Preemptive PR3TACK Framework Maps Threats Before Attackers Strike

Defensive cybersecurity frameworks have long operated in reactive mode, cataloging attacks only after they’ve already breached systems. Security analysts study a confirmed incident, document the method, and build detection rules around what’s already happened. This reactive cycle creates a dangerous lag: the time between when an attacker invents a new technique and when defenders learn to spot it.

PR3TACK, the Preemptive Tactics and Countermeasures Knowledgebase, is designed to close that gap. Created by Vishal Thakur of Atlassian, this open framework catalogs plausible attacker tactics, techniques, and procedures that have not yet been observed in the wild. It shifts the focus from past attacks to future possibilities.

The most familiar reference point in this space is MITRE ATT&CK, the widely used catalog of real-world intrusion techniques. ATT&CK documents what attackers have already done. PR3TACK, by contrast, documents what attackers could do next, based on current system weaknesses and patterns of innovation. While MITRE D3FEND lists defenses for known techniques, PR3TACK extends that logic toward threats that haven’t yet materialized.

The framework highlights attacks that caused real damage but remained outside ATT&CK’s catalog. Examples include Atom Table abuse and the Revix ransomware family’s “kill-all-VMs” tactic, both of which were effective methods that evaded the observed-technique databases.

Entries in PR3TACK are organized into three tiers of plausibility. High priority covers techniques backed by working proof-of-concept code. Medium priority includes techniques argued through technical reasoning, awaiting validation. Low priority covers techniques emerging from academic research or ongoing investigation. This structure ensures every entry is grounded in demonstrable reasoning.

The Seed Matrix, an early release, organizes techniques across seventeen tactic categories. Some labels are familiar, such as Execution, Persistence, and Lateral Movement. Others are original to the project. Pre-Positioning covers long-lead actions like sleeper commits in open-source code that prepare a target for later compromise. Resilience Erosion includes tactics like backup corruption and patch-process fatigue. Governance Subversion targets procurement, policy, and standards processes. Cognitive Manipulation aims to degrade analyst judgment through alert habituation and crafted logs. Digital Exhaust Manipulation weaponizes telemetry, threat feeds, and metadata to mislead defenders.

One cataloged technique, Execution via Peripheral Firmware Stagers, describes benign-looking peripheral firmware that stages a payload once connected. Defenses include firmware verification, device attestation, and vendor allowlisting. Another, Governance Subversion via Procurement Account Establishment, describes attackers setting up trusted vendor identities as long-term footholds, with supplier verification and procurement audits as countermeasures.

A Navigator tool presents the matrix as a visual, column-based grid. Each tactic forms a column, with its techniques listed beneath. Users can search and filter across tactics, techniques, platforms, and status. Clicking into a technique reveals detection ideas and mitigations. Users can also upload custom JSON files to extend the matrix with their own entries.

PR3TACK operates as a collaborative project open to practitioners, academics, and organizations. Contributors submit a technique description, a feasibility assessment, potential impact, and suggested preemptive defenses. Supporting proof-of-concept code is encouraged.

Version 0.1 marks an early stage for the framework. Its long-term value will depend on the volume and quality of community submissions over time.