Visualizing ATT&CK Tactics, Techniques, and Sub-techniques

Overview

The ThreatConnect^® ATT&CK^® Visualizer displays all MITRE ATT&CK^® Enterprise tactics, techniques, and sub-techniques. As you select techniques and sub-techniques in the ATT&CK Visualizer, you can view more details about the selected items and see which Groups in your ThreatConnect owners are using them. This context allows you to gather insights into other Groups using similar tactics, techniques, and procedures (TTPs) and make informed decisions during an investigation involving the Groups.

Before You Start

User Roles

• To access the ATT&CK Visualizer and view details for techniques and sub-techniques, your user account can have any Organization role.

ATT&CK Visualizer Layout

Figure 1 illustrates how the ATT&CK Visualizer displays MITRE ATT&CK Enterprise tactics, techniques, and sub-techniques:

1. Each column represents a tactic (i.e., the goal a threat actor or adversary is trying to achieve) and displays the number of techniques that the tactic comprises.
2. Each card within a column represents a technique (i.e., the method a threat actor or adversary uses to achieve their goal) that the tactic comprises and displays the number of the technique’s sub-techniques.
3. If a technique has sub-techniques (i.e., more specific descriptions of the adversarial behavior used to achieve a goal), the technique card will contain a series of nested cards that represent the sub-techniques. To display a technique’s sub-techniques, click Show sub-techniquesat the bottom of the technique.
   Hint

   To expand all techniques and display their sub-techniques, click Expand All at the upper right of the ATT&CK Visualizer.

Viewing Details for Selected Techniques and Sub-techniques

Selecting techniques and sub-techniques in the ATT&CK Visualizer opens the Selection Details drawer, which displays details about the selected items. The appearance of the Selection Details drawer depends on the number of items that are currently selected.

When you select an individual technique or sub-technique, the Selection Details drawer opens automatically. You can also open the Selection Details drawer manually by clicking View selection detailsat the upper right of the ATT&CK Visualizer or by selecting View Selection Details from the Selection Actions dropdown at the upper right of the ATT&CK Visualizer.

Individual Technique or Sub-technique

When only one technique or sub-technique is selected, the Selection Details drawer (Figure 2) displays the following details about the selected item:

• Technique: The technique or sub-technique ID.
• Associated Tactics: The tactics associated with the technique or sub-technique.
• Platform(s): The operating systems and applications associated with the technique or sub-technique.
• Sub-Techniques: (Techniques only) The sub-techniques that the technique comprises. To open the Selection Details drawer for a sub-technique, click its name.
• Parent Technique: (Sub-techniques only) The sub-technique’s parent technique. To open the Selection Details drawer for the parent technique, click its name.
• Groups using Technique or Groups using Sub-technique: The number of Groups in your ThreatConnect owners that have an ATT&CK Tag corresponding to the technique or sub-technique applied to them.
• Financial Impact: (Techniques only) The technique’s Financial Impact level, which is the relative amount of potential financial risk that the technique poses to your company. Financial Impact levels range from $ (Very Low Potential Cost) to $$$$$ (Very High Potential Cost).
  Note

  The currency displayed in the Financial Impact field is selected by your Organization Administrator. If ATT&CK RQ Financial Impact is not configured for your Organization, the Financial Impact field will display no Financial Impact data.
• Description: The description of the technique or sub-technique. To view the technique’s or sub-technique’s entry on the MITRE ATT&CK website, click More information at the bottom of this section.
• Groups: The Groups in your ThreatConnect owners that have an ATT&CK Tag corresponding to the technique or sub-technique applied to them. If there are no such Groups, the Selection Details drawer will not display the Groups card.

Multiple Techniques or Sub-techniques

You can select multiple techniques and sub-techniques when viewing a standard ATT&CK view or assigning security coverage for an Organization. When multiple techniques or sub-techniques are selected, the Selection Details drawer (Figure 3) displays the following cards:

• Selections: The Selections card displays all techniques and sub-techniques that are currently selected in the ATT&CK Visualizer and allows you to do the following:
  • Clear an individual selection: Click Clear selectionon the right side of a technique’s or sub-technique’s row to deselect the technique or sub-technique.
  • Clear all selections: Click Clear all selectionsin the table header to deselect all techniques and sub-techniques that are currently selected.
  • View more details about a technique or sub-technique: Click a technique’s or sub-technique’s row to open its Selection Details drawer. To return to the Selection card, click Go Backat the upper left of the Selection Details drawer.
• Shared Groups: (Standard ATT&CK views only) The Shared Groups card displays the Groups in your ThreatConnect owners that have ATT&CK Tags corresponding to all selected techniques and sub-techniques applied to them.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.
MITRE ATT&CK^® and ATT&CK^® are registered trademarks of The MITRE Corporation.

20151-05 v.04.A