MITRE ATT&CK

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a comprehensive knowledge base and framework that catalogues cyber adversary behavior across the entire attack lifecycle, from initial access to impact.

Overview

Developed by MITRE Corporation, ATT&CK provides a common language for describing adversary actions. It is widely used by security teams to understand threats, map defenses, and improve detection capabilities.

Structure

The framework is organized into several matrices:

• Enterprise: Covers Windows, macOS, Linux, Cloud, and Network platforms
• Mobile: Covers Android and iOS platforms
• ICS: Covers Industrial Control Systems

Tactics (The "Why")

Tactics represent the adversary's tactical objectives — the reason for performing an action. Examples include Initial Access, Persistence, Lateral Movement, and Exfiltration.

Techniques (The "How")

Techniques describe how adversaries achieve their tactical objectives. Each tactic contains multiple techniques, and some techniques have sub-techniques providing additional granularity.

Why It Matters

ATT&CK enables organizations to:

1. Map their detection coverage against known adversary behaviors
2. Identify gaps in visibility and detection
3. Communicate threats using a standardized vocabulary
4. Benchmark security capabilities against real-world threats

Related Terms

• Adversary Simulation
• Detection Engineering
• Threat Intelligence