MITRE ATT&CK, Explained
MITRE ATT&CK is a free, continuously updated knowledge base of the tactics and techniques that real attackers use, observed in actual intrusions. Where the Cyber Kill Chain sketches the shape of an attack, ATT&CK fills in the specific moves — giving defenders a shared, evidence-based catalog to measure themselves against.
How is ATT&CK structured?#
Two concepts do most of the work:
- Tactics are the attacker’s goals — the columns of the matrix. Examples: Initial Access, Persistence, Privilege Escalation, Lateral Movement, Exfiltration.
- Techniques are the concrete ways to achieve a tactic — the entries under each column. Each has a stable ID (e.g. T1566 for Phishing) and documents procedures, detections, and mitigations.
Because every technique carries a stable identifier, teams and vendors can talk about the exact same behavior without ambiguity — a common language for describing lateral movement or privilege escalation.
How do defenders actually use it?#
ATT&CK turns a vague question into a measurable one:
| Use | What it looks like |
|---|---|
| Coverage mapping | Heat-map which techniques your detections catch |
| Prioritization | Focus on techniques your sector’s adversaries favor |
| Purple teaming | Emulate a technique, verify the blue team sees it |
| Communication | Report incidents in shared technique IDs |
ATT&CK is the detailed companion to the Cyber Kill Chain and a cornerstone of detection engineering. More foundations at the Security Fundamentals hub.
Frequently asked questions#
What are tactics and techniques in ATT&CK?
A tactic is an attacker goal — the "why" of a step, such as persistence or privilege escalation. A technique is a specific way to achieve it, the "how", such as scheduled tasks or valid accounts. ATT&CK organizes techniques under tactics in a matrix, giving each a stable ID like T1053.
How do blue teams use ATT&CK?
They map their detections and controls onto the matrix to see coverage gaps, prioritize based on techniques real adversaries use against their sector, and communicate in a shared vocabulary. A coverage heat map over ATT&CK turns "are we secure?" into "which techniques can we currently detect?"