The PR3TACK Initiative: Building the World’s First Preemptive Tactics & Countermeasures Knowledgebas

The PR3TACK Initiative: Building the World’s First Preemptive Tactics & Countermeasures Knowledgebase

Speakers: Vishal Thakur, Lead Incident Response (Atlassian)

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=6dbQicBAx8s

Overview

In an era where cyber threats evolve at an unprecedented pace, the security community often finds itself in a reactive posture, responding to attacks only after they have been observed and reported. Vishal Thakur, Lead Incident Response at Atlassian, introduced The PR3TACK Initiative at FIRSTCON, a groundbreaking effort aimed at shifting this paradigm. PreTAC, an acronym for Preemptive Tactics & Countermeasures Knowledgebase, is an open-source, community-driven framework designed to identify, document, and share plausible adversary Tactics, Techniques, and Procedures (TTPs) before they are actively exploited in the wild.

Thakur highlighted a critical gap in existing threat intelligence frameworks, such as MITRE ATT&CK, which primarily catalog TTPs that have already been reported and observed. PreTAC seeks to bridge this gap by focusing on "adjacent possible" TTPs—those that are technically feasible and likely to emerge, but have not yet been weaponized or widely detected. The initiative empowers incident response teams to develop proactive defenses, mitigations, and detections, ensuring readiness for future threats rather than simply reacting to past ones. This proactive approach not only enhances an organization's security posture but also provides a tangible way for security leaders to demonstrate foresight and resilience to their stakeholders.

The core motivation behind PreTAC stems from Thakur's own experience in leading technical research teams and observing the disconnect between theoretical security frameworks and practical, preemptive defense. By fostering a collaborative environment where novel TTPs can be shared and validated, PreTAC aims to elevate the entire security industry from a "good" reactive state to a "great" preemptive one, ultimately reducing the impact of emerging cyberattacks.

Background

▶ Watch: Introduction and the core problem of untracked threats (0:00)

Vishal Thakur, drawing from his extensive background in leading reverse engineering research teams and incident response functions at major tech companies like Salesforce and Atlassian, articulated a common frustration within the cybersecurity industry: the predominantly reactive nature of defense. He observed that while frameworks like MITRE ATT&CK are invaluable for understanding and mapping known adversary behaviors, they inherently operate on reported incidents. This leaves a significant blind spot for emerging, plausible TTPs that have not yet been observed in the wild but are technically viable.

The genesis of PreTAC can be traced back to a conversation Thakur had at FIRST Copenhagen, where he and his colleagues discussed highly effective, plausible TTPs that warranted tracking. When they approached representatives from MITRE, the response underscored the problem: these TTPs couldn't be tracked because they hadn't been formally reported or observed "in the wild." This revelation highlighted a fundamental limitation: if a TTP hasn't been used yet, or if the threat actor employing it has been apprehended, it often falls outside the scope of traditional tracking mechanisms, even if the underlying technique remains valid and reproducible.

Thakur provided two concrete examples illustrating this gap. The first was atom table abuse, a TTP that was successfully demoed at Black Hat, achieving full execution and bypassing various defenses, yet was not being tracked by any major framework at the time. The second example involved the ReVil ransomware's pivot to Linux, where the TTPs were made public through research but were subsequently not tracked by a prominent framework because the threat actor group had been shut down. Thakur emphasized that the apprehension of an adversary does not negate the continued viability of their TTPs, which can be adopted by new groups. These instances solidified the need for a framework that proactively captures and shares such plausible, yet unobserved, TTPs, moving the industry towards an anticipatory layer of defense.

Key Findings

▶ Watch: Real-world examples of plausible, untracked TTPs (7:05)

The central finding presented by Vishal Thakur is the successful conceptualization and initial implementation of PreTAC, the world's first Preemptive Tactics & Countermeasures Knowledgebase. This initiative fundamentally shifts the focus of threat intelligence from purely reactive analysis of observed attacks to a proactive anticipation of future threats. The key findings and contributions of PreTAC include:

1. Bridging the Proactive Gap: PreTAC directly addresses the void left by existing frameworks like MITRE ATT&CK and D3FEND, which primarily document TTPs after they have been reported and observed. PreTAC explicitly targets TTPs that are "plausible" and "waiting to happen" but have not yet manifested in real-world attacks.
2. Community-Driven Open-Source Framework: The initiative is designed as an open-source, community-driven project, with its initial version publicly released on GitHub at the time of the talk. This fosters collaborative research and sharing of novel TTPs and their associated countermeasures. The project can be found at pret.org.
3. Validation and Plausibility over Speculation: A critical aspect of PreTAC is its rigorous validation process. Unlike mere speculation, TTPs submitted to PreTAC undergo scrutiny to confirm their technical plausibility and often require working Proofs of Concept (PoCs) for higher priority submissions. This ensures that the knowledge base contains actionable and realistic threat intelligence.
4. Emphasis on Countermeasures: A core ethical policy of PreTAC dictates that no TTP will be publicly published without accompanying detections, mitigations, or other countermeasures. This ensures that the framework provides immediate defensive value, allowing organizations to implement protections before an attack occurs. Information without countermeasures is shared under TLP Red or an internal TLP Black (invitation-only) for core members.
5. Anticipatory Defense Capability: PreTAC enables organizations to establish an anticipatory layer in their security operations. By documenting potential TTPs and their defenses, security teams can tell leadership, "We've got it covered," even for novel threats. This preemptive capability allows incident responders to measure success not by how well they react, but by how often they prevent or pre-mitigate incidents.
6. Initial Framework and Tools: The project has already released a seed matrix of techniques and a navigator (a visual grid similar to ATT&CK Navigator) to help users explore the knowledge base. At the time of the talk, the number of tracked techniques had grown rapidly from an initial 34 to "way over 40," with a corresponding increase in documented detections.
7. AI Integration for Scalability: PreTAC has already begun integrating Artificial Intelligence (AI) internally. An AI agent pre-loaded with PreTAC knowledge has been developed to quickly identify TTPs, spot gaps in defenses, and assist in generating detections. The roadmap includes further AI/ML expansion to automate and scale TTP discovery and countermeasure development.

Technical Deep Dive

▶ Watch: Ensuring plausibility, not speculation, for TTP submissions (14:30)

The PreTAC (Preemptive Tactics & Countermeasures Knowledgebase) initiative introduces a structured, technical approach to proactive cybersecurity. At its core, PreTAC is an open-source framework designed to capture and disseminate knowledge about plausible TTPs that have not yet been widely observed in the wild. This distinguishes it from frameworks like MITRE ATT&CK, which primarily focuses on reported TTPs. Vishal Thakur emphasized that PreTAC is not a competitor but a complement to existing frameworks, bridging a crucial gap in the threat intelligence lifecycle.

The framework's structure and operational methodology are designed to ensure the quality and actionability of its content:

1. TTP Identification and Submission:

PreTAC seeks contributions of novel TTPs that are technically feasible. These can originate from internal research, academic studies, or even red team exercises. The submission process involves providing details about the TTP, how it works, and any existing Proofs of Concept (PoCs). Submissions are currently accepted via email ([email protected]) or through a dedicated Jira instance for a more structured approach.

2. Plausibility and Prioritization:

A key differentiator for PreTAC is its focus on plausibility rather than mere speculation. When a submission is received, the PreTAC core team assigns a priority level:

• High Priority: These submissions include a "full P" (fully working Proof of Concept) demonstrating the TTP's functionality and exploitability. This could involve an actual exploit or a detailed mechanism of use. For example, the atom table abuse TTP, which was successfully demoed at Black Hat to bypass defenses and achieve execution, would fall into this category.
• Medium Priority: These are based on strong hypotheses and reasoning, where a fully working PoC might not exist yet, but the technical viability is clear, and the TTP could likely work with further development or combination with other techniques.
• Low Priority: Primarily encompasses academic research or theoretical concepts that show potential but require more foundational work to become actionable TTPs.

Thakur stressed that these priority levels are for the core team's processing efficiency and do not diminish the inherent value of any submission, as academic research often forms the basis for future high-priority TTPs.

3. The PreTAC Matrix and Navigator:

Similar to MITRE ATT&CK, PreTAC utilizes a structured matrix to categorize and visualize TTPs. This seed matrix covers various tactics, some of which overlap with ATT&CK (less than half), while others are entirely new and specific to preemptive concerns. At the time of the talk, the matrix had rapidly expanded from around 34 techniques to over 40 techniques within a few weeks, with a corresponding increase in detections.

A navigator tool is also available, providing a visual grid interface for exploring techniques, similar to the ATT&CK Navigator, allowing users to quickly identify relevant TTPs.

4. Ethical Policy and Disclosure:

PreTAC operates under a strict ethical policy: no TTP is publicly published on the pret.org website or GitHub repository unless corresponding countermeasures (detections, mitigations, or defenses) are also available. This ensures that the shared knowledge is immediately actionable for defenders.

If a TTP is submitted without available countermeasures, it is still accepted but shared internally with core members under TLP Red or a stricter, invitation-only TLP Black designation. This controlled sharing allows the community to develop defenses before public disclosure, preventing adversaries from exploiting newly revealed techniques without immediate defensive guidance.

5. AI/ML Integration and Future Vision:

An ambitious aspect of PreTAC's technical roadmap involves deep integration of Artificial Intelligence (AI) and Machine Learning (ML). Internally, an AI agent has already been developed and pre-loaded with PreTAC's knowledge. This agent assists the core team by:

• Rapidly identifying TTPs.
• Pinpointing gaps in existing defenses.
• Accelerating the development of new detections.
• Analyzing large datasets of historical security incidents to find overlaps with PreTAC TTPs, as demonstrated by an internal "retro" exercise that revealed numerous previously uncaptured but relevant TTPs.

The long-term vision is to leverage AI to expand the framework itself, using ML to proactively discover new TTPs, generate PoCs, and even suggest scalable detections. Thakur referenced concepts like "Glasswing Mythos" to illustrate the desired level of advanced, automated threat intelligence generation. This AI-driven expansion aims to make the framework more scalable and dynamic in anticipating future threats.

6. Complementary Relationship with Existing Frameworks:

PreTAC is explicitly designed to complement existing frameworks. Once a TTP documented in PreTAC is observed in the wild and meets the criteria of MITRE ATT&CK, it will be migrated to ATT&CK (and its defenses to D3FEND). However, the TTP will remain in PreTAC, tagged appropriately, to maintain a historical repository and continuity. This ensures that PreTAC serves as a leading-edge intelligence source that feeds into the broader threat landscape.

Demo / Proof of Concept

▶ Watch: PreTack's ethical policy: countermeasures required for publication (18:00)

While the FIRSTCON talk itself did not feature a live, interactive demonstration of the PreTAC framework in action, Vishal Thakur explicitly highlighted the critical role of Proof of Concepts (PoCs) and previous demonstrations in validating PreTAC's approach.

Thakur referred to a specific example: atom table abuse. This particular TTP, which demonstrates a method for bypassing security controls and achieving execution, was not only identified as a plausible, unobserved technique but was also successfully demoed at Black Hat by his team. This demonstration involved showcasing how the technique could bypass various defenses and achieve arbitrary code execution. This real-world, public demonstration of a novel TTP underscored the validity of PreTAC's focus on plausible, yet untracked, techniques.

Furthermore, Thakur explained that the submission process for PreTAC explicitly values and, for high-priority submissions, often requires a "full P" (fully working PoC). This ensures that the TTPs incorporated into the knowledge base are not mere speculation but are technically sound and reproducible. He stated that for a TTP to be published on PreTAC, "it's basically definitely out there. We've checked it out. People have done PoCs on it and... it's in a working condition at that point in time."

Therefore, while the audience at FIRSTCON did not witness a live PreTAC-specific demo, the talk strongly conveyed that the framework is built upon a foundation of validated, demonstrable attack techniques, with the Black Hat atom table abuse demo serving as a prime example of the type of TTPs PreTAC aims to preemptively address.

Defensive Implications

▶ Watch: Q&A: Transitioning PreTack TTPs to MITER Attack (36:50)

The PreTAC initiative offers profound defensive implications for organizations striving to mature their cybersecurity posture beyond traditional reactive models. By providing a structured approach to preemptive threat intelligence, PreTAC empowers defenders in several key ways:

1. Shift to Preemptive Defense: The most significant implication is the ability to transition from a reactive incident response model to a preemptive defense strategy. Instead of waiting for TTPs to be reported in the news or observed in attacks, security teams can proactively research, understand, and implement defenses against plausible future threats. This allows organizations to "have it covered" before an incident even occurs, significantly reducing the impact and likelihood of successful attacks.

1. Proactive Posture and Enterprise Resilience: PreTAC directly contributes to a proactive security posture and enhances enterprise resilience. By anticipating potential attack vectors, organizations can strengthen their defenses, develop robust mitigations, and refine their detection capabilities in advance. This foresight is highly valued by senior leadership and stakeholders, enabling security teams to demonstrate tangible value by keeping the organization "out of the news."

1. Enhanced Red and Purple Teaming: The knowledge base of plausible TTPs is an invaluable resource for red and purple teaming exercises. Red teams can leverage PreTAC techniques to simulate novel attack scenarios that adversaries might employ in the future, thereby testing an organization's defenses against previously unknown threats. Purple teams can then use this information to collaboratively develop and validate detections and mitigations, ensuring comprehensive coverage. Thakur noted this as an unexpected but highly important benefit identified during early sharing.

1. Targeted Detection and Mitigation Development: PreTAC enables security teams to develop highly specific and effective detections and mitigations. For each plausible TTP, the framework encourages the creation of concrete countermeasures. This allows organizations to build out their security controls, EDR rules, SIEM alerts, and other defensive mechanisms to address emerging threats before they become widespread. The internal AI agent further assists in rapidly generating and validating these detections.

1. Community-Driven Intelligence Sharing: By being an open-source, community-driven framework, PreTAC facilitates the sharing of cutting-edge threat intelligence. Organizations can contribute their own research into novel TTPs and benefit from the collective knowledge of the community. This collaborative approach ensures that the knowledge base remains dynamic and reflective of the evolving threat landscape. The ethical policy, requiring countermeasures before public disclosure, ensures that shared intelligence is always actionable and responsible.

1. Improved Leadership Communication and Metrics: PreTAC provides security leaders with a powerful narrative for communicating their team's effectiveness. The ability to confidently state that "we've already got it under control" for an emerging threat, rather than scrambling to respond, significantly boosts leadership confidence and supports resource allocation. It shifts the measure of success from incident containment to incident prevention.

1. Future-Proofing Security Operations: The integration of AI and ML into PreTAC's roadmap further bolsters its defensive implications. By leveraging AI to automatically discover new TTPs and scale detection development, organizations can continuously "future-proof" their security operations against increasingly sophisticated and rapidly evolving threats.

Key Takeaways

• Preemptive Focus: PreTAC fills a critical gap in threat intelligence by systematically identifying and documenting plausible, yet unobserved, TTPs before they are exploited in the wild, shifting security from reactive to proactive.
• Community-Driven & Open Source: The initiative is an open-source framework (pret.org) that thrives on community contributions, fostering collaborative research and sharing of novel TTPs and their corresponding countermeasures.
• Validated Plausibility: TTPs within PreTAC are rigorously validated, often requiring working Proofs of Concept (PoCs) for higher priority submissions, ensuring the knowledge base contains actionable and realistic threat intelligence, not mere speculation.
• Ethical Countermeasure Requirement: PreTAC adheres to a strict ethical policy: no TTP is publicly disclosed without accompanying detections, mitigations, or defenses, ensuring immediate defensive value for the community.
• Enhanced Defensive Capabilities: PreTAC empowers organizations to develop anticipatory defenses, perform advanced red/purple teaming, and enhance enterprise resilience against emerging threats, allowing teams to proactively prepare.
• AI for Scalability: The project leverages AI internally for rapid TTP identification and detection development, with a roadmap to expand AI/ML integration to automate and scale the discovery of new TTPs and countermeasures.

About the Speaker(s)

Vishal Thakur is a distinguished cybersecurity professional currently serving as the Lead Incident Response at Atlassian. His career reflects a deep technical background, having started "from the trenches" and leading research teams focused on reverse engineering and emerging threats. Prior to Atlassian, Vishal held various significant roles in big tech, including working at Salesforce for many years, where he was part of the CERT and later started a research team. He also contributed to the Commonwealth Bank of Australia and was instrumental in setting up the cyber fusion center for TikTok USDS. Vishal's experience spans incident response, threat research, and security leadership, driving him to question traditional reactive security approaches and champion preemptive defense strategies like PreTAC.

David Wearing is acknowledged as the co-speaker and the technical head behind the PreTAC initiative. Although he was unable to attend the conference due to illness, Vishal Thakur highlighted David's significant contributions, particularly in leading the technical aspects of the framework. David's insights, including the idea to use an AI agent for PreTAC, have been crucial to the project's development and success.