Attack Pattern Domain

Overview#

The Attack Pattern domain provides attack pattern profiling based on the MITRE ATT&CK framework for cyber threats and a custom physical attack taxonomy for physical security threats. It maps adversary tactics, techniques, and procedures (TTPs), tracks kill chain phases, and provides defensive countermeasure recommendations, supporting both digital and physical security threat modeling in a unified framework.

Key Features#

• MITRE ATT&CK Integration -- Maps to official MITRE ATT&CK tactic and technique identifiers for standardized cyber threat categorization
• Physical Attack Taxonomy -- Custom framework for physical security threats including reconnaissance, breach techniques, and explosive device attacks
• Kill Chain Mapping -- Tracks attack patterns through Lockheed Martin Cyber Kill Chain phases from delivery through exploitation
• Defensive Countermeasure Mapping -- Links attack techniques to defensive measures with relationship types (mitigates, detects) and effectiveness strength ratings
• Threat Profiling -- Assesses adversary capabilities including sophistication level, target sectors, and known tool usage
• Investigation Linking -- Connects attack patterns to active investigations for case-specific threat analysis
• Multi-Domain Coverage -- Supports cyber, physical, and hybrid threat scenarios in a single system
• Defense-in-Depth Analysis -- Maps multiple defensive layers against attack techniques for comprehensive security assessment
• Tactic Auto-Population -- Automatically associates relevant tactics and techniques based on pattern configuration
• Control Type Classification -- Categorizes defenses as preventive or detective with physical and technical control type indicators

Use Cases#

• Threat intelligence analysts profile cyber attack patterns using MITRE ATT&CK identifiers, enabling standardized communication and correlation across teams and organizations.
• Physical security planners model threats against facilities using the physical attack taxonomy, identifying appropriate vehicle barriers, inspection checkpoints, and surveillance countermeasures.
• Investigators link attack patterns to active cases to track adversary TTPs and identify connections between related incidents across investigations.
• Security architects query defensive mappings to identify the most effective countermeasures for specific attack techniques, building layered defense strategies.
• Analysts conduct kill chain analysis to understand the progression of multi-stage attacks and identify optimal points for defensive intervention.

Integration#

The Attack Pattern domain integrates with the Threat Intelligence domain for intelligence ingestion, the Investigation domain for case management, the Entity Profile domain for structured profiling, and the MITRE ATT&CK framework for standardized technique identifiers.

Last Reviewed: 2026-02-05