Skip to content
Vol. 1 · Ed. 2026
CyberGlossary
Русский
Entry № 081

Attack Flow

Что такое Attack Flow?

Attack FlowA MITRE Engenuity Center for Threat-Informed Defense language and toolset for describing how adversaries chain techniques into multi-step operations, complementing ATT&CK's per-technique catalog with sequencing and decision logic.

Attack Flow is a STIX-extensible language and authoring tooling released by MITRE Engenuity's Center for Threat-Informed Defense in 2022, with version 2 in 2023. Its goal is to capture the missing piece between ATT&CK techniques and full incident narratives: how an adversary actually sequences techniques across an intrusion, including conditions, branches, and parallel paths. An Attack Flow document models an operation as a directed graph of `attack-action` (a technique execution) and `attack-condition` nodes, with linked `attack-asset` (targeted resources) and `attack-operator` (AND/OR/XOR) elements. The CTID publishes a public corpus of Attack Flows for real incidents (Conti, SolarWinds, NotPetya, Triton, REvil, etc.) and ships a web-based authoring tool (Attack Flow Builder). Use cases include threat-intelligence sharing in a machine-readable form richer than ATT&CK alone, building synthetic intrusion narratives for detection engineering, and helping defenders reason about which techniques to disrupt to break a likely chain.

● Примеры

  1. 01

    A CTI team publishes an Attack Flow document for a recent intrusion showing how phishing, credential theft, AD enumeration, and ransomware deployment were chained.

  2. 02

    A detection-engineering exercise picks the highest-cost node in a target Attack Flow and writes the alert that would break the chain there.

● Частые вопросы

Что такое Attack Flow?

A MITRE Engenuity Center for Threat-Informed Defense language and toolset for describing how adversaries chain techniques into multi-step operations, complementing ATT&CK's per-technique catalog with sequencing and decision logic. Относится к категории Защита и операции в кибербезопасности.

Что означает Attack Flow?

A MITRE Engenuity Center for Threat-Informed Defense language and toolset for describing how adversaries chain techniques into multi-step operations, complementing ATT&CK's per-technique catalog with sequencing and decision logic.

Как работает Attack Flow?

Attack Flow is a STIX-extensible language and authoring tooling released by MITRE Engenuity's Center for Threat-Informed Defense in 2022, with version 2 in 2023. Its goal is to capture the missing piece between ATT&CK techniques and full incident narratives: how an adversary actually sequences techniques across an intrusion, including conditions, branches, and parallel paths. An Attack Flow document models an operation as a directed graph of `attack-action` (a technique execution) and `attack-condition` nodes, with linked `attack-asset` (targeted resources) and `attack-operator` (AND/OR/XOR) elements. The CTID publishes a public corpus of Attack Flows for real incidents (Conti, SolarWinds, NotPetya, Triton, REvil, etc.) and ships a web-based authoring tool (Attack Flow Builder). Use cases include threat-intelligence sharing in a machine-readable form richer than ATT&CK alone, building synthetic intrusion narratives for detection engineering, and helping defenders reason about which techniques to disrupt to break a likely chain.

Как защититься от Attack Flow?

Защита от Attack Flow обычно сочетает технические меры и операционные практики, как описано в определении выше.

Какие есть другие названия Attack Flow?

Распространённые альтернативные названия: MITRE Attack Flow, Attack Flow Language.

● Связанные термины