# MITRE ATT&CK Framework Overview for Malware Analysis

## What is ATT&CK?

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a knowledge base of adversary behaviors based on real-world observations. It provides a common vocabulary for describing what malware does.

## Enterprise Matrix Tactics (14)

| # | Tactic | Description | Key for Malware Analysis |
|---|--------|-------------|-------------------------|
| 1 | Reconnaissance | Gathering target information | Rarely observed in malware binary |
| 2 | Resource Development | Establishing infrastructure | C2 setup, tool acquisition |
| 3 | Initial Access | Getting into the network | Phishing, exploits, supply chain |
| 4 | Execution | Running malicious code | Scripts, macros, exploits |
| 5 | Persistence | Maintaining access | Registry, services, boot |
| 6 | Privilege Escalation | Getting higher permissions | Exploits, token manipulation |
| 7 | Defense Evasion | Avoiding detection | Obfuscation, injection, rootkits |
| 8 | Credential Access | Stealing credentials | Dumping, keylogging |
| 9 | Discovery | Learning about the environment | System, network enumeration |
| 10 | Lateral Movement | Moving through the network | RDP, SMB, WMI |
| 11 | Collection | Gathering target data | Screenshots, keylogging |
| 12 | Command and Control | Communicating with C2 | HTTP, DNS, custom protocols |
| 13 | Exfiltration | Stealing data | C2 channel, alternative protocols |
| 14 | Impact | Disruption/destruction | Ransomware, wiping |

## Most Common Techniques in Malware

Based on prevalence in analyzed malware families:

1. **T1055 Process Injection** — Most prevalent defense evasion technique
2. **T1059 Command and Scripting Interpreter** — PowerShell, cmd, VBA
3. **T1547 Boot or Logon Autostart Execution** — Registry Run keys
4. **T1071 Application Layer Protocol** — HTTP/HTTPS C2
5. **T1027 Obfuscated Files or Information** — Packing, encoding
6. **T1566 Phishing** — Primary delivery mechanism
7. **T1105 Ingress Tool Transfer** — Download additional payloads
8. **T1486 Data Encrypted for Impact** — Ransomware

## How to Map Malware to ATT&CK

1. **Observe** behaviors during analysis (static, dynamic, behavioral)
2. **Identify** the tactic category (what objective does the behavior serve?)
3. **Map** to the specific technique (how is the objective achieved?)
4. **Document** the evidence supporting each mapping
5. **Assess** confidence level for each mapping

## Using ATT&CK for Detection

Each technique includes:
- **Data Sources**: What telemetry reveals the technique
- **Detection**: How to identify the technique in action
- **Mitigations**: How to prevent or limit the technique

## Tools

- [ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/) — Visualize technique coverage
- [capa](https://github.com/mandiant/capa) — Auto-map binary capabilities to ATT&CK
- [attack_mapper.py](../scripts/attack_mapper.py) — Map behaviors to techniques