Defensive frameworks in cybersecurity record what attackers have already done. Analysts study a breach, document the method, and build detections around confirmed activity. This cycle leaves a gap between the moment an attacker invents a technique and the moment defenders learn to catch it.
PR3TACK, the Preemptive Tactics and Countermeasures Knowledgebase, aims to close that gap. Vishal Thakur of Atlassian built the open framework that catalogs plausible attacker tactics, techniques, and procedures that remain unobserved in the wild.
How PR3TACK differs from ATT&CK
The reference point is MITRE ATT&CK, the catalog many security teams use to align detection and response work. ATT&CK documents techniques confirmed in real intrusions. PR3TACK documents techniques that could emerge from current system weaknesses and attacker innovation patterns. MITRE D3FEND lists defenses for known techniques, and PR3TACK extends that idea toward threats that have yet to appear.
The framework points to attacks that caused real harm and stayed outside ATT&CK. Its materials name Atom Table abuse and the Revix ransomware family’s “kill-all-VMs” tactic as examples of working methods that stayed outside the observed-technique catalogs.
Three tiers of plausibility
Each submission sits in one of three tiers. High priority covers techniques proven through working proof-of-concept code. Medium priority covers techniques argued through technical reasoning and awaiting validation. Low priority covers techniques surfacing from academic research or ongoing investigation. The structure keeps entries anchored to demonstrable reasoning.
Seventeen tactic categories
The Seed Matrix, an early release, organizes entries across seventeen tactic categories. Several match familiar labels such as Execution, Persistence, and Lateral Movement. Others are original to the project. Pre-Positioning covers long-lead actions that prepare a target for later compromise, such as sleeper commits in open-source code. Resilience Erosion covers attempts to degrade recovery, including backup corruption and patch-process fatigue.
Governance Subversion covers manipulation of procurement, policy, and standards processes. Cognitive Manipulation targets the judgment of analysts through alert habituation and crafted logs. Digital Exhaust Manipulation weaponizes telemetry, threat feeds, and metadata to mislead defenders.
One cataloged technique, Execution via Peripheral Firmware Stagers, describes benign-seeming peripheral firmware that stages a payload once connected. Its listed defenses include firmware verification, device attestation, and vendor allowlisting. A second entry, Governance Subversion via Procurement Account Establishment, describes attackers setting up trusted vendor identities as long-term footholds, with supplier verification and procurement audits as countermeasures.
A tool for browsing the matrix
A Navigator tool presents the matrix as a visual, column-based grid. Each tactic forms a column, with its techniques listed beneath. Users can search and filter across tactics, techniques, platforms, and status, click into a technique to read detection ideas and mitigations, and upload custom JSON files to extend the matrix with their own entries.
An open contribution model
PR3TACK runs as a collaborative project open to practitioners, academics, and organizations. The intake process asks contributors for a technique description, a feasibility assessment, potential impact, and suggested preemptive defenses, with supporting proof-of-concept code encouraged.
Version 0.1 marks an early stage for the framework, and its value will depend on the volume and quality of community submissions over time.
Report: How to Implement a Continuous Offensive Security Testing Program