal commands.

The MITRE ATT&CK framework added classification entries for AI-assisted attack techniques in recent updates.

T1053 in MITRE ATT&CK represents the scheduled task/job abuse technique.

MITRE ATT&CK is a knowledge base of adversary tactics and techniques maintained by MITRE Corporation, categorized and numbered along two dimensions of tactical objectives and technical methods, currently covering hundreds of technique entries.

Lateral movement refers to the technique by which an attacker, after gaining control of an internal host or account, uses that foothold to expand access within the internal network; common techniques include Pass-the-Hash, Pass-the-Ticket, RDP, WMI, and PSExec, and the MITRE ATT&CK framework lists lateral movement as one of the key stages of the attack chain.

In the MITRE ATT&CK framework, C2 communication is classified as the 11th phase of the attack chain.

威胁情报共享实践包括STIX/TAXII标准和MITRE ATT&CK框架下的协作