Attack Flow v1

This is Attack Flow Release v1. View the current release.

Project Summary

Published : Mar 3, 2022

Defenders typically track adversary behaviors atomically, focusing on one specific action at a time. While this is a good first step toward adopting a threat-informed defense, adversaries usually use multiple actions in sequence—we call these sequences attack flows. Toward the goal of visualizing, analyzing, and sharing attack flows, the Attack Flow project is developing a data format for describing sequences of adversary behaviors, a set of attack flow examples, and a GUI-based attack flow builder tool.

Problem

Defenders often track adversary behaviors atomically, focusing on one specific action at a time. This makes it harder to understand adversary attacks and to build effective defenses against those attacks.