Understanding Threat Frameworks

A threat framework gives security teams a shared structure for describing harmful activity, organising evidence, planning defences, and communicating priorities.

What you will learn

This page explains what threat frameworks are, introduces MITRE ATT&CK as the primary framework used in this kit, and shows how to create evidence-based ATT&CK mappings.

What is a threat framework?

Core concept

A threat framework organises security knowledge so teams can describe harmful behaviour, relate evidence, compare priorities, and plan defensive work using a shared language. Different frameworks may focus on attacker behaviour, attack stages, incident relationships, or defensive coverage.

GoalsBehavioursEvidenceControlsGaps

Keep in mind: A framework helps people organise and communicate an assessment. It does not automatically identify organisational risk, prove that a detection works, or replace incident evidence.

01BehaviourAn observable action carried out to achieve a goal 02MappingA documented relationship between evidence and a framework concept 03CoverageA scoped claim about visibility, detection, testing, or response

What a threat framework is not

Threat frameworkOrganise and communicate security knowledge

Risk assessmentPrioritise likelihood and organisational impact

Threat intelligenceDescribe relevant actors, campaigns, infrastructure, and context

Detection engineeringBuild and test logic against available security data

Security validationTest whether selected controls produce the expected outcome

Connected, but not interchangeable

Frameworks help these practices use consistent language. They do not perform the risk analysis, collect the intelligence, create the detection, or execute the validation test.

What is MITRE ATT&CK?

MITRE ATT&CK is a knowledge base that organises observed attacker behaviour. It gives security teams a shared way to describe what an attacker is trying to achieve and how they may do it.

ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge. It is the main threat framework used throughout this kit and the framework displayed by ATT&CK Navigator.

01EvidenceA command, process, file, authentication event, or other observed record

→

02BehaviourA plain-language explanation of what the evidence shows

→

03ATT&CK mappingThe closest tactic and technique supported by the evidence

A mapping is not proof of coverage

Mapping observed behaviour to a technique does not show that every form of the technique is visible, detected, prevented, or understood.

How ATT&CK is organised

Tactic

The attacker's immediate goal, such as gaining access to account credentials.

Technique

A general method used to reach that goal, such as capturing information entered by a user.

Sub-technique

A more specific form of a technique, such as recording keys pressed on a keyboard.

Procedure

How a particular attacker or tool carried out the technique using a specific command, file, or sequence.

Mitigation

A control that may reduce the chance or impact of the behaviour.

Data source

The type of information defenders can examine, such as program activity recorded by an endpoint tool.

ATT&CK includes separate collections, called domains, for enterprise technology, mobile devices, and industrial control systems. Select the domain that matches the environment being studied.

How defenders use ATT&CK

Describe incidents

Use shared technique names when recording attacker behaviour supported by evidence.

Plan detections

Identify which activity records and detection logic may reveal a technique.

Review coverage

Compare important attacker behaviours with existing visibility, detections, and test results.

Design exercises

Select relevant behaviours for authorised security validation and training.

A practical mapping workflow

1. ObserveRecord what actually happened using commands, processes, files, authentication records, network activity, or other available evidence.
2. DescribeExplain the behaviour in plain language before selecting a framework concept, keeping facts separate from assumptions.
3. SearchFind candidate ATT&CK techniques and sub-techniques whose complete descriptions may match the observed behaviour.
4. CompareReview definitions, platforms, examples, relationships, data components, and the level of detail supported by the evidence.
5. SelectChoose the closest tactic, technique, or sub-technique supported by the behaviour rather than matching keywords alone.
6. DocumentRecord the evidence, reasoning, confidence, ATT&CK version, uncertainty, owner, and purpose of the mapping.
7. Review and improveAsk another analyst to challenge the mapping and update it when evidence, scope, or ATT&CK changes.

Try an ATT&CK mapping

Act as a junior analyst. Review a small evidence record, choose the closest ATT&CK mapping, and use the feedback to test another case.

Analyst challengeMap three evidence records 0 of 3 mapped

1 Select an evidence record

PowerShell activityEndpoint process record Scheduled taskWindows task event Credential accessProcess-access event

Evidence recordPowerShell activity

HostFIN-LT-22 RecordProcess creation

Observed behaviourpowershell.exe ran an encoded command from WINWORD.EXE.

2 Choose the best-supported mapping

? Make your assessment Choose the technique that most directly explains the recorded behaviour.

Exercise debrief

A defensible mapping starts with the observed behaviour, not a keyword. Record the supporting evidence, confidence, scope, and ATT&CK version when using a mapping operationally. A mapped technique does not prove that every variation is detected or prevented.

What makes ATT&CK useful

Start with an evidence question

What behaviour best explains this observed PowerShell activity?

1. 1Set the evidence boundarySeparate observed facts from assumptions and missing records.
2. 2Find the closest conceptCompare complete technique and sub-technique definitions.
3. 3Record the supportLink evidence, reasoning, confidence, scope, and ATT&CK version.
4. 4Use the mappingGuide investigation, detection planning, validation, or communication.

! Plan for mapping friction

Ambiguous behaviourIncomplete telemetryTechnique overlapVersion changesDifferent scoringUnclear confidence

ATT&CK improves consistency, but useful mappings still require evidence, review, documented rules, and operational context.

Threat-framework tool in this kit

ATT&CK Navigator is a web-based tool for exploring ATT&CK matrices and creating coloured, scored, or annotated layers.

Visual ATT&CK analysis

ATT&CK Navigator

Choose it when: You need to compare, score, annotate, or communicate selected ATT&CK techniques.

Layer contents: Technique selections, colours, scores, comments, links, and supporting notes.

Strength: A portable visual format for detection reviews, incident mapping, threat comparison, and exercise planning.

Define the layer's purpose, ATT&CK version, scoring meaning, evidence standard, owner, and review date.

Choose the purpose before colouring techniques

Navigator displays the team's assessment; it does not test or verify the claimed coverage.

Continue learning

• Explore ATT&CK Navigator to create and manage ATT&CK layers.
• Understand Security Validation to see how selected behaviours can be tested safely.
• Explore Caldera to run authorised ATT&CK-aligned exercises.