Our Work

Our Research Approach

Collaborative R&D in the Public Interest

Together with Participant organizations, we cultivate solutions for a safer world and advance threat-informed defense with open-source software, methodologies, and frameworks. By expanding upon the MITRE ATT&CK knowledge base, our work expands the global understanding of cyber adversaries and their tradecraft with the public release of data sets critical to better understanding adversarial behavior and their movements.

Insider Threat TTP Knowledge Base V1

The Insider Threat Tactics, Techniques, and Procedures (TTP) Knowledge Base aims to advance our collective understanding of the technical …

Continue reading

NIST 800-53 Controls to ATT&CK Mappings

This project created a comprehensive set of mappings between MITRE ATT&CK® and NIST Special Publication 800-53 with supporting documentation …

Continue reading

Mapping ATT&CK to CVE for Impact

This research defines a methodology for using MITRE ATT&CK® to characterize the potential impacts of vulnerabilities. ATT&CK’s tactics …

Continue reading

Threat Report Attack Mapper V1

TRAM is an open-source platform designed to advance research into automating the mapping of cyber threat intelligence reports to MITRE …

Continue reading

Security Stack Mappings – Amazon Web Services

This project empowers organizations with independent data on which native AWS security controls are most useful in defending against the …

Continue reading

ATT&CK Integration into VERIS V1

This project created a mapping and translation layer between VERIS and ATT&CK that allows ATT&CK to describe the adversary behaviors that …

Continue reading

Atomic Data Sources

Cyber threat detection starts with understanding the data sources and sensors that can be used to detect a given adversary TTP. Motivated by a …

Continue reading

Security Stack Mappings – Azure

This project empowers organizations with independent data on which native Azure security controls are most useful in defending against the …

Continue reading

ATT&CK Workbench V1

ATT&CK Workbench is an easy-to-use open-source tool that allows organizations to manage and extend their own local version of ATT&CK and …

Continue reading

ATT&CK for Containers

This project investigated the viability of adding container-related techniques into MITRE ATT&CK, leading to the development of an ATT&CK …

Continue reading

Menupass Adversary Emulation Plan

menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with …

Continue reading

ATT&CK for Cloud

This project refined and expanded MITRE ATT&CK’s coverage of adversary behaviors in cloud environments. Through our research, we refactored …

Continue reading