MITRE ATT&CK, Explained

On this page
  1. How is ATT&CK structured?
  2. How do defenders actually use it?

MITRE ATT&CK is a free, continuously updated knowledge base of the tactics and techniques that real attackers use, observed in actual intrusions. Where the Cyber Kill Chain sketches the shape of an attack, ATT&CK fills in the specific moves — giving defenders a shared, evidence-based catalog to measure themselves against.

How is ATT&CK structured?#

Two concepts do most of the work:

  • Tactics are the attacker’s goals — the columns of the matrix. Examples: Initial Access, Persistence, Privilege Escalation, Lateral Movement, Exfiltration.
  • Techniques are the concrete ways to achieve a tactic — the entries under each column. Each has a stable ID (e.g. T1566 for Phishing) and documents procedures, detections, and mitigations.

Because every technique carries a stable identifier, teams and vendors can talk about the exact same behavior without ambiguity — a common language for describing lateral movement or privilege escalation.

How do defenders actually use it?#

ATT&CK turns a vague question into a measurable one:

UseWhat it looks like
Coverage mappingHeat-map which techniques your detections catch
PrioritizationFocus on techniques your sector’s adversaries favor
Purple teamingEmulate a technique, verify the blue team sees it
CommunicationReport incidents in shared technique IDs

ATT&CK is the detailed companion to the Cyber Kill Chain and a cornerstone of detection engineering. More foundations at the Security Fundamentals hub.

Frequently asked questions#

What are tactics and techniques in ATT&CK?

A tactic is an attacker goal — the "why" of a step, such as persistence or privilege escalation. A technique is a specific way to achieve it, the "how", such as scheduled tasks or valid accounts. ATT&CK organizes techniques under tactics in a matrix, giving each a stable ID like T1053.

How do blue teams use ATT&CK?

They map their detections and controls onto the matrix to see coverage gaps, prioritize based on techniques real adversaries use against their sector, and communicate in a shared vocabulary. A coverage heat map over ATT&CK turns "are we secure?" into "which techniques can we currently detect?"

Sources & further reading