MITRE and TLCTC: The Triangle That Never Closed

The three pages

The thesis we tested

This page began with a thesis of our own: that the three catalogues once formed a closed triangle, and that ATT&CK broke it when it expanded beyond software exploitation into living-off-the-land behaviour. It sounds right. It did not survive contact with the sources.

Part of the intuition holds: most of ATT&CK does not describe broken software. But the chronology runs the other way, the links never formed a closed structure, and the links that exist do not sit where the thesis predicted. The triangle was not broken by ATT&CK’s growth. On the available evidence, it never closed.

Three separate origins

ATT&CK did not begin in exploitation and drift towards native tools. It began after the compromise, and its 2018 extension moved it towards the initial exploit. MITRE’s design paper states the focus directly: “Behavior-based techniques are the focus as opposed to exploits and malware.”[2]

MITRE’s own comparison describes the two as focused on different use cases, CAPEC on application security and ATT&CK on network defense, with entries “cross referenced when appropriate”.[5] That is a looser claim than a triangle. We found no MITRE document that describes a designed three-way closure, though we cannot rule out that one exists.

The links, measured

A triangle has three sides. We counted each one in the current data.[6]

Three results follow.

• CWE and ATT&CK do not connect directly. Between the catalogues, the only path runs through CAPEC, so the structure is a chain with a middle link, not a triangle. A second route exists at the level of individual vulnerabilities: a CVE record can carry a CWE and, optionally, an ATT&CK mapping.[9] That connects one vulnerability to a weakness and a technique. It does not connect the catalogues’ entries in general, and it only covers behaviour tied to a CVE.
• ATT&CK has stopped pointing at CAPEC. In Enterprise v12.1, 104 of 594 active techniques carried a CAPEC reference. In v13.0 the figure is 0 of 607. The 36 references still in the data sit on revoked or deprecated entries. The count was also flat before that: it was already 104 in v8.2, when ATT&CK had 530 active techniques.
• The chain is incomplete. Following CAPEC 3.9’s own ATT&CK references, 179 of 706 active techniques reach a pattern and 167 (23.7%) reach a weakness.

We do not know why the references were removed. The April 2023 release notes do not mention CAPEC, so we report the change without assigning a motive.

Where the links sit, and what they say

The thesis predicts that links cluster around exploitation and fade out after the compromise. Coverage per tactic does not show that pattern. Initial Access is highest, but Lateral Movement, Collection, Credential Access and Discovery are close behind.

Individual chains are more telling than the totals. Discovery techniques that use a system as designed have chains. Of the ten active techniques with “exploit” in their names, eight have none. The exceptions are T1211, through a pattern specific to Thunderbolt protection flaws (CAPEC-665), and T1499.004, through Forced Deadlock (CAPEC-25).

The missing exploitation links are consistent with how ATT&CK treats exploits. In its design paper, MITRE works through SQL injection and files it as a detail of Exploit Public-Facing Application, adding that “additional resources can be cited as needed, such as CAPEC, CWE, OWASP”.[2]

The discovery chains show a different problem. T1087 leads to CWE-200, Exposure of Sensitive Information to an Unauthorized Actor, and CWE-200 is the most frequent endpoint across all chains, reached by 25 techniques. CWE’s own mapping guidance marks it Discouraged and explains why:

So the chain that appears to give account discovery a weakness ends at an entry CWE itself says describes an impact. This is not isolated. Of the 167 techniques with a chain, 92 reach at least one Discouraged weakness, 40 reach only Discouraged weaknesses, and 17 reach CWE-200 alone. CAPEC’s links date from January 2023 and the verdicts from CWE 5.0, so the links may predate the current guidance. The result stands either way: following the links does not reliably lead to a cause.

The question none of them asks

None of this is a failure of the catalogues. Each answers its own question well, and none of them was built to answer the question a risk owner has to ask.

Running whoami exploits no flaw, so a flaw catalogue has no natural entry for it. That does not make it causeless. In TLCTC, the generic vulnerability of #1 Abuse of Functions is “the inherent trust, scope, and complexity designed into software functionality and configuration”. “No flaw” and “no vulnerability” are different statements, and our original thesis ran them together.

Our ATT&CK mapping shows the scale. Of 698 mapped techniques, 499 name #1 and only 14 name #2 or #3. Chain coverage barely separates them: 23.9% for the 176 techniques that map to #1 alone, and 28.6% for those 14, too few to read much into. A link can exist or be absent without saying anything about the cause.

TLCTC therefore does not try to close the triangle. As the core paper sets out, techniques, patterns and weaknesses all attach beneath the clusters at the operational layer.[8] Each entry is classified by the generic vulnerability it exploits in context, which gives all three catalogues one axis to meet on.

What these numbers can and cannot show

• Exact identifiers. Chains match exact technique IDs, so a parent technique does not inherit links from its sub-techniques, or the reverse.
• Enterprise only. We did not measure ATT&CK Mobile or ICS.
• Link counts are not quality scores. A missing link may be an omission and not a judgement.
• Our mappings lag and are not independently validated. The ATT&CK and CWE mappings are AI-generated and human-reviewed, and record TLCTC v2.6 classifications. Against ATT&CK v20, 24 of our 698 ATT&CK entries are no longer active and 32 active techniques are not yet mapped. The per-tactic table uses v20 tactics, including Stealth and Defense Impairment; the mapping still uses the earlier tactic names.
• CAPEC’s status. CAPEC’s site lists 3.9 as the latest version. We found no retirement notice, so we describe it as unchanged, not as retired.

Elsewhere in the MITRE corpus

• ATLAS: MITRE ATLAS and TLCTC and the mapping tool.
• D3FEND: The Missing Axis.
• STIX: Enhancing threat intelligence with STIX, ATT&CK and TLCTC.
• CWE taxonomy: Why MITRE CWE needs taxonomic discipline.
• Kill chain: CKC, ATT&CK and TLCTC synthesis.