In brief

FIRST’s article introduces PR3TACK, the Preemptive Tactics & Countermeasures Knowledgebase, as an openly accessible framework for cataloguing plausible but not yet observed adversary tactics, techniques and procedures. Its purpose is to fill the gap left by retrospective frameworks such as MITRE ATT&CK and MITRE D3FEND: instead of documenting only what attackers have already done, PR3TACK aims to help defenders reason about what attackers could plausibly do next. The framework is positioned as a tool for blue teams, red teams, SOCs, vendors, academia and leadership, with the goal of enabling earlier hardening, better threat modelling and proactive defence.

The article stresses that PR3TACK is not meant to be speculative fiction, but a structured catalogue grounded in proof-of-concept research, technical reasoning and adversarial innovation patterns. It organises techniques into tactics such as Execution, Persistence and Lateral Movement, but also introduces broader categories including Pre-Positioning, Resilience Erosion, Governance Subversion, Cognitive Manipulation and Digital Exhaust Manipulation. The framework includes a navigator-style matrix that lets defenders search, filter and map possible future techniques to detections, mitigations and research priorities. PR3TACK was released during FIRSTCON26 and is presented as a community-driven effort inviting participation from CSIRTs and other security practitioners.

Source: FIRST.org

‍