MITRE ATT&CK for web

Why this matters

ATT&CK is the canonical taxonomy of what attackers actually do — derived from observed incidents, organised into tactics (the 'why') and techniques (the 'how'). For web work the relevant matrices are Initial Access, Credential Access, Lateral Movement, and Exfiltration. Mapping your detection coverage to ATT&CK techniques is how mature security teams prove they're not just patching whatever's loudest.

Demo

A real attacker chain on a web app might be: T1190 (Exploit Public-Facing Application) → T1071 (Application Layer Protocol C2) → T1003 (OS Credential Dumping) → T1041 (Exfiltration over C2). Each ID has a description, real-world examples, and recommended detections.

Try it yourself

1. Browse attack.mitre.org and pick three techniques relevant to web apps. Read the detections section for each.
2. For each, ask: 'would my logging catch this today?'. The honest answer is your detection gap.
3. Write one Sigma-rule-style detection idea for one technique. Compare to attack.mitre.org's suggestions.

Prompt your AI

Use these three in order. Each builds on the one before.

1. Basics & terminology

In one paragraph, describe ATT&CK and how it differs from a vulnerability list.

2. Why it works (the mechanism)

Walk me through using ATT&CK to plan a detection roadmap for a web product.

3. Advanced — application & what's next

Some critics argue ATT&CK over-emphasises post-exploit and under-emphasises initial access. Where do you agree, where not?

References

• MITRE ATT&CK
• ATT&CK Navigator