4.1. Attack Methodology Frameworks

💡 First Principle: Attack frameworks don't just describe what attackers do — they give defenders a shared language for communicating about threats, a structure for identifying defensive gaps, and a way to reason about attacker behavior even when specific indicators are unknown.

Without a framework, "the attacker got in and moved around" is the entire incident narrative. With a framework like MITRE ATT&CK, the same incident becomes: "Initial access via T1566.001 (spear-phishing attachment), persistence via T1053.005 (scheduled task), lateral movement via T1021.002 (SMB/Windows Admin Shares), exfiltration via T1041 (exfiltration over C2 channel)." The second description enables precise detection rule writing, precise gap analysis, and precise communication with technical and non-technical stakeholders.

⚠️ Common Misconception: The Cyber Kill Chain and MITRE ATT&CK describe the same thing. The Kill Chain provides a high-level linear model (7 stages from reconnaissance to actions on objectives). ATT&CK is a continuously updated, highly granular taxonomy of specific techniques organized by tactic — far more detailed and non-linear. They're complementary, not interchangeable.