The MITRE ATT&CK Framework: What It Is For

Red teams, SOC analysts, researchers and managers all talk about attacks, but they use different words. MITRE ATT&CK gives them a shared vocabulary, a kind of periodic table of adversary behavior. In this lesson you will learn how it is organized, how to read it and, just as important, how not to misuse it.

What is it?

ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a freely available knowledge base, maintained by the MITRE organization at attack.mitre.org. It documents behaviors that real adversaries have been observed using, based on public reports. It is not a list of tools or exploits, and it is not a product. It is a structured description of what attackers do, with pointers on how to detect and mitigate it.

The knowledge base is updated regularly: new techniques appear and others are reorganized. Always consult the current version on the official site rather than relying on a printed poster, and note the version used in your reports.

The structure: tactics, techniques, sub-techniques

ATT&CK is organized as a matrix. Columns are tactics, the goals an adversary pursues at each stage. In the enterprise matrix, the tactics follow the rough order of an intrusion:

1. Reconnaissance
2. Resource development
3. Initial access
4. Execution
5. Persistence
6. Privilege escalation
7. Defense evasion
8. Credential access
9. Discovery
10. Lateral movement
11. Collection
12. Command and control
13. Exfiltration
14. Impact

Under each tactic are techniques, the methods used to achieve the goal, each with an identifier starting with the letter T, for example T1566 for phishing or T1110 for brute force. Many techniques have sub-techniques with a decimal suffix, such as T1558.003, which is the Kerberoasting technique you studied in chapter 1. Each technique page describes how it works, real-world examples, mitigations and detection ideas.

The same technique can appear under several tactics, because it can serve several goals.

Beyond the matrix

ATT&CK also catalogs groups (named sets of intrusion activity), software (tools and malware used), mitigations and data sources that help detect behaviors. This allows questions such as: "Which techniques are commonly used against organizations like mine, and which log sources would reveal them?" There are also matrices for other environments such as mobile devices and industrial control systems.

What it is used for

• Common language: a report that says "T1078, valid accounts" is understood by any team, in any country.
• Detection coverage: map your detections onto techniques to see where you are strong and where you are blind.
• Threat-informed defense: prioritize the techniques used by adversaries relevant to your sector.
• Red and purple teaming: design emulation scenarios and test specific techniques, as in chapter 3.
• Reporting and training: classify incidents, structure lessons learned, and teach new analysts.
• Buying decisions: ask tool providers which techniques they actually cover, and how.

A worked example: the Kerberoasting story in ATT&CK terms

Take the scenario of chapter 1, and describe the activity as a sequence of techniques. The mapping below is illustrative: the exact techniques depend on what really happened.

Stage of the story	Tactic	Example technique
An employee receives a deceptive message and opens a link	Initial access	Phishing (T1566)
The adversary uses the stolen credentials to sign in	Initial access / Persistence	Valid accounts (T1078)
The adversary lists accounts and groups in the directory	Discovery	Account discovery, permission groups discovery
Service tickets are requested and guessed offline	Credential access	Kerberoasting (T1558.003)
The adversary signs in to other machines with the found account	Lateral movement	Remote services

Seen this way, the story becomes a set of detection opportunities: every row asks "could we see this, and where?"

Coverage maps and the ATT&CK Navigator

The project provides a tool called the ATT&CK Navigator, a web-based visualization that lets you color the matrix, for example green for techniques you detect well, yellow for partial and red for none. Many teams export such a map for management: "this is where we are strong, and this is where we plan to invest". You can also build the same table in a spreadsheet; the idea matters more than the tool.

Using it well: common mistakes

• Treating it as a checklist to color completely. Covering every technique equals covering none properly. Prioritize by relevant threats.
• Equating coverage with quality. "We have a rule for T1110" says nothing about whether it works. Test it, as you do in purple exercises.
• Mapping by tool name. A product that "supports" a technique may detect only one variant of it.
• Ignoring prevention and response. The knowledge base lists mitigations too; detection is not the only answer.
• Using it as a legal or compliance standard. It is an excellent knowledge base, not a regulation.
• Forgetting the version. Cite which version you used when presenting results.

Other frameworks that fit around it

• NIST Cybersecurity Framework (nist.gov): a high-level structure for managing security risk, with functions such as govern, identify, protect, detect, respond and recover. ATT&CK helps with the "detect" and "respond" activities in a more technical way.
• OWASP projects (owasp.org): application security knowledge such as the Top Ten lists, which complement ATT&CK for web and API risks.
• CVE and NVD (cve.org, nvd.nist.gov): catalogs of specific vulnerabilities, which are a different concern from adversary behavior.

Together they answer different questions: how to organize security (NIST), what vulnerabilities exist (CVE), how to write secure applications (OWASP), and how adversaries operate (ATT&CK).

How an apprentice should learn it

Do not try to memorize the matrix. Instead: read one tactic page per day for two weeks; for each technique you meet in a lab or a CTF, look up its ATT&CK page and note the identifier; and when you read a public incident report, try to map two or three of its steps. After a month, the vocabulary will feel natural.

Your turn: map and prioritize

A fictional company, "LabCorp", reports the following incident summary. Map each step to a tactic from the list above (technique identifiers are optional), then decide which step offers the best opportunity for detection with the logs a typical SIEM already collects.

1. An employee enters their password on a fake sign-in page.
2. Using that password, the adversary signs in to the company's remote access portal.
3. The adversary lists the groups and administrators in the directory.
4. The adversary copies a large archive of documents to an external location.

See a solution

1. Initial access (phishing, T1566 family).
2. Initial access using valid accounts (T1078), and arguably a persistence opportunity.
3. Discovery (account and group discovery).
4. Exfiltration (and collection, because documents were gathered first).

Best detection opportunities: step 2 is very attractive because sign-in logs are collected almost everywhere: a first sign-in from an unusual location or device, especially without multi-factor authentication, is a strong signal. Step 4 is also valuable (unusual volume leaving the network) but arrives late, when damage is already near. Detecting earlier gives you more time to respond.

Portfolio step

Create attack-coverage-map.md (or a spreadsheet) in 04-detection-response. List ten techniques relevant to your lab scenarios, with their identifiers, the log source that would reveal each, and your detection status. Link the use cases from lesson 4.1 to this table. A coverage map is a concrete, readable deliverable that bridges red and blue skills.

Detecting is only half the job. The last lesson of the chapter covers what to do when the alarm is real.