PR3TACK: the preemptive framework that anticipates attacks before they happen

PR3TACK: the preemptive framework that anticipates attack tactics

The PR3TACK framework, developed by Vishal Thakur of Atlassian, introduces an innovative approach to cybersecurity by closing the gap between the invention of an offensive technique and its detection by defenders. Unlike traditional frameworks that only document observed techniques, PR3TACK catalogs potential tactics, techniques, and procedures that may emerge from current vulnerabilities and attacker innovations.

Quick Response

A proactive catalog of future threats

While MITRE ATT&CK focuses on techniques confirmed in real intrusions, PR3TACK aims to document techniques that could emerge from systemic weaknesses and attacker innovations. The framework includes examples of techniques such as abusing Atom Tables and the "kill-all-VMs" tactic of the Revix ransomware family, both effective techniques that have remained outside traditional observed catalogs.

Three priority levels for structured assessment

PR3TACK organizes techniques into three priority levels: high, medium, and low. High-priority techniques are supported by working proofs-of-concept, medium-priority techniques require further validation, and low-priority techniques derive from academic research or ongoing investigations. This structure ensures that each technique is anchored to a demonstrable and reasoned basis.

Seventeen tactical categories for comprehensive coverage

The framework uses the Seed Matrix, an initial version organized into 17 tactical categories. Some categories are familiar, such as Execution, Persistence, and Lateral Movement. Others are innovative, such as Pre-Positioning, which covers long-term actions to prepare a target, and Erosion of Resilience, which includes techniques to degrade recovery capabilities such as backup corruption and patching process fatigue.

Innovative techniques and countermeasures

One of the cataloged techniques, Execution via Peripheral Firmware Stager, describes the use of seemingly benign peripheral firmware that loads a payload once connected. Suggested defenses include firmware verification, device attestation, and vendor allowlisting. Another technique, Governance Replacement via Procurement Account Establishment, describes the establishment of trusted vendor identities as long-term footholds, with countermeasures such as vendor verification and procurement auditions.

A tool to navigate and contribute to the framework

The Navigator tool presents the matrix as a visual grid, allowing users to search and filter tactics, techniques, platforms, and states. Users can click on a technique to read detection ideas and mitigations, and upload custom JSON files to extend the matrix with their own entries. This collaborative approach is fundamental to the framework's success, as its usefulness will depend on the quality and quantity of community contributions.

An open-source project in continuous evolution

PR3TACK is a collaborative project open to practitioners, academics, and organizations. The contribution process requires a technique description, a feasibility assessment, a potential impact, and preemptive defenses, with supporting proofs-of-concept encouraged. Version 0.1 represents an initial phase, and the framework's value will grow with increased community contributions.

Implications for security teams

The adoption of PR3TACK could transform how security teams prepare for attacks. By anticipating potential techniques, organizations can develop defenses before attackers implement them, reducing the threat reaction cycle. This proactive approach is particularly useful for companies operating in high-risk sectors or handling sensitive data.

Integration with other frameworks

PR3TACK does not replace MITRE ATT&CK or MITRE D3FEND but integrates them, offering a more comprehensive view of threats. While ATT&CK documents confirmed techniques and D3FEND provides defenses for these techniques, PR3TACK extends the horizon towards future threats, creating a more robust and preemptive security ecosystem.

Challenges and opportunities

One of the main challenges for PR3TACK is maintaining the accuracy and relevance of the cataloged techniques. With the continuous evolution of threats, the framework will need to be regularly updated to reflect new trends and attacker innovations. However, the open-source and collaborative approach of the project offers a unique opportunity for the security community to shape its future.