A common language is essential when communicating between different security teams. When Zscaler MDR uses a behavioral analytic to hunt for adversary behavior, or confirms threatening activity in your environment, it is important that you quickly understand what we’re communicating.
We found that the MITRE ATT&CK® taxonomy of behavioral techniques best fits our philosophy, so we exclusively use MITRE ATT&CK throughout Zscaler MDR (supplemented by our own techniques when appropriate, which we contribute back to MITRE ATT&CK).
How does Zscaler MDR use MITRE ATT&CK?
Many Zscaler MDR objects are mapped to MITRE ATT&CK to aid your understanding and response:
Each detection analytic (detector) is mapped to one or more MITRE ATT&CK techniques the analytic identifies.
A coverage heatmap allows you to understand the total technique coverage that Zscaler MDR contributes to your security program.
Potentially threatening events resulting from detection analytics show the set of MITRE ATT&CK techniques used to identify the event.
Confirmed threats (detections) published following the investigation of potentially threatening events show the set of MITRE ATT&CK techniques compiled from the underlying events.
Many reports and summary evaluations include MITRE ATT&CK as a dimension to help you understand what techniques are used in your environment (including a heatmap of techniques involved in confirmed threats).
What if Zscaler MDR identifies a technique that is not in MITRE ATT&CK?
If Zscaler MDR identifies an adversary technique that isn’t yet included in MITRE ATT&CK, we create a new technique identifier prefixed with RC (instead of the typical T prefix). We then submit that technique to the MITRE ATT&CK team. Once it is added to MITRE ATT&CK, we remove the RC prefix and replace it with the new identifier.
How can I see what MITRE ATT&CK techniques Zscaler MDR detects?
We provide a MITRE ATT&CK matrix heatmap that shows the technique coverage Zscaler MDR contributes to your security program.
Learn more about using MITRE ATT&CK heatmaps to understand Zscaler MDR’s threat coverage.
Does Zscaler MDR support MITRE ATT&CK sub-techniques?
Zscaler MDR has collaborated with the MITRE ATT&CK team throughout the definition of sub-techniques and is very excited about how they improve MITRE ATT&CK usage.