What is the MITRE ATT&CK framework used for in blue team activities?

• A. To categorize attacker tactics, techniques, and procedures, map detections to known attack patterns, and guide threat hunting and defensive controls
• B. To manage user accounts and passwords
• C. To design network topology
• D. To encrypt data at rest

Answer: (D)

MITRE ATT&CK is a knowledge base of attacker tactics and techniques that blue teams use to understand how adversaries operate. In practice, it helps you categorize what attackers do, map your detections to those known patterns, and guide threat hunting and defensive controls so you can anticipate and stop phases of an intrusion. This framework focuses on attacker behavior across stages like initial access, execution, discovery, lateral movement, and exfiltration, which makes it a powerful tool for building detection coverage and coordinating responses.

The option describing encryption of data at rest would be about data protection measures, not about understanding attacker behavior or guiding defenses. The other options—managing user accounts, designing network topology—lie outside the framework’s purpose.