MITRE ATT&CK
A public knowledge base of adversary tactics and techniques observed in real intrusions, used as a shared vocabulary for detection and intel.
ATT&CK organises behaviour into tactics (the goal, such as Initial Access, Persistence, Credential Access, Lateral Movement, identified as TA00xx) and techniques and sub-techniques (how, such as T1558.003 Kerberoasting), each with procedure examples, data sources and mitigations. There are Enterprise, Mobile and ICS matrices.
Teams use it to map detection coverage, tag rules and intelligence, plan purple-team exercises, and describe incidents consistently. It is far more granular than the kill chain.
Misuse: colouring a heatmap green because one rule exists for a technique says nothing about whether it detects the variations attackers use. Coverage should be measured by tested detections per procedure, weighted by what threats actually target you.
Learn it properly
Compared
Also used in
- Writing Sigma rulesAnalyst · Query & detection craftFree
- Writing intelligence reportsAnalyst · Threat intelligence for analystsFree
- Security metrics, SLOs and risk quantificationSecEng · Advanced: Security Architecture at ScalePro
- Design an EDR telemetry pipelineHLD · Design problems: Telemetry & detectionPro
- Hypothesis-driven huntingAnalyst · Investigation & threat huntingPro