ATT&CK Threat Hunting flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

ATT&CK Tactic

A column in the ATT&CK matrix representing the adversary's tactical goal at a stage of an intrusion, such as Credential Access or Lateral Movement. Tactics group techniques by purpose rather than by tool or platform.

Sub-technique ID format

Sub-techniques extend a parent technique ID with a dot and three digits, for example T1059.001 under T1059. The parent ID is never reused for a different behavior after publication, preserving mapping stability.

x_mitre_platforms field

A STIX property on ATT&CK technique objects listing applicable platforms such as Windows, Linux, macOS, AWS, or Azure AD. Filtering by this field prevents mapping cloud-only techniques to endpoint telemetry.

Data Component

A STIX object nested under a Data Source that names a specific observable category, such as Process Creation under the Process source. It is the join key between ATT&CK techniques and actual telemetry fields.

Deprecated technique handling

ATT&CK marks retired techniques with revoked or x_mitre_deprecated flags instead of deleting or reassigning IDs. Pipelines must filter these flags so stale mappings do not inflate coverage scores.

Intrusion Set versus Campaign

An Intrusion Set groups activity attributed to one actor across time, while a Campaign is a bounded set of activity within a period. Map durable TTPs to Intrusion Set and transient infrastructure to Campaign.

Software uses relationship

ATT&CK links Software objects to the techniques they can perform via uses relationships. Traversing these links from a named tool yields a capability map independent of whether the behavior was observed.

Mapping confidence ladder

A ranking of mapping evidence: explicit technique citation ranks highest, behavioral description next, then inference from tooling, then inference from actor profile. Each mapping should record its evidence tier.

Navigator layer JSON

A JSON file describing technique scores, color scales, and comments for display in ATT&CK Navigator. It is the standard interchange format for coverage heat maps and scoring rubrics.

Indicates relationship in STIX

A STIX relationship connecting an Indicator object to an Attack Pattern it detects. It allows indicator feeds to be resolved to ATT&CK techniques for coverage and prioritization queries.

Falsifiable hunt hypothesis

A statement pairing an adversary behavior, target platform, expected telemetry, and an observable outcome that could disprove it. Without a disprovable outcome the activity is monitoring, not hunting.

Intelligence-to-hypothesis chain

The derivation path from actor or technique to Data Component, telemetry source, query, expected result, and validation criterion. Each link must be explicit or the hunt cannot be validated.

Predefined benign baseline

The measured normal distribution for the population a hunt queries, established before execution. It converts deviation judgments from impressionistic to quantitative and supports threshold selection.

Inconclusive hunt outcome

A hunt result where telemetry was absent or insufficient to test the hypothesis. It is recorded as a data-source gap rather than a negative finding and feeds acquisition requests.

Hunt population scoping

Explicitly specifying the host subset, user cohort, and time window before querying. Unbounded scope produces unreadable result sets and prevents meaningful baseline comparison.

4688 command-line auditing

Windows Security event 4688 records process creation, but the process command line field appears only when the command-line inclusion policy is enabled. Without it, argument-based hypotheses cannot be tested.

Sysmon Event ID 10

Sysmon process access events record cross-process handle requests with GrantedAccess masks. Masks such as 0x1F0FFF or 0x1010 indicate access rights consistent with process injection.

CloudTrail data events

AWS CloudTrail management events are logged by default, but S3 object-level and Lambda invoke data events are opt-in and incur cost. Absence of data events silently limits cloud hunting scope.

Zeek protocol logs

Zeek emits structured conn, dns, http, and ssl logs capturing protocol-level metadata without full payload retention. They are the durable network substrate when packet capture windows are short.

Retention versus hunt window

A hunt window longer than the log retention period is silently truncated, producing false negatives. Retention must exceed the longest planned hypothesis window, commonly ninety days or more.

Process lineage rarity

A frequency comparison of parent-child image pairs against a population baseline. Rare pairs involving scripting hosts such as mshta or rundll32 carry high signal for proxy execution.

Argument tokenization versus regex

Parsing command lines into normalized argument tokens resists evasion through quoting, case, and whitespace variation. Raw string regex matching is brittle against trivial adversary obfuscation.

Sigma rule portability

Sigma is a vendor-neutral detection format converted to backend query languages. Field mappings differ per SIEM, so converted rules require validation against the target schema before deployment.

Sequence correlation entity key

Multi-step analytics need a stable key such as host plus user and explicit time windows. Without it, events from different entities correlate falsely and inflate alert volume.

First-seen API call detection

Flagging API actions a principal has never previously invoked, derived from CloudTrail history. Behavioral rarity outperforms enumerating known-malicious API names, which adversaries rotate.

Zero-result source health check

Before accepting an empty query result as negative, confirm the underlying log source is ingesting and parsed. Silent source failure is a common cause of false negative hunts.

Triage decision tree

An ordered set of questions: is the event a telemetry artifact, is it explained by sanctioned tooling, does it match the hypothesis observable, and should it escalate. It standardizes closure rationale.

True positive to rule

A confirmed hunt finding must become a detection rule carrying the query, ATT&CK mapping, and tested false-positive profile. Otherwise the finding remains a one-time observation with no lasting value.

Atomic test validation

Executing a controlled emulation of the target behavior and confirming the analytic fires. An untested analytic is a hypothesis about detection rather than a validated detection.

Hunt chain of custody

Preserving raw event identifiers, query text, execution timestamp, and result counts for each hunt. It makes findings reproducible, auditable, and defensible during incident review.

Handoff package contents

Rule logic, required log sources and field mappings, ATT&CK and Data Component mapping, known false positives, test evidence, severity routing, and named owner. It enables independent rule maintenance.

Claimed versus validated coverage

Claimed coverage is a mapped rule with no test evidence; validated coverage has fired in controlled testing and carries a false-positive profile. Only validated coverage should be reported as detection.