What is the purpose of MITRE ATT&CK and how is it used in threat modeling?

• A. It's a knowledge base of adversary behaviors used to model and detect tactics, techniques, and procedures; used to map detections, gap analysis, and mitigation prioritization.
• B. It's a dynamic firewall rule set for network segmentation.
• C. It's a software development framework for secure coding.
• D. It's a vulnerability scanner for asset discovery.

Answer: (A)

MITRE ATT&CK is a comprehensive knowledge base of adversary behaviors organized as tactics, techniques, and procedures. In threat modeling, you use it to describe how an attacker might operate in your environment by mapping potential steps to ATT&CK techniques. This helps you understand what to monitor, how an attacker could progress, and where defenses may be weak. By aligning current detections, controls, and investigation playbooks to these techniques, you can identify gaps where no coverage exists and then prioritize mitigations and detections for the most likely or impactful techniques. ATT&CK also provides a common language for red teaming and adversary emulation, making it easier to test defenses against realistic attack sequences. It’s not a dynamic firewall rule set, not a software development framework, and not a vulnerability scanner.