Threat intelligence and MITRE ATT&CK

In short

Cyber threat intelligence (CTI) is evidence-based knowledge about adversaries - who they are, what they want, and how they operate - processed so that a defender can make a decision with it. MITRE ATT&CK is the public, curated knowledge base that catalogues adversary behaviour as tactics (why), techniques (how) and procedures (the specific way a given group does it), and has become the common vocabulary linking intelligence to detection, red teaming and risk reporting. Raw data (a feed of IPs) is not intelligence; intelligence is data plus context plus analysis plus a recommended action. The topic is examined in cyber security electives under AICTE/CBCS curricula and in certifications (CEH, CySA+, Security+, GIAC), and is asked in interviews at Indian SOC and MSSP employers - TCS, Infosys, Wipro, HCLTech, Accenture, Deloitte, PwC, EY, KPMG, Quick Heal/Seqrite, K7, CloudSEK, Sequretek, Tata Communications, Airtel, Jio, and the banks' own SOCs - and matters in practice because CERT-In directions make incident reporting and log retention a legal duty.

Explained

What threat intelligence is, and its four types

• Definition: evidence-based knowledge - including context, mechanisms, indicators, implications and action-oriented advice - about an existing or emerging threat to assets, used to inform decisions.
• Data → information → intelligence: an IP address is data; "this IP was a C2 server for a banking trojan last week" is information; "this trojan targets Indian UPI apps and our mobile banking fleet is exposed; block the range and hunt for this registry key" is intelligence.
• Strategic: non-technical, for boards and CISOs - threat landscape, sector targeting, geopolitics, budget and risk decisions. Horizon: months to years.
• Operational: on specific campaigns and actors - who is attacking this sector now, their intent, infrastructure and timing. Consumers: SOC managers, threat hunters, IR leads.
• Tactical: the adversary's TTPs - how they phish, which LOLBins they abuse, what they do after access. Consumers: detection engineers, hunters. This is where ATT&CK lives.
• Technical: atomic artefacts - hashes, IPs, domains, URLs, mutexes, YARA rules - fed to firewalls, EDR, SIEM. Short-lived.
• Classification by source: OSINT (public), HUMINT, SIGINT, internal telemetry (your own logs - the highest-fidelity source), closed/commercial feeds, dark web and sharing communities (ISACs, CERT-In advisories).

The intelligence lifecycle (six steps, commonly examined)

1. Direction / planning: define intelligence requirements (IRs) and priority intelligence requirements (PIRs) - the questions the business needs answered, e.g. "which ransomware groups hit Indian NBFCs and how do they gain entry?"
2. Collection: gather from the planned sources - feeds, logs, sandbox output, forums, partner sharing, honeypots.
3. Processing: normalise, de-duplicate, translate, enrich (WHOIS, passive DNS, geo, reputation), convert to a structure such as STIX.
4. Analysis: apply reasoning - attribution, clustering, hypothesis testing, confidence grading; produce the assessment and the recommendation.
5. Dissemination: deliver in the consumer's format - a board slide for strategic, a Sigma/YARA rule or ATT&CK layer for tactical, an API push for technical.
6. Feedback: did it answer the PIR, was it actioned, were there false positives - and the loop restarts.
7. Analytic rigour: use structured analytic techniques (ACH - analysis of competing hypotheses), state confidence (high/medium/low) and estimative language ("likely", "almost certainly"), and separate fact from assessment. Beware cognitive bias, especially confirmation bias and mirror-imaging.
8. Admiralty / NATO source grading: source reliability A-F and information credibility 1-6, quoted as "B2".
9. Traffic Light Protocol (TLP): sharing restriction labels - TLP:CLEAR, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED (TLP 2.0 retired "TLP:WHITE" in favour of TLP:CLEAR).

Indicators, the Pyramid of Pain, and attribution models

• IOC (indicator of compromise): evidence that a breach has happened - hash, IP, domain, filename, registry key, mutex, user-agent. IOA (indicator of attack): behaviour in progress, e.g. Office spawning PowerShell with encoded arguments.
• Pyramid of Pain (David Bianco) - bottom to top, how costly each is for the adversary to change: hash values → IP addresses → domain names → network/host artefacts → tools → TTPs (hardest). Detecting on TTPs forces the adversary to change behaviour, not just rebuild infrastructure.
• Cyber Kill Chain (Lockheed Martin, 7 linear phases): reconnaissance, weaponisation, delivery, exploitation, installation, command and control, actions on objectives. Strength: simple, intuitive, good for perimeter thinking. Weakness: intrusion-centric and linear; weak on insiders, lateral movement and post-compromise detail.
• Diamond Model (Caltagirone et al.): every event has four vertices - adversary, capability, infrastructure, victim - plus meta-features (timestamp, phase, result, confidence). Pivoting from one vertex to another is the core analytic move; events chain into activity threads.
• Unified Kill Chain: 18 phases merging ATT&CK's depth with the kill chain's flow (initial foothold, network propagation, action on objective).
• Attribution levels: (a) cluster / activity group - same behaviour seen together, e.g. a vendor's "UNC" or "TA" number; (b) nation-state or criminal enterprise attribution - requires intelligence beyond logs. Different vendors name the same group differently (APT41 / Wicked Panda / BARIUM), which is why ATT&CK keeps an alias list.

MITRE ATT&CK - structure and use

• What it is: a free, globally used knowledge base of adversary post-compromise behaviour observed in the wild, maintained by MITRE since 2013 and versioned (ATT&CK is revised roughly twice a year, so always cite the version you used; check the current version on the site rather than assuming).
• Matrices / domains: Enterprise (sub-matrices for Windows, Linux, macOS, Network devices, Containers, Cloud - IaaS, SaaS, Identity Provider, Office Suite - and ESXi), Mobile (Android, iOS) and ICS (industrial control systems - relevant to Indian power, oil and gas under NCIIPC's critical-infrastructure remit). PRE-ATT&CK was retired and folded into Enterprise as Reconnaissance and Resource Development.
• Hierarchy: Tactic (the adversary's goal, e.g. TA0008 Lateral Movement) → Technique (how, e.g. T1059 Command and Scripting Interpreter) → Sub-technique (T1059.001 PowerShell) → Procedure (the actual observed implementation by a group).
• Enterprise tactics in order (14): Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact.
• Other objects: Groups (G-IDs, e.g. G0016 APT29), Software (S-IDs - malware and tools), Campaigns (C-IDs), Mitigations (M-IDs), Data Sources and Data Components (what telemetry reveals a technique), Detections, and Assets (ICS).
• ID conventions: T#### technique, T####.### sub-technique, TA#### tactic, G#### group, S#### software, M#### mitigation, C#### campaign.
• Common uses: (1) detection engineering - map each detection rule to a technique; (2) coverage/gap analysis with ATT&CK Navigator heat-map layers; (3) adversary emulation plans (CALDERA, Atomic Red Team) for purple teaming; (4) threat-informed defence - prioritise the techniques your actual threat actors use; (5) SOC maturity and reporting; (6) common language across intel, red and blue teams.
• Limitations: it is a knowledge base of *observed* behaviour, not a complete taxonomy; absence of a technique does not mean it cannot happen. It is not a maturity model, not a risk assessment, and not prioritised for you. Techniques vary hugely in difficulty and importance, so "we cover 400 techniques" is a vanity metric. Coverage must be weighted by relevance and by detection quality.
• Related MITRE resources: CAPEC (attack patterns at a more abstract, application-design level), CWE (weakness types), CVE (specific vulnerabilities), D3FEND (a knowledge graph of defensive countermeasures that maps to ATT&CK), Engage (adversary engagement/denial and deception), ATT&CK Evaluations (vendor EDR tests), CTID (Center for Threat-Informed Defense).

Standards, formats and platforms

• STIX 2.1 (Structured Threat Information eXpression) - a JSON data model of objects (indicator, malware, threat-actor, attack-pattern, relationship, sighting). TAXII 2.1 - the HTTPS transport protocol that serves STIX collections. Mnemonic: STIX is *what* you say, TAXII is *how* you ship it.
• Others: OpenIOC, MAEC (malware attribute enumeration), Sigma (vendor-neutral SIEM detection rules), YARA (file/memory pattern rules), Snort/Suricata (network rules), OpenC2 (machine-speed response commands), VERIS (incident classification, used by the DBIR), CVSS (severity), EPSS (exploit probability).
• Platforms: MISP (open-source sharing), OpenCTI (open-source TIP, ATT&CK-aware), TheHive/Cortex (case management and enrichment), commercial TIPs (Anomali, ThreatConnect, Recorded Future, Mandiant), and sources like VirusTotal, AbuseIPDB, Shodan, Censys, URLScan, AlienVault OTX.
• Sharing in India: CERT-In (Indian Computer Emergency Response Team, under MeitY, the national nodal agency under the IT Act, 2000 s.70B) issues advisories, vulnerability notes and its directions of 28 April 2022 - report specified cyber incidents within 6 hours of noticing, keep ICT logs for 180 days within India, and sync clocks to NIC/NPL NTP. NCIIPC (under NTRO, s.70A) is the nodal agency for Critical Information Infrastructure and runs its own malware/threat advisories. Sectoral: RBI (cyber security framework for banks, its CSITE cell and the SOC/CSOC expectation), SEBI's CSCRF for market entities, IRDAI guidelines for insurers, DoT/NCSC and the I4C (Indian Cyber Crime Coordination Centre, MHA) with the Sanchar Saathi and 1930 helpline ecosystem. Under the DPDP Act, 2023, the Data Fiduciary breach-intimation duty and the related DPDP Rules, 2025 obligations apply only from 13 May 2027; until then IT Act s.43A and the SPDI Rules, 2011 govern reasonable security practices. ISO/IEC 27001:2022 (with 27002:2022 controls and 27035 for incident management) is the usual certification; it is voluntary unless a contract or regulator requires it.

Threat modelling, hunting and threat-informed defence

• Threat-informed defence: rather than defending everything equally, pick the actors realistically targeting your sector and geography, extract their technique set, and test and tune against that set first.
• Threat actor types: nation-state/APT, organised cyber crime and ransomware-as-a-service affiliates, hacktivists, insiders, script kiddies, and access brokers. Motivations: espionage, financial, disruption, ideology.
• Threat modelling frameworks: STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege), DREAD (scoring), PASTA (7-stage risk-centric), attack trees, MITRE's threat modelling with ATT&CK for operational technology.
• Hypothesis-driven hunting using ATT&CK: pick a technique relevant to your threat profile → state a hypothesis → identify the data source/component ATT&CK names → write the query → confirm, tune or disprove → convert a good hunt into a standing detection. (Hunting process detail belongs with incident response and hunting; here it is the ATT&CK-mapping step that matters.)
• TTP-based risk reporting: express residual risk as unmitigated high-relevance techniques rather than as a raw CVE count - this is what boards and regulators increasingly ask for.

Key points

• Threat intelligence - data processed with context and analysis into an actionable decision aid; a feed alone is not intelligence.
• Four types - strategic (board), operational (campaigns), tactical (TTPs), technical (atomic indicators).
• Intelligence lifecycle - direction, collection, processing, analysis, dissemination, feedback.
• PIR - priority intelligence requirement; the question that drives collection and keeps CTI from becoming feed-hoarding.
• IOC vs IOA - evidence of a past/current compromise versus behaviour signalling an attack in progress.
• Pyramid of Pain - hashes are cheapest to change, TTPs costliest; detect high on the pyramid.
• Cyber Kill Chain - 7 linear phases from reconnaissance to actions on objectives; perimeter-oriented and weak post-compromise.
• Diamond Model - adversary, capability, infrastructure, victim; built for analytic pivoting.
• MITRE ATT&CK - curated knowledge base of observed post-compromise behaviour; free, versioned, three domains (Enterprise, Mobile, ICS).
• Tactic / technique / sub-technique / procedure - why / how / specific how / the actual observed implementation.
• 14 Enterprise tactics - Recon, Resource Dev, Initial Access, Execution, Persistence, Priv Esc, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, C2, Exfiltration, Impact.
• ATT&CK Navigator - layer tool for coverage heat-maps and gap analysis; layers can be scored and combined.
• CAPEC / CWE / CVE / D3FEND - attack patterns / weakness classes / specific vulnerabilities / defensive countermeasures.
• STIX and TAXII - STIX is the JSON representation, TAXII the transport; Sigma for SIEM rules, YARA for file patterns.
• TLP 2.0 - CLEAR, GREEN, AMBER, AMBER+STRICT, RED (TLP:WHITE withdrawn).
• Admiralty grading - source reliability A-F with information credibility 1-6, e.g. "B2".
• CERT-In 2022 directions - report notified incidents within 6 hours; retain ICT logs 180 days in India; NTP sync to NIC/NPL.
• Coverage is not capability - technique count without weighting by relevance and detection quality is a vanity metric.

Formulas and examples

Example 1 - plain versus weighted ATT&CK coverage. A bank's SOC scopes 120 Enterprise techniques as relevant. It has validated detections for 42.

• Plain coverage = 42 ÷ 120 × 100 = 35.0%.
• Now weight by threat relevance. Suppose the techniques fall into three bands:

• Weighted coverage = 95.0 ÷ 230 × 100 = 41.3% - higher than the plain figure because effort went to the techniques that matter. Had the scores been reversed (0.05 on band 1, 0.70 on band 3) the weighted figure would be (90×0.05 + 100×0.30 + 40×0.70) ÷ 230 = (4.5 + 30 + 28) ÷ 230 = 27.2% - the same 35% plain coverage, far weaker defence. Lesson: the plain percentage can hide a misallocated programme.

Example 2 - alert quality of a new detection rule. A rule for T1059.001 (PowerShell) runs for 30 days: 180 alerts, of which 36 are confirmed malicious; separately, purple-team emulation shows 9 true PowerShell abuses were missed.

• TP = 36, FP = 180 − 36 = 144, FN = 9.
• Precision = 36 ÷ 180 = 0.20 (20%).
• Recall = 36 ÷ (36 + 9) = 36 ÷ 45 = 0.80 (80%).
• F1 = 2 × 0.20 × 0.80 ÷ (0.20 + 0.80) = 0.32 ÷ 1.00 = 0.32.
• Reading: the rule catches most abuse but 4 out of 5 alerts are noise. Fix by adding context (parent process, encoded command, user group) rather than switching the rule off - a sensitive rule plus enrichment beats a disabled rule.

Example 3 - indicator decay, and why TTPs win. A commercial feed's IP indicators have a half-life of 7 days; the SOC will act on an indicator only while at least 12.5% of its original value remains.

• 12.5% = 1/8 = (1/2)³, so three half-lives → useful life = 3 × 7 = 21 days.
• The same feed delivers 50,000 IPs/month at ₹6,00,000/year. Cost per indicator = 6,00,000 ÷ (50,000 × 12) = ₹1.00 per indicator, each useful for 21 days.
• A single detection on T1566.001 (spearphishing attachment) behaviour costs about 3 analyst-days to build and tune. At ₹1,20,000/month (≈₹5,455 per working day of 22 days), that is 3 × 5,455 ≈ ₹16,365, and it keeps firing across campaigns after infrastructure rotates. Hence the Pyramid of Pain: spend on the durable layer, buy indicators only for blocking at scale.

Example 4 - CERT-In reporting clock. A ransomware note is noticed by the SOC at 23:40 IST on a Friday.

• CERT-In's 2022 directions require reporting notified incidents within 6 hours of noticing, so the deadline is 05:40 IST Saturday - the clock does not pause for a weekend.
• Hours available for the first report = 6; containment work runs in parallel. The lesson in exams: the trigger is "noticing", not "confirming", and the duty is on the entity, not on its MSSP.
• Log retention: an incident on 2026-11-05 requires ICT logs from at least 2026-05-09 (180 days earlier) to be available within India.

Example 5 - vulnerability prioritisation with CVSS and EPSS. Three findings on an internet-facing portal:

• Ranking by CVSS alone puts A first; adding EPSS (74% chance of exploitation in 30 days) and ATT&CK context puts B first. Expected-loss view: if a breach costs ₹2 crore, B's expected loss = 0.74 × ₹2,00,00,000 = ₹1.48 crore against A's 0.02 × ₹2,00,00,000 = ₹4 lakh.

# Sigma-style skeleton mapped to ATT&CK (vendor-neutral; converted to SIEM query by a backend)
title: Office application spawning PowerShell
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  parent:
    ParentImage|endswith: ['\WINWORD.EXE', '\EXCEL.EXE', '\POWERPNT.EXE']
  child:
    Image|endswith: '\powershell.exe'
  condition: parent and child
falsepositives: ['Signed macro-based internal reporting tools']
level: high
tags:
  - attack.execution
  - attack.t1059.001
  - attack.initial_access
  - attack.t1566.001

Where it is used

• SOC and MSSP delivery (India's largest employer of this skill): TCS, Infosys, Wipro, HCLTech, Tech Mahindra, LTIMindtree, Accenture, Deloitte, PwC, EY, KPMG - analysts map every alert and rule to an ATT&CK technique, and coverage heat-maps are a standard client deliverable.
• Product and research teams: Quick Heal/Seqrite, K7 Computing, Sequretek, CloudSEK, Lucideus/SAFE Security, Innefu, and global vendors' India centres - IOC and TTP extraction, YARA/Sigma authoring, threat reports.
• Banking, NBFC and capital markets: RBI-regulated entities' CSOCs, SEBI CSCRF compliance for exchanges, depositories and large brokers; UPI/NPCI fraud-and-threat teams; ATT&CK-mapped red-team and purple-team exercises.
• Government and critical infrastructure: CERT-In advisories, NCIIPC for power, telecom, transport, banking and strategic sectors (ATT&CK for ICS in grid and refinery SCADA), DRDO/NTRO and defence cyber units, state cyber cells and I4C.
• Telecom and cloud: Airtel, Jio, Tata Communications and hyperscaler India teams - Cloud and Identity Provider sub-matrices, high-volume feed management, OpenC2-style automated blocking.
• Job roles: Threat Intelligence Analyst, SOC Analyst L1-L3, Detection Engineer, Threat Hunter, Purple Team Engineer, Red Team Operator, CTI Manager; typical entry requirement is one of CEH, CompTIA CySA+/Security+, GIAC GCTI/GCIH, or a Blue Team Level 1-style practical certification.

Interview questions

• Q: How is threat intelligence different from a threat feed? A: A feed is raw data - indicators without context. Intelligence is that data processed, enriched and analysed against a specific requirement, with an assessment and a recommended action.
• Q: Distinguish tactics, techniques and procedures with one example. A: Tactic is the goal (Credential Access), technique is the method (T1003 OS Credential Dumping, sub-technique T1003.001 LSASS Memory), procedure is the specific observed implementation (a given group using a renamed comsvcs.dll MiniDump call).
• Q: Why detect on TTPs rather than hashes? A: The Pyramid of Pain - a hash or IP changes in minutes at near-zero cost to the adversary, while changing behaviour means re-tooling and retraining, so a TTP detection survives infrastructure rotation.
• Q: Compare the Cyber Kill Chain and MITRE ATT&CK. A: The kill chain is a linear 7-phase story of an intrusion, good for narrative and perimeter defence; ATT&CK is a non-linear matrix of concrete post-compromise techniques with detections and mitigations, built for detection engineering and emulation. They are complementary, not rivals.
• Q: What are the four vertices of the Diamond Model and what is it for? A: Adversary, capability, infrastructure and victim; it is an analytic framework for pivoting - from a malicious domain to the adversary that registered it to other victims it contacted.
• Q: What are STIX and TAXII? A: STIX 2.1 is a standardised JSON model for expressing threat information as objects and relationships; TAXII 2.1 is the HTTPS API for publishing and subscribing to STIX collections.
• Q: Your CISO says "we cover 85% of ATT&CK". What is wrong with that? A: Technique count is a vanity metric. It ignores relevance to your actual threat actors, ignores detection quality (telemetry present is not a rule that fires), and treats all techniques as equally important. Weighted, emulation-validated coverage is the meaningful number.
• Q: What does an ATT&CK Navigator layer give you? A: A scored, colour-coded heat-map over the matrix that you can use to show detection coverage, a specific actor's technique set, or the overlap between the two - the gap is your roadmap.
• Q: How would you build an adversary emulation plan? A: Pick the actor relevant to the sector, extract its technique list from its ATT&CK group page and public reporting, order the techniques into a realistic chain, execute with Atomic Red Team or CALDERA in a controlled scope with written authorisation, then record which steps were detected, blocked or missed and feed the gaps to detection engineering.
• Q: What is the difference between CVE, CWE, CAPEC and ATT&CK? A: CVE is a specific vulnerability instance, CWE the class of weakness behind it, CAPEC the abstract attack pattern that exploits such weaknesses, and ATT&CK the real-world adversary behaviour observed in intrusions.
• Q: What are CERT-In's key directions of April 2022? A: Report specified cyber incidents within 6 hours of noticing, keep ICT system logs for 180 days within India, synchronise system clocks to NIC/NPL NTP servers, and maintain designated points of contact; service providers must also retain subscriber and KYC records as specified.
• Q: Is attribution a defender's priority? A: Usually not for an enterprise. Behavioural attribution to an activity cluster is useful because it predicts the next technique; nation-state naming rarely changes the defensive action and is best left to governments and vendors with broader intelligence.
• Q: How would you measure whether a CTI programme is worth its money? A: Against the PIRs it was set up to answer - how many feeds led to a blocked or detected intrusion, mean time to detect before and after, false-positive reduction, techniques newly covered - and express the benefit as losses avoided versus programme cost in rupees.

Common mistakes

• Calling a feed of IPs and hashes "threat intelligence" with no requirement, no context and no action attached.
• Writing that ATT&CK is a kill chain or that its tactics must be executed in order - the matrix is non-linear and an intrusion may revisit or skip tactics.
• Confusing a tactic ID (TA####) with a technique ID (T####), or quoting a technique without its sub-technique where the sub-technique is the real answer.
• Treating ATT&CK as a complete or prescriptive standard, then reporting raw technique-count coverage as security maturity.
• Mixing up STIX and TAXII (format versus transport), and IOC with IOA (past evidence versus behaviour in progress).
• Chasing attribution and actor names in an exam answer or an interview when the examiner wanted the defensive action.
• Quoting CERT-In's window as 6 hours "from confirmation" or from the incident's start - it runs from noticing; and quoting DPDP breach duties as already in force when the Data Fiduciary obligations under the DPDP Rules, 2025 apply from 13 May 2027.
• Reporting a detection as working without validating it by emulation - telemetry existing in the SIEM is not the same as a rule that fires and an analyst who acts.

Related topics

Security operations: SOC and SIEM · Incident response and threat hunting · Ethical hacking and penetration testing · Malware analysis and reverse engineering · Vulnerability assessment and management · Cyber crime