Mapping Real Attacks to the MITRE ATT&CK Framework: A Practical Guide

In the ever-evolving cybersecurity landscape, defenders are often faced with the challenge of turning raw threat data into actionable intelligence. One of the most effective ways to bridge this gap is by mapping real-world attacks to the MITRE ATT&CK Framework—a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

This practical guide will walk you through how UK organisations can effectively use MITRE ATT&CK to contextualise threats, strengthen defences, and improve incident response.

What Is the MITRE ATT&CK Framework?

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a knowledge base that categorises how attackers behave at various stages of the attack lifecycle. It includes tactics (the why of an attack), techniques (the how), and sub-techniques, all of which help security teams understand adversary behaviour.

Organisations in the UK—from SMEs to government departments—use ATT&CK to:

• Improve threat detection and hunting

• Inform incident response processes

• Identify security control gaps

• Prioritise defensive investments

Step-by-Step: Mapping a Real Attack to ATT&CK

1. Gather Evidence from a Real Attack

Start with data collected from an incident:

• Logs (Windows Event Logs, Sysmon, firewall logs)

• EDR alerts

• Threat intel reports

• Internal IR (incident response) notes

Example: Let’s say your SOC received alerts of suspicious PowerShell execution followed by unauthorised domain account use.

2. Break the Attack into Phases

Identify the key stages of the intrusion using the ATT&CK matrix:

• Initial Access

• Execution

• Persistence

• Privilege Escalation

• Defence Evasion

• Credential Access

• Discovery

• Lateral Movement

• Command & Control

• Exfiltration

This helps you contextualise each part of the attack within a larger kill chain.

3. Map Each Step to ATT&CK Techniques

Match observed behaviours to ATT&CK techniques.

Example Attack Mapping:

• PowerShell abuse → T1059.001 (Command and Scripting Interpreter: PowerShell)

• Credential dumping via LSASS → T1003.001 (OS Credential Dumping: LSASS Memory)

• Remote desktop lateral movement → T1021.001 (Remote Services: Remote Desktop Protocol)

• Data exfil via cloud → T1567.002 (Exfiltration Over Web Service: Exfiltration to Cloud Storage)

4. Validate & Cross-Reference

Ensure mappings are accurate by cross-referencing with:

• MITRE’s official documentation

• Threat intel feeds (e.g., NCSC advisories, vendor reports)

• Red team findings

5. Use the Mapping for Action

Now that you’ve mapped the incident:

• Tune detection rules (e.g., add Sigma rules)

• Patch visibility gaps

• Run threat hunts using the identified techniques

• Communicate effectively with stakeholders using ATT&CK IDs

UK-Focused Example: Mapping a Real Threat Campaign

In 2023, the NCSC highlighted ongoing attacks targeting UK legal and accounting sectors using spear-phishing emails delivering malware like Qakbot.

Mapped Techniques:

• T1566.001 – Phishing: Spearphishing Attachment

• T1059.003 – Command and Scripting Interpreter: Windows Command Shell

• T1105 – Ingress Tool Transfer

• T1027 – Obfuscated Files or Information

By mapping this attack, affected organisations improved their email filtering rules, implemented stricter macro controls, and launched targeted hunts for Qakbot-related behaviours.

Final Thoughts

Mapping real-world attacks to the MITRE ATT&CK Framework isn’t just a tick-box exercise—it’s a strategic move. For UK-based organisations, it provides a shared language for analysts, CISOs, and stakeholders alike, turning chaos into clarity and intelligence into action.

By regularly applying this approach, you’ll:

• Shorten detection and response times

• Improve threat hunting capabilities

• Strengthen overall cyber resilience

As threats continue to evolve, so must our methods. And ATT&CK is one of the best places to start.

Want to get started?

Explore the MITRE ATT&CK Navigator or check out the latest advisories from the NCSC to begin mapping current threats affecting the UK today.