PreATTCK

PREATTACK, commonly written PRE-ATT&CK, is a knowledge base published by MITRE that documents attacker behaviors and techniques that occur before an initial compromise of a target organization. It is designed to capture the activities threat actors perform prior to gaining access to systems or networks, including information gathering, target selection, and capability development.

Scope and structure: The framework organizes pre-attack techniques into categories describing stages before initial access. Each technique provides a description, potential attacker goals, and example scenarios. The knowledge base is intended to be used in conjunction with the ATT&CK framework, enabling defenders to model threats at the pre-breach stage and identify preventive controls.

Relation to ATT&CK and usage: PRE-ATT&CK complements ATT&CK by filling the pre-incident gap, and mapping between PRE-ATT&CK techniques and ATT&CK post-access techniques helps security teams understand how an attack may progress and where to intervene. It supports threat modeling, risk assessment, red-teaming, security awareness, and detection engineering.

Examples and scope: Common pre-attack activities described include reconnaissance, resource development (acquiring infrastructure and tools), social engineering setup, infrastructure preparation such as domain registration or hosting, and planning or rehearsing attack sequences. The framework is regularly updated as new threat actor behaviors are observed.

Accessibility and context: PRE-ATT&CK is publicly available through MITRE and is used by researchers and practitioners to inform defensive strategies. It is one part of MITRE’s broader ATT&CK ecosystem, which also includes post-compromise techniques and defense-oriented resources.