What is MITRE ATT&CK; what do the MITRE ATT&CK and MITRE Post-Exploit fields in TR7 show?

Short answer

MITRE ATT&CK is a publicly available knowledge base, maintained by MITRE, of the adversary tactics and techniques observed in real attacks; it defines the stages of an attack, from reconnaissance to initial access and from command execution to data exfiltration, with technique codes such as T1190. TR7 maps WAF signatures to these techniques in two separate fields: the MITRE ATT&CK field shows the technique seen in the request itself, that is, at the moment of the attack; the MITRE Post-Exploit field shows the techniques expected to follow if the attack succeeds. The MITRE ATT&CK Coverage card in Signature & Rule Library and the MITRE ATT&CK filter in WAF Event Logs count the two fields together; the mitre field in the attack record sent to SIEM, however, carries only the techniques at the moment of the attack.

Where It Is Used in TR7

Where	Field / label	What for
WAF → Signature & Rule Library	The MITRE ATT&CK and MITRE Post-Exploit columns; the Classification tab of the rule preview	The techniques of a rule at the moment of the attack and after it
Signature & Rule Library	The MITRE ATT&CK Coverage card and the Filter group of the same name	The number of unique techniques found in the signatures; the two fields are counted together
WAF-Protected vService → Event Logs	The MITRE ATT&CK filter; the Summary tab of the preview	Filtering the records by technique; the filter lists the techniques at the moment of the attack and after it together
WAF Management → WAF Report	Classification → MITRE ATT&CK	The breakdown of the period's detections by technique
WAF Management → SIEM & Attack Details	Attack details in WAF info → MITRE ATT&CK (List)	Adding the mitre field to the record sent to SIEM; only the techniques at the moment of the attack are sent, and if the rule carries no technique, the value is null

In the rules in the LLM Prompt Injection category, these two fields carry, instead of a MITRE ATT&CK technique code, MITRE ATLAS technique codes (with the AML. prefix, e.g. AML.T0051), which define attacks aimed at artificial intelligence systems; the MITRE ATT&CK Coverage card and the filter also count these codes.

Common Misconceptions

• "MITRE ATT&CK is a signature set." It is a classification of tactics and techniques; TR7 maps its own signatures to these techniques.
• "The Post-Exploit field shows that the attack succeeded." It shows the techniques that can be expected if the attack succeeds; it does not mean that they occurred.
• "Post-Exploit techniques are also sent to SIEM." The mitre field in the SIEM record carries only the MITRE ATT&CK techniques at the moment of the attack; Post-Exploit techniques are seen in the interface.

Seeing the MITRE and other mappings of a rule: How do I see which OWASP Top 10, CWE, CAPEC and MITRE ATT&CK entries a rule maps to?

How it is done in the documentation

• Signature & Rule Library · The Library Summary Cards
• Signature & Rule Library · The Rules Listing Screen
• SIEM Attack Details · Attack Details in WAF Info

Related questions

• How do I see which OWASP Top 10, CWE, CAPEC and MITRE ATT&CK entries a rule maps to?
• Which attack fields are sent to the SIEM (score, severity, scope, name, category, CWE, MITRE, CAPEC, OWASP, target)?
• What is CWE; why does it appear in TR7 WAF logs and reports?