MITRE ATT&CK Practical Guide: Mapping Threats to Detection Rules

MITRE ATT&CK: From Theory to Detection

The MITRE ATT&CK framework catalogs adversary tactics, techniques, and procedures (TTPs) based on real-world observations. While many organizations adopt ATT&CK, few effectively translate it into operational detections.

Framework Structure

Tactics (The "Why")

14 tactics representing adversary goals:

1. Reconnaissance
2. Resource Development
3. Initial Access
4. Execution
5. Persistence
6. Privilege Escalation
7. Defense Evasion
8. Credential Access
9. Discovery
10. Lateral Movement
11. Collection
12. Command and Control
13. Exfiltration
14. Impact

Techniques (The "How")

~200 techniques and ~400 sub-techniques describing specific methods.

Procedures (The "What")

Specific implementations by threat actors.

Building Detection Rules

Step 1: Prioritize Techniques

Not all techniques are equally relevant. Prioritize based on:

• Techniques used by threat actors targeting your industry
• Techniques your current tooling can detect
• Techniques with high prevalence across groups

Step 2: Map Data Sources

Each technique lists required data sources:

T1003.001 - LSASS Memory
Data Sources: Process Access, OS API Execution
Log Sources: Sysmon Event 10, Windows Security 4656

Step 3: Write Detection Rules

Sigma Rule Example (T1003.001 - LSASS Credential Dumping):

title: LSASS Memory Access
logsource:
    category: process_access
    product: windows
detection:
    selection:
        TargetImage|endswith: '\lsass.exe'
        GrantedAccess|contains:
            - '0x1010'
            - '0x1410'
    filter:
        SourceImage|endswith:
            - '\wmiprvse.exe'
            - '	askmgr.exe'
    condition: selection and not filter
level: high

Step 4: Validate Coverage

Create an ATT&CK Navigator layer showing your detection coverage:

• Green: Detected with high confidence
• Yellow: Partial detection or high false positive rate
• Red: No detection capability

Continuous Improvement

• Run purple team exercises to validate detections
• Update rules as threat actor TTPs evolve
• Track detection effectiveness metrics
• Share detections with the community (Sigma, YARA)

Where SuperClue Fits

SuperClue's 58 built-in HIDS rules are mapped to MITRE ATT&CK techniques, and its SOC dashboard shows an ATT&CK map of the techniques behind your agents' detections. It does not produce a detection coverage heatmap or gap analysis for your whole program.