Attack Pattern.

An attack pattern is an abstract, structured description of an adversary's approach — the steps, prerequisites, and weaknesses involved in a class of attacks rather than a single exploit. The MITRE CAPEC catalogue (Common Attack Pattern Enumeration and Classification, currently version 3.9) contains over 550 patterns organised into a hierarchy of meta, standard, and detailed abstractions. For example, CAPEC-66 "SQL Injection" targets the weakness CWE-89, and CAPEC-63 "Cross-Site Scripting" maps to CWE-79. Each pattern records prerequisites, attacker skill level, likely consequences, and — crucially — recommended mitigations, so a defender can move from "we saw this technique" to "here is the design change that neutralises the whole class."

In threat modelling and detection engineering, attack patterns sit one layer above MITRE ATT&CK techniques and provide common vocabulary for purple-team exercises, secure-design reviews, and threat-intelligence sharing in STIX/TAXII (STIX 2.1 even defines an attack-pattern object type). They let teams generalise from a single incident to a recurring class of behaviour worth detecting and preventing — CAPEC's explicit CWE links close the loop from an observed technique back to the root code weakness engineers must fix, while its mitigation fields feed straight into secure-design requirements.

flowchart TD
  A[Observed incident] --> B[Map to ATT&CK technique]
  B --> C[Match CAPEC attack pattern]
  C --> D[Linked CWE weakness]
  C --> E[Recommended mitigations]
  D --> F[Fix root cause in code]
  E --> G[Build detection rule]
  F --> H[Whole class neutralised]
  G --> H