MITRE ATT&CK and Threat Hunting Basics

Step 1: Learn the structure: tactics, techniques, sub-techniques

Tactics are the attacker's goals at a stage of an attack, such as gaining initial access or stealing credentials. Techniques are how those goals are achieved, and many have more specific sub-techniques. Each technique has an identifier like T1566 for phishing, a description, real examples of groups and software that use it, detection ideas, and mitigations. The matrix is updated regularly, so always check the current version on attack.mitre.org.

Tactics (the why), in typical attack order:
Reconnaissance, Resource Development, Initial Access, Execution,
Persistence, Privilege Escalation, Defense Evasion, Credential Access,
Discovery, Lateral Movement, Collection, Command and Control,
Exfiltration, Impact

Example:  Initial Access -> Phishing (T1566) -> Spearphishing Attachment

Step 2: Use ATT&CK to describe incidents

When you investigate, map each observed action to a technique. This turns a confusing pile of events into a story: how the attacker got in, how they stayed, how they moved, and what they took. A shared vocabulary also makes reports, threat intelligence, and handoffs between teams clearer.

Step 3: Map your detections and find gaps

List the detection rules you have and tag each with the technique it covers. Many Sigma and Wazuh rules already carry ATT&CK tags. Then look at techniques commonly used against your kind of environment and see which have no coverage. The free ATT&CK Navigator web tool lets you color a matrix with your coverage and share it. Remember that having a rule for a technique does not guarantee detection of every variant of it.

Step 4: Form a hunting hypothesis

Threat hunting is proactively searching for attackers who have evaded alerts. Good hunts start with a hypothesis based on a technique, such as: an attacker who gained access may be using scheduled tasks for persistence. Then decide which data would show it, query the data, investigate anomalies, and record the result either way.

Hypothesis : An attacker may persist using scheduled tasks (T1053).
Data       : Process creation and task-creation events from endpoints.
Query idea : New tasks created outside change windows, by unusual users,
             or running from temp or user-writable folders.
Outcome    : Benign / Suspicious / Confirmed -> new detection or fix.

Step 5: Practice safely and turn hunts into detections

In your lab, you can run harmless, documented test behaviors and see whether your tools notice, which is the idea behind adversary emulation. Atomic Red Team provides small, documented tests mapped to ATT&CK techniques, to be used only on systems you own or are authorized to test, ideally isolated lab machines. When a hunt finds something useful, convert it into an automated detection so you do not have to hunt for it manually again.