## MITRE ATT&CK Framework

**Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK)**.
It is the periodic table of hacker behavior. It moves us away from "My antivirus blocked a virus" to "The adversary used **T1059.001 (PowerShell)** to execute code."

### The Hierarchy
1.  **Tactics (The Goal - "Why")**: The column headers. There are 14 tactics.
    *   *Examples*: Initial Access, execution, Persistence, Privilege Escalation, Command and Control.
2.  **Techniques (The Method - "How")**: The cells in the column.
    *   *Example*: Under "Initial Access", you have "Phishing" (T1566) and "Exploit Public-Facing Application" (T1190).
3.  **Procedures (The Implementation - "Specifics")**: The exact command or tool used.
    *   *Example*: "APT33 sent a spearphishing email with a malicious HTA file."

### Deep Dive: Technique T1059 (Command and Scripting Interpreter)
This is one of the most common techniques.
*   **Sub-Techniques**:
    *   `.001 PowerShell`: Windows native automation tool. Loved by hackers because it is installed everywhere.
    *   `.004 Unix Shell`: Bash/Zsh on Linux/Mac.
*   **Detection**: You cannot just "Block PowerShell". You must look for *malicious use* of PowerShell (e.g., Encoded Commands, Downloads).

### Why use ATT&CK?
1.  **Common Language**: Red Team says "I validated T1059". Blue Team says "I detected T1059". Executive says "We are protected against Scripting attacks".
2.  **Gap Analysis**: You can map your defenses against the matrix. "We have great coverage for Malware (Execution) but zero coverage for Exfiltration".