## Using ATT&CK for Defense

How do we actually use this in the SOC?

### 1. Alert Enrichment
When an alert fires in the SIEM, tag it with the T-Code.
*   Bad: "Alert: PowerShell detected."
*   Good: "Alert: **T1059.001** PowerShell Execution detected."
*   Why? This allows you to run metrics later. "We saw 500 T1059 alerts this month."

### 2. Gap Analysis
*   "We have 50 SIEM rules."
*   Map them to ATT&CK.
*   "Oh, wait. 49 of them are for **Malware** (Execution), and 1 is for **Phishing**. We have ZERO rules for **Exfiltration**."
*   Action: Write rules for Exfiltration.

### 3. Adversary Emulation (Red Teaming)
*   Instead of just "pentesting" (finding random bugs), tell the Red Team: "Emulate **Fin7**."
*   The Red Team will look up Fin7's ATT&CK profile and use *only* those techniques.
*   This tests if your SOC can catch that specific threat actor.

### The Pyramid of Pain Connection
MITRE ATT&CK focuses on TTPs (The top of the pyramid). If you defend against Techniques (e.g., "Block all unsigned usage of PowerShell"), you stop *every* attacker who uses PowerShell, not just one specific script.