logo
        • Who We Are

        • Learn more about MITRE Engenuity’s journey as a hub for transformative innovation.

        • How We Engage

        • We forge innovative partnerships to generate whole-of-nation solutions to complex technological problems.

        • Contact Us

        • Connect with a member of the MITRE Engenuity team and ensure your inquiry gets to the right people.

        • Cybersecurity

        • We are relentlessly advancing the art of threat-informed defense, anchored by a belief that we can improve our defenses with a systemic application of a deep understanding of adversary tradecraft and technology.

        • ATT&CK Evaluations

        • We offer objective analysis of cyber products and features – see our latest results.

        • Center for Threat-Informed Defense

        • Read more about the cutting-edge research and development being done with input from our participant organizations, featuring some of the top security operations centers.

        • Developing tomorrow's cyber workforce today.
        • News & Insights

        • We are leading the leading edge of innovation. Explore the latest news, insights, R&D, and special projects from our advanced tech experts and partners.

        • Subscribe to Our Newsletters

        • Our tech foundation is addressing the complex problems that face our nation today. Find out how you can join our efforts as we spur innovation for public good.

          Subscribe

Attack Flow

Project Summary

Published : Oct 27, 2022

Attack flow is a data model with supporting tooling and examples for describing sequences of adversary behaviors. Attack flows help defenders understand, share, and make threat-informed decisions based on the sequence of actions in a cyber-attack. Flows can be analyzed to identify common patterns in adversary behavior, overlayed on ATT&CK Navigator layers to understand defensive coverage, and create a foundation for intel-driven adversary emulation plans.

Problem

Defenders often track adversary behaviors atomically, focusing on one specific action at a time. This makes it harder to understand adversary attacks and to build effective defenses against those attacks.

SOLUTION

Create a language, and associated tooling, to describe flows of ATT&CK techniques and combine those flows into patterns of behavior.

IMPACT

Help defenders and leaders understand how adversaries operate and compose atomic techniques into attacks to better understand defensive posture.

 

funding Research Participants

A logo with the word'monal'on it.
Attack iq logo on a black background.
Citrix logo on a black background.
Crowdstrike logo on a white background.
A logo with a red square on a black background.
Fujitsu logo on a black background.
Hca healthcare logo on a black background.
Ibm security logo on a white background.
Jp morgan chase & co logo.

Non-Profit Research Participants

Analysis & resilience center for systematic risk.
Cyber threat alliance logo.
Global cyber alliance logo.

Leadership Spotlight: 
Collaborative Leadership Driving Innovation

 

Hear directly from research participants about this project and why it matters. Learn how these leaders are changing the game on the adversary.

Adoption Spotlights: Center R&D in Action

Adoption Spotlights showcase the Center’s R&D in action to help the community adopt threat-informed defense. Learn how these organizations are leveraging Center R&D to change the game on the adversary.

Share This Project

Explore More of Our Work

Stay Informed

Stay informed about new releases of R&D projects and other exciting updates from the Center for Threat-Informed Defense.