MITRE ATT&CK Framework

What Is MITRE ATT&CK?

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a comprehensive framework that catalogs the tactics, techniques, and procedures (TTPs) used by real-world adversaries. It provides a common language for describing attacker behavior and is used worldwide by defenders, vendors, and researchers.

ATT&CK Matrix Structure

The framework is organized into:

• Tactics: The adversary's objective (the "why") — 14 tactics from Initial Access to Impact
• Techniques: How the objective is achieved (the "what") — ~200 techniques
• Sub-techniques: Specific variations of techniques — ~400 sub-techniques
• Procedures: Specific implementations by threat groups

The 14 Tactics

| # | Tactic | Objective | |---|---|---| | 1 | Reconnaissance | Gather information about the target | | 2 | Resource Development | Establish resources for the attack | | 3 | Initial Access | Get into the network | | 4 | Execution | Run malicious code | | 5 | Persistence | Maintain access | | 6 | Privilege Escalation | Gain higher permissions | | 7 | Defense Evasion | Avoid detection | | 8 | Credential Access | Steal credentials | | 9 | Discovery | Learn about the environment | | 10 | Lateral Movement | Move through the network | | 11 | Collection | Gather target data | | 12 | Command and Control | Communicate with compromised systems | | 13 | Exfiltration | Steal data | | 14 | Impact | Disrupt, destroy, or manipulate |

How Organizations Use ATT&CK

• Detection engineering: Map detection rules to specific techniques to identify coverage gaps
• Threat intelligence: Describe adversary behavior using a common taxonomy
• Red teaming: Plan exercises that emulate specific threat group TTPs
• Vendor evaluation: Compare security products based on ATT&CK technique coverage (e.g., MITRE Engenuity evaluations)
• SOC maturity: Measure detection coverage across the ATT&CK matrix
• Incident response: Classify observed attacker behavior during investigations

ATT&CK Matrices

MITRE maintains separate matrices for different environments:

• Enterprise: Windows, macOS, Linux, Cloud, Network, Containers
• Mobile: Android, iOS
• ICS: Industrial Control Systems