A new open framework, PR3TACK (Preemptive Tactics and Countermeasures Knowledgebase), aims to map potential attacker techniques before they are observed in active intrusions. Developed by Vishal Thakur of Atlassian, PR3TACK is designed to bridge the gap between the emergence of new attack methods and their documentation in defensive frameworks, which typically catalog techniques only after they have been used in real-world breaches.
Unlike MITRE ATT&CK, which focuses on documented techniques from confirmed intrusions, PR3TACK compiles plausible attacker tactics, techniques, and procedures (TTPs) that have not yet been seen in the wild. It also extends the concept of MITRE D3FEND, which lists defenses for known techniques, by proposing countermeasures for threats that have not yet materialized. The framework highlights examples of attacks that caused harm but remained outside observed-technique catalogs, such as Atom Table abuse and the Revix ransomware family's tactic of killing all virtual machines.
PR3TACK organizes submissions into three tiers based on their plausibility. High-priority techniques are those proven through working proof-of-concept code. Medium-priority techniques are supported by technical reasoning but await validation. Low-priority techniques emerge from academic research or ongoing investigations. This structure ensures that entries are anchored to demonstrable reasoning.
The initial release, known as the Seed Matrix, categorizes entries across seventeen tactic categories. Some of these align with familiar labels like Execution, Persistence, and Lateral Movement. However, several categories are original to the project. Pre-Positioning covers long-lead actions, such as sleeper commits in open-source code, that prepare a target for later compromise. Resilience Erosion addresses attempts to degrade recovery capabilities, including backup corruption and inducing patch-process fatigue. Governance Subversion involves manipulating procurement, policy, and standards processes. Cognitive Manipulation targets analysts' judgment through alert habituation and crafted logs. Digital Exhaust Manipulation weaponizes telemetry, threat feeds, and metadata to mislead defenders.
Specific techniques cataloged include "Execution via Peripheral Firmware Stagers," which describes benign-seeming peripheral firmware that stages a payload upon connection. Suggested defenses for this technique include firmware verification, device attestation, and vendor allowlisting. Another entry, "Governance Subversion via Procurement Account Establishment," details attackers setting up trusted vendor identities as long-term footholds, with supplier verification and procurement audits as recommended countermeasures.
A Navigator tool provides a visual, column-based grid for browsing the matrix. Each tactic forms a column, with its associated techniques listed below. Users can search and filter entries by tactics, techniques, platforms, and status. Clicking on a technique reveals detection ideas and mitigations. The tool also allows users to upload custom JSON files to extend the matrix with their own entries.
PR3TACK operates as a collaborative, open project, inviting contributions from practitioners, academics, and organizations. The intake process requires contributors to provide a technique description, a feasibility assessment, potential impact, and suggested preemptive defenses, with supporting proof-of-concept code strongly encouraged. Version 0.1 marks an early stage for the framework, and its long-term value will depend on the volume and quality of community submissions.
