Practical Threat Modeling with MITRE ATT&CK Framework

Traditional threat modeling focuses on identifying what can go wrong in a system. MITRE ATT&CK provides knowledge about how attackers specifically achieve their goals. Combining both approaches creates a powerful tool for building realistic protection.

Why STRIDE or PASTA Alone Isn’t Enough

Limitations of Classic Methodologies

Methodologies like STRIDE or PASTA work well for identifying threat categories, but have a significant limitation - they operate at an abstract level.

STRIDE Example:

Threat: Elevation of Privilege
Description: Attacker may gain higher privileges
Mitigation: Implement access control

That’s true, but not very helpful in practice. It lacks answers to questions:

• What specific techniques do attackers use for privilege escalation?
• Which ones are most commonly used in my industry?
• How do I detect attempts to use them?

What MITRE ATT&CK Brings

The ATT&CK framework fills these gaps:

Tactic: Privilege Escalation (TA0004)
Techniques:
├── T1548 - Abuse Elevation Control Mechanism
│   ├── .001 - Setuid and Setgid
│   ├── .002 - Bypass User Account Control
│   └── .003 - Sudo and Sudo Caching
├── T1134 - Access Token Manipulation
├── T1068 - Exploitation for Privilege Escalation
└── T1078 - Valid Accounts

For each technique:
- How it works
- Real attack examples
- Detection methods
- APT groups using the technique

📚 Read the complete guide: SOC: Security Operations Center - what it is, how it works, how to choose

Integrated Model: STRIDE meets ATT&CK

Mapping STRIDE Categories to ATT&CK Tactics

STRIDE	ATT&CK Tactics
Spoofing	Initial Access, Defense Evasion
Tampering	Execution, Persistence, Defense Evasion
Repudiation	Defense Evasion
Information Disclosure	Collection, Exfiltration
Denial of Service	Impact
Elevation of Privilege	Privilege Escalation, Lateral Movement

Extended Modeling Process

Classic modeling:
1. Define scope → 2. Draw DFD → 3. Identify threats (STRIDE) → 4. Assess risk → 5. Plan mitigations

Modeling with ATT&CK:
1. Define scope
2. Draw DFD
3. Identify threats (STRIDE)
4. ★ Map to ATT&CK techniques ★
5. ★ Profile potential adversaries ★
6. Assess risk with threat intelligence context
7. Plan mitigations including detection

Practical Methodology Step by Step

Step 1: Adversary Profiling

Before you start modeling threats, define who might attack you.

Example for a manufacturing company:

Potential adversaries:
┌─────────────────────────────────────────────────────────┐
│ 1. APT groups targeting industrial sector              │
│    - APT33 (Elfin) - energy, aviation industry         │
│    - APT34 (OilRig) - critical infrastructure          │
│    - Sandworm - OT/ICS systems                         │
├─────────────────────────────────────────────────────────┤
│ 2. Cybercriminals (ransomware)                         │
│    - LockBit, BlackCat - opportunistic attacks         │
│    - Techniques: phishing → lateral movement → impact  │
├─────────────────────────────────────────────────────────┤
│ 3. Insider threat                                       │
│    - Employees with OT system access                   │
│    - Techniques: Valid Accounts, Data from Local System│
└─────────────────────────────────────────────────────────┘

Step 2: Creating Threat Profile for a System

For each analyzed system, determine:

A. Attractiveness to attackers:

• What data does it process?
• Does it have access to other systems?
• Does it control physical processes?

B. Attack surface:

• External interfaces (API, web)
• Integrations with other systems
• Management channels (SSH, RDP)

C. Kill chain mapping:

System: Customer portal (web application)

Initial Access:
├── T1190 - Exploit Public-Facing Application
│   → OWASP Top 10 vulnerabilities
├── T1133 - External Remote Services
│   → Admin panel accessible from internet
└── T1566 - Phishing
    → Support staff as targets

Execution:
├── T1059 - Command and Scripting Interpreter
│   → Command injection possibility
└── T1203 - Exploitation for Client Execution
    → User browsers

Persistence:
├── T1505.003 - Web Shell
│   → Server threat
└── T1078 - Valid Accounts
    → Compromised user/admin accounts

Step 3: Detection Coverage Assessment

For each identified technique, verify:

Technique	Monitoring?	Data Sources	Gap?
T1190 - Exploit Public-Facing App	Partial	WAF logs	No SIEM correlation
T1505.003 - Web Shell	No	-	No file monitoring
T1078 - Valid Accounts	Yes	AD logs, SIEM	OK
T1059.001 - PowerShell	Partial	Endpoint	No script block logging

Step 4: Prioritization Based on Threat Intelligence

Use data from ATT&CK Navigator and threat intelligence:

Technique prioritization for manufacturing sector:

HIGH (frequently used by APTs):
├── T1566.001 - Spearphishing Attachment (90% of sector attacks)
├── T1486 - Data Encrypted for Impact (ransomware)
├── T1078 - Valid Accounts
└── T1021.001 - Remote Desktop Protocol

MEDIUM:
├── T1190 - Exploit Public-Facing Application
├── T1105 - Ingress Tool Transfer
└── T1059.001 - PowerShell

LOWER (less common in this sector):
├── T1195 - Supply Chain Compromise
└── T1200 - Hardware Additions

Tools Supporting the Process

ATT&CK Navigator

Coverage and priority visualization:

Layers to create:
1. "Our detections" - techniques we detect
2. "APT targeting manufacturing" - techniques of groups attacking our sector
3. "Gap analysis" - difference between 1 and 2 = priorities

Generating coverage map:

1. Export rule list from SIEM
2. Map to ATT&CK techniques
3. Import to Navigator as layer
4. Overlay threat intelligence layer
5. Identify gaps

Integration with Threat Modeling Tools

Microsoft Threat Modeling Tool + ATT&CK:

• Standard STRIDE templates
• Add custom properties with ATT&CK technique IDs
• Link to ATT&CK documentation in mitigation notes

OWASP Threat Dragon:

• Open-source alternative
• Ability to add ATT&CK tags
• Export to various formats

Practical Example: Online Payment System

Context

System: E-commerce payment gateway
Processed data: Card data (PCI DSS scope)
Interfaces: REST API, merchant panel, bank integration

Analysis with STRIDE + ATT&CK

Spoofing:

STRIDE Threat	ATT&CK Techniques	Specific Risk
Merchant impersonation	T1078.004 - Cloud Accounts	API account takeover
User impersonation	T1528 - Steal Application Access Token	Session token theft

Tampering:

STRIDE Threat	ATT&CK Techniques	Specific Risk
Transaction amount modification	T1565.001 - Stored Data Manipulation	Database parameter changes
Account number substitution	T1557 - Adversary-in-the-Middle	MITM in bank communication

Information Disclosure:

STRIDE Threat	ATT&CK Techniques	Specific Risk
Card data leak	T1005 - Data from Local System	Database dump
	T1041 - Exfiltration Over C2 Channel	Exfiltration via C2
API key leak	T1552.001 - Credentials In Files	Hardcoded secrets in code

Mitigation Plan with Detection Use Cases

Threat: T1078.004 - Merchant API account takeover
├── Prevention:
│   ├── MFA for merchant panel
│   ├── IP whitelisting for API calls
│   └── API key rotation every 90 days
├── Detection:
│   ├── Alert: login from new IP/geolocation
│   ├── Alert: sudden transaction volume spike
│   └── Alert: webhook configuration change
└── Response:
    ├── Automatic block after 3 alerts
    └── Merchant notification procedure

Effectiveness Metrics

Indicators to Track

Detection coverage:

Metric: % of ATT&CK techniques with working detection
─────────────────────────────────────────────────────
Q1 2024: 35% (42/120 techniques)
Q2 2024: 48% (58/120 techniques) ↑
Q3 2024: 61% (73/120 techniques) ↑
Target:  80%

Mean Time to Detect (MTTD):

Analysis per ATT&CK tactic:
Initial Access:     avg 4h (target: <1h)
Execution:          avg 2h (target: <30min)
Persistence:        avg 72h (target: <24h) ← priority
Exfiltration:       avg 6h (target: <1h)

Mitigation effectiveness:

Red team exercises - % blocked attacks:
├── Spearphishing:        78% (target: >90%)
├── Credential dumping:   45% (target: >80%) ← gap
├── Lateral movement:     62% (target: >80%)
└── Data exfiltration:    71% (target: >90%)

Organizational Implementation

Implementation Roadmap

Phase 1: Foundation (1-2 months)

• Team training on MITRE ATT&CK
• Mapping existing detections to framework
• First threat model with ATT&CK for critical system

Phase 2: Systematization (3-4 months)

• ATT&CK Navigator integration with threat modeling process
• Automated SIEM rules → ATT&CK techniques mapping
• Creating threat profile library for typical systems

Phase 3: Continuous Improvement (ongoing)

• Regular updates with new ATT&CK versions
• Purple team exercises based on profiles
• Feedback loop: incidents → model updates

Common Pitfalls

1. Trying to cover all techniques

❌ Wrong: "We need to detect all 200+ techniques"
✓ Right: "We prioritize 50 techniques most frequently
          used against our sector"

2. Lack of business context

❌ Wrong: Universal threat model for all systems
✓ Right: Customized risk profile per system
          considering business criticality

3. Static models

❌ Wrong: Threat model as a one-time document
✓ Right: Living document updated with system changes
          and threat landscape evolution

Summary

Combining threat modeling with MITRE ATT&CK brings measurable benefits:

• Realism - threats based on actual attacker techniques
• Prioritization - focus on techniques relevant to your sector
• Measurability - concrete coverage and effectiveness metrics
• Common language - standard terminology for security, IT, and business teams

The key is an iterative approach: start with critical systems, build team competencies, then scale the process across the organization.

---

Need support with threat modeling using MITRE ATT&CK? Contact us - we’ll conduct threat modeling workshops tailored to your organization’s specifics and industry.

---

Related Terms

Learn key terms related to this article in our cybersecurity glossary:

• Ransomware — Ransomware is a type of malicious software (malware) that blocks access to a…
• Security Operations Center (SOC) — Security Operations Center (SOC) is a central location where a team of security…
• SOC as a Service — SOC as a Service (Security Operations Center as a Service), also known as…
• Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
• Encryption — Encryption is the process of converting data from a human-readable format to…

---

Learn More

Explore related articles in our knowledge base:

• RidgeBot Uses MITRE ATT&CK Framework for Realistic Security Testing
• What is MITRE ATT&CK and how does it work? - Key elements
• Cyber Security Landscape 2024-2025: Evolving threats and attack vectors
• Cyber Vault from Dell Technologies
• Cybersecurity Trends in Poland 2023

---

Explore Our Services

Need cybersecurity support? Check out:

• Security Audits - comprehensive security assessment
• Penetration Testing - identify vulnerabilities in your infrastructure
• SOC as a Service - 24/7 security monitoring

Explore Our Products

Solutions mentioned in this article that can help protect your organization:

• RidgeBot — Ridge Security

Frequently asked questions

Why is STRIDE alone not enough for threat modeling?

STRIDE identifies threat categories at an abstract level but doesn't answer questions about specific attacker techniques, their frequency in a given industry, or detection methods. MITRE ATT&CK fills these gaps by providing knowledge about real-world techniques, APT groups, and attack detection methods.

How to combine STRIDE with MITRE ATT&CK in threat modeling?

The classic STRIDE process should be extended with mapping to ATT&CK techniques, profiling potential adversaries for a given sector, evaluating detection coverage per technique, and prioritization based on threat intelligence. Each STRIDE category maps to specific ATT&CK tactics.

How to measure the effectiveness of threat modeling with MITRE ATT&CK?

Key indicators include the percentage of ATT&CK techniques with working detection (target: 80%), Mean Time to Detect (MTTD) per ATT&CK tactic, and mitigation effectiveness measured by red team exercises — percentage of blocked attacks per technique.

Where to start implementing threat modeling with MITRE ATT&CK?

In the first phase (1-2 months), train the team on MITRE ATT&CK, map existing detections to the framework, and conduct the first threat model for a critical system. Then systematize the process with ATT&CK Navigator and automate SIEM rule mapping to ATT&CK techniques.