logo

Attack Flow v1

This is Attack Flow Release v1. View the current release.

Project Summary

Published : Mar 3, 2022

Defenders typically track adversary behaviors atomically, focusing on one specific action at a time. While this is a good first step toward adopting a threat-informed defense, adversaries usually use multiple actions in sequence—we call these sequences attack flows. Toward the goal of visualizing, analyzing, and sharing attack flows, the Attack Flow project is developing a data format for describing sequences of adversary behaviors, a set of attack flow examples, and a GUI-based attack flow builder tool.

Problem

Defenders often track adversary behaviors atomically, focusing on one specific action at a time. This makes it harder to understand adversary attacks and to build effective defenses against those attacks.

SOLUTION

Built a language to describe sequences of adversary techniques (attack flows) and developed an Attack Flow Builder tool.

IMPACT

Help defenders and leaders understand how adversaries operate and compose atomic techniques into attacks to better understand defensive posture.

funding Research Participants

Non-Profit Research Participants

Share This Project

Stay Informed

Stay informed about new releases of R&D projects and other exciting updates from the Center for Threat-Informed Defense.