MITRE ATT&CK Tactics

What is MITRE ATT&CK?

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally recognized framework for understanding adversary behavior. It provides a common language for describing what attackers do and why.

Why MITRE ATT&CK Matters

Benefit	Description
Common Language	Security teams speak the same vocabulary
Threat Intelligence	Map detections to known attack patterns
Gap Analysis	Identify what you can and can’t detect
Reporting	Executive-friendly threat categorization
Compliance	Many frameworks reference ATT&CK

ATT&CK Structure

Tactics (WHY)    → Techniques (HOW)    → Procedures (SPECIFIC)
│                  │                     │
├── Reconnaissance │                     │
│   ├── Active Scanning ────────────────▶ Port scan with nmap
│   └── Gather Victim Info ─────────────▶ WHOIS lookup
│
├── Initial Access
│   ├── Exploit Public App ─────────────▶ SQL injection
│   └── Phishing ───────────────────────▶ Credential harvest
│
└── ... 12 more tactics

WebDecoy and MITRE

WebDecoy maps each detection to one MITRE ATT&CK tactic, to help you understand the intent behind the activity. The mapping is an interpretation of what was requested, not an observed technique.

---

MITRE Tactics in Detections

How the Tactic Is Assigned

When the API returns a detection, WebDecoy picks its tactic in this order:

1. A tactic the sensor supplied. The WordPress plugin tags its detections with mitre_tactic (and mitre_tactic_name) in metadata, from its own path analysis.
2. The decoy’s path. For a decoy hit, the decoy path is matched against patterns (login, admin, config file, backup file, debug endpoint, API endpoint, robots/sitemap, hidden form) to pick a decoy type.
3. The decoy type, when no path pattern matches.
4. The requested path of a detection with no decoy.
5. A generic Reconnaissance mapping as the fallback.

Attack signatures and behavior do not change the tactic.

Decoy Type Mappings

Decoy type	Tactic	Confidence
Login / authentication path	TA0006 Credential Access	High
Config or credentials file	TA0006 Credential Access	High
Admin path	TA0043 Reconnaissance	High
Hidden form field	TA0043 Reconnaissance	High
API endpoint	TA0043 Reconnaissance	Medium
robots.txt / sitemap	TA0043 Reconnaissance	Medium
Endpoint decoy	TA0043 Reconnaissance	Medium
Link decoy	TA0043 Reconnaissance	Low
Generic (fallback)	TA0043 Reconnaissance	Low
Backup file	TA0009 Collection	High
Debug / dev endpoint	TA0007 Discovery	High

A tactic supplied by the WordPress plugin is shown with Medium confidence.

What the API Returns

Each detection returned by the management API carries a mitre object:

{
  "mitre": {
    "tactic": {
      "id": "TA0006",
      "name": "Credential Access",
      "description": "...",
      "url": "https://attack.mitre.org/tactics/TA0006/"
    },
    "techniques": [
      { "id": "T1110", "name": "Brute Force", "tactic_ids": ["TA0006"], "url": "https://attack.mitre.org/techniques/T1110/" }
    ],
    "confidence": "high"
  }
}

techniques are candidate techniques associated with the mapping (the techniques listed for the decoy type, or every technique WebDecoy knows under the tactic when the tactic came from the sensor). They describe what that tactic commonly looks like, not a technique WebDecoy observed on this request.

Viewing MITRE Data in Detections

Open a detection: its detail panel has a MITRE ATT&CK section showing the tactic (click it to open the MITRE page) and the candidate techniques. The detections table does not have a MITRE column or filter.

Confidence Levels

Level	Meaning
High	The path or decoy type points clearly at the tactic
Medium	Probable match, or a tactic supplied by the sensor
Low	Generic fallback

---

Tactics WebDecoy Assigns

TA0043: Reconnaissance

Purpose: Gathering information about the target

Typical Detections:

• Accessing admin pages
• Probing API endpoints
• Reading robots.txt and sitemaps looking for hidden paths
• Filling hidden form fields
• Anything that matches no more specific mapping

TA0006: Credential Access

Purpose: Stealing account credentials

Typical Detections:

• Requests to login or password-reset decoys
• Requests for .env, wp-config, SSH keys and other credential files

TA0009: Collection

Purpose: Gathering data of interest

Typical Detections:

• Requests for backup files and database dumps (.sql, .bak, .zip)

TA0007: Discovery

Purpose: Figuring out your environment

Typical Detections:

• Debug and development endpoints (phpinfo, actuator, swagger, server-status)

---

Using MITRE Data for Analysis

Where MITRE data appears

• Each detection’s detail panel (tactic and candidate techniques).
• The mitre object on each detection returned by GET /api/organizations/{org_id}/detections and GET /api/organizations/{org_id}/detections/{detection_id}.
• GET /api/organizations/{org_id}/mitre/stats (optional property_id, days up to 365, default 30), which returns detection counts and percentages per tactic, aggregated by decoy type.
• The reference routes GET /api/mitre/tactics, /api/mitre/techniques and /api/mitre/mappings.

There is no dedicated dashboard widget.

Correlating with Threat Intelligence

MITRE tactics help you:

1. Research threats - Look up techniques on attack.mitre.org
2. Find mitigations - MITRE lists defenses for each technique
3. Share intelligence - Use standard tactic IDs in communications

Integration with SIEM

The MITRE mapping is part of the management API response. The Splunk, CrowdStrike, Datadog and webhook integrations do not include a mitre object or technique IDs in what they forward; see each integration page for the fields it sends. To add the tactic in your SIEM, look the detection up through the API by its detection_id.

---

MITRE Tactics Reference Table

For reference, the 14 ATT&CK Enterprise tactics. WebDecoy assigns only the four marked Yes.

ID	Name	Description	Assigned by WebDecoy
TA0043	Reconnaissance	Gathering victim information	Yes
TA0042	Resource Development	Setting up attack infrastructure	No
TA0001	Initial Access	Getting in	No
TA0002	Execution	Running malicious code	No
TA0003	Persistence	Maintaining access	No
TA0004	Privilege Escalation	Getting higher permissions	No
TA0005	Defense Evasion	Avoiding detection	No
TA0006	Credential Access	Stealing credentials	Yes
TA0007	Discovery	Learning the environment	Yes
TA0008	Lateral Movement	Moving through environment	No
TA0009	Collection	Gathering target data	Yes
TA0011	Command and Control	Communicating with implants	No
TA0010	Exfiltration	Stealing data	No
TA0040	Impact	Disruption and destruction	No