MITRE ATT&CK is a freely available knowledge base of observed attacker behavior. It organizes behavior into tactics, techniques and sub-techniques and connects these to specific examples, groups, campaigns, software, mitigations and detection opportunities. Security teams gain a shared language for describing attacks and defensive measures consistently.
How is MITRE ATT&CK structured?
| Element | Meaning | Example |
|---|---|---|
| Tactic | The attacker's current objective. | Credential Access or Lateral Movement |
| Technique | The general way of achieving that objective. | Brute Force or Remote Services |
| Sub-technique | A more specific form of a technique. | Password Guessing as a form of Brute Force |
| Procedure | Observed behavior of a group or software. | A particular command or tool |
| Mitigation and detection | Ways to restrict or identify the behavior. | MFA, segmentation or suitable telemetry |
Identifiers provide unambiguous references in reports and technical rules. T1059, for example, denotes Command and Scripting Interpreter, with more specific sub-techniques below it. Distinguishing technique from procedure matters: two actors may implement the same technique using entirely different tools.
Which ATT&CK domains exist?
Enterprise ATT&CK covers behavior in traditional enterprise environments and cloud platforms. Mobile ATT&CK addresses mobile operating systems, while ICS ATT&CK focuses on industrial control environments. Their matrices differ because objectives, technology and consequences are not identical. Teams should record the relevant domain and version because MITRE updates the knowledge base regularly.
How do blue teams use ATT&CK?
- Prioritize threats: Derive relevant groups, techniques and platforms from the organization's risk profile.
- Review telemetry: Determine which data a detection requires and whether it is actually collected.
- Develop detection: Describe analytics with expected signals and likely false-positive sources.
- Test effectiveness: Execute behavior safely and verify that alerting and response work.
- Manage gaps: Treat missing coverage as prioritized work rather than an empty matrix cell.
A SOC can map alerts and incidents to techniques. This supports analysis across several tools and reveals recurring attack patterns. The mapping alone says nothing about detection quality, context or response speed.
How do red and purple teams use ATT&CK?
A red team can plan scenarios around realistic techniques and document executed steps clearly. During purple teaming, ATT&CK connects simulated behavior, observed telemetry and improved detection. The objective is not to execute as many techniques as possible, but to test attack paths that matter to the organization.
What makes ATT&CK coverage meaningful?
Complete coverage of the entire matrix is neither realistic nor automatically useful. A cloud company, manufacturing operator and public authority require different priorities. Good prioritization combines systems, exposed access, threat intelligence, previous incidents and business impact. Important techniques need more than a “covered” label: data source, detection rule, test date, result and owner make the claim verifiable.
What are the framework's limitations?
ATT&CK is not a complete risk model, vulnerability catalog or ready-made incident-response plan. It mainly describes known, observed behavior; new or organization-specific methods may be absent. Product claims such as “80 percent ATT&CK coverage” mean little without scope and test method. The framework becomes valuable through relevant selection, telemetry, testing and a functioning response process.
Thank you for your feedback! We will review it and optimize this content.