What is MITRE ATT&CK and how do you use it in your work?
What the interviewer wants to hear
- Knowledge base of real adversary tactics and techniques
- Tactics are goals, techniques are methods
- Map alerts and incidents to techniques
- Find detection coverage gaps
- Use for threat intel, hunting and reporting
Model answer
MITRE ATT&CK is a free knowledge base of how real attackers behave, built from observed incidents. Tactics are the goals, like Initial Access, Persistence, Privilege Escalation or Exfiltration, and techniques and sub-techniques are the ways they achieve them, like T1566 Phishing or T1003 OS Credential Dumping. In the SOC I tag alerts and incidents with technique IDs, which gives everyone a common language and helps reports. I also use it to map our detection rules and see coverage gaps, for example if we have nothing for lateral movement through remote services. When threat intelligence says a group targeting our industry uses certain techniques, I check whether we can detect them and plan hunts. I keep in mind that coverage on a heatmap does not mean good detection, so rules still need testing.
Can you answer it under time pressure?
Take a timed medium round and get scored on every answer.
More medium Cybersecurity Analyst questions
- Walk me through how you triage a new SIEM or EDR alert.
- You have 2,000 open vulnerabilities from a scan. How do you decide what to fix first?
- You suspect a Microsoft 365 user account is compromised. How do you investigate and respond?
- Your SOC gets too many false positive alerts. How would you reduce alert fatigue without missing real attacks?
- How do you write an incident report that works for both technical teams and non-technical leaders?
- A network alert says a laptop may be beaconing to a command-and-control server. How do you investigate?
- How do you use threat intelligence in day-to-day SOC work without drowning in indicator feeds?
- A critical vulnerability is being exploited in the wild, but the affected system cannot be patched for weeks. What do you do?
- EDR raises an alert for a suspicious PowerShell command on a user's laptop. Walk me through your investigation.