ATT&CK with Sub-Techniques — What You Need to Know
By: Blake Strom
Tags: Cti, Mitre Attack

The new sub-techniques here add more detail underneath OS Credential Dumping. Taking advantage of them will require some manual analysis, but the added granularity will allow you to represent different types of credential dumping that can happen at a more detailed level than just mapping to the broader OS Credential Dumping. These types of remaps can be done over time, because if you keep something mapped to OS Credential Dumping, then it’s still correct. You can map new stuff to the sub-techniques and come back to the old ones to make them more precise as you have time and resources.

TL;DR, if you do just Step 1 while mapping things that are deprecated to NULL, then it will still be correct. If you do Step 2, then you’ll have pretty much everything you mapped before now also mapped to the new ATT&CK. If you complete Step 3, then you’ll get the newfound power of sub-techniques!

We also converted these into JSON to make programmatic manipulation easier. The preview below shows four entries T1001, T1002, T1003, and T1004 with explanations of different types of changes. The last for T1034 shows the format when a technique was broken apart into several sub-techniques. Thanks to Marcus Bakker for the initial structure idea!

[

{

"T1001": [

{

"id": "T1001",

"explanation": "Remains Technique, New sub-techniques added"

}

]

},

{

"T1002": [

{

"id": "T1560",

"explanation": "Created to consolidate behavior around encrypting and compressing collected data"

}

]

},

{

"T1003": [

{

"id": "T1003",

"explanation": "Remains Technique, Renamed, Name change from Credential Dumping and new sub-techniques added"

}

]

},

{

"T1004": [

{

"id": "T1547.004",

"explanation": "Existing technique that became a sub-technique"

}

]

},

...

{

"T1034": [

{

"id": "T1574.007",

"explanation": "Deprecated and split into separate Unquoted Path, PATH Environment Variable, and Search Order Hijacking sub-techniques."

},

{

"id": "T1574.008",

"explanation": "Deprecated and split into separate Unquoted Path, PATH Environment Variable, and Search Order Hijacking sub-techniques."

},

{

"id": "T1574.009",

"explanation": "Deprecated and split into separate Unquoted Path, PATH Environment Variable, and Search Order Hijacking sub-techniques."

}

]

},

...

]

Sub-Technique Timeline and Feedback

As I mentioned above, the version of ATT&CK with sub-techniques is only in beta right now to allow enough time for feedback and for organizations to determine how to transition. We are expecting to make we make it the official version sometime in July 2020.

There are some expected changes with sub-techniques to be aware of before July. We anticipate some changes to the techniques and sub-techniques based on feedback we get, but do not think it will be substantial. We think it’s more likely that we’ll be making changes to sub-techniques (adding or moving) than changing techniques.

We’re asking for continued feedback on technique and sub-technique pairings as well as any additional techniques or sub-technique ideas that help organize remaining techniques without sub-techniques.

New Contributions

We haven’t been adding technique, groups, or software contributions while we were implementing sub-techniques. This resulted in a decent sized backlog since the last update in October.

We will be working through that backlog now and are accepting contributions again for groups and software. Any new content to ATT&CK will only be added to the sub-technique version since it will be too difficult to maintain two different versions of ATT&CK. If you are contributing groups or software entries, we’d ask you to leverage the sub-technique version of ATT&CK.

Since sub-techniques will be in beta over several months, it’s likely that new contributions will be reflected within the version that goes live in July. We will determine at a later time if the changes are substantial enough that there needs to be an update while still in beta to allow for further review time.

What’s Next

With sub-techniques published in beta, the next two efforts we will focus on from our 2020 roadmap are revamping the Data Sources used by Enterprise and taking the next step to merge PRE-ATT&CK into ATT&CK.

©2020 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 19–01075–30.