How to Operationalize MITRE ATT&CK in Cyber Threat Intelligence
Summary
Scott Small of Tidal Cyber recommends using MITRE ATT&CK to prioritize pre-attack defenses, map techniques to vulnerabilities, and identify stolen credentials for targeted resets. He says AI can structure CTI data and accelerate known attack techniques.
Key points
- Scott Small describes MITRE ATT&CK as a shared reference for making sense of growing volumes of threat intelligence.
- He recommends focusing on pre-attack techniques so defenders can block attacks before an adversary reaches the network.
- Threat intelligence can help identify stolen credentials for targeted resets and blocking attacker access.
- Mapping TTPs to vulnerabilities can help teams deprioritize vulnerabilities where effective defenses or coverage are already in place.
- Small says Tidal Cyber tracks nearly 25,000 procedure-level instances mapped to MITRE ATT&CK, including commands, processes, and network ports or protocols.
- Small says adversaries use AI to accelerate known techniques, such as writing phishing emails or PowerShell scripts, rather than to create novel TTPs.
- He sees AI and LLMs as useful for extracting structured technique data from unstructured reports, but not for producing finished intelligence or reports.
Article Details
- Topic
- Operationalizing MITRE ATT&CK in cyber threat intelligence, including role collaboration and the use of AI.