Quick answer: MITRE ATT&CK is a free, globally used knowledge base that classifies the behaviors of real attackers by tactics and techniques. It has two core concepts: a Tactic is the attacker's goal at that step (for example "Initial Access", "Privilege Escalation", "Exfiltration") shown with a TA number. A Technique is the method used to reach that goal (for example "Phishing", "Valid Accounts") shown with a T number. The enterprise matrix lays out 14 tactics left to right from initial access to impact; under each tactic there are dozens of techniques and sub techniques. The value of ATT&CK is this: it moves defense from an abstract "bad guy" fear to concrete, detectable behaviors. SOC teams use it to write detection rules, red teams to plan attacks, and executives to map defense gaps. In short, ATT&CK is the common language of cybersecurity: a technique number (for example T1566 Phishing) means the same thing everywhere in the world.

One of the biggest problems in cybersecurity was the lack of a common language; everyone named attacks differently. MITRE ATT&CK solved this: it put adversary behavior onto a standard map. This guide gathers ATT&CK, from tactic to technique to use case to defense mapping, into a single reference with world class clarity.

MITRE ATT&CK tactic matrix

MITRE ATT&CK · ADVERSARY TACTIC MATRIX Left to right: direction of attack progress (tactic = goal, technique = method) TA0001Initial AccessTA0002ExecutionTA0003PersistenceTA0004Priv EscalationTA0005Defense EvasionTA0006Credential AccessTA0007DiscoveryTA0008Lateral MovementTA0009CollectionTA0011Command ControlTA0010ExfiltrationTA0040Impact Each tactic has dozens of techniques (T-numbers); defense turns these into detection rules.

Reading the matrix is simple: columns are tactics (goals), the cells inside each column are the techniques to reach that goal. An attack usually moves left to right but does not have to use every technique; the job of defense is to see this journey as early as possible.

Tactic, technique and defense map

Tactic (goal) Example technique Defense focus
Initial Access Phishing (T1566) Email filter, awareness
Execution Command/Script interpreter (T1059) EDR, application control
Persistence Valid accounts (T1078) Anomalous session detection
Privilege Escalation Token manipulation (T1134) Least privilege, PAM
Defense Evasion Log clearing (T1070) Immutable logs, SIEM
Credential Access Brute force (T1110) MFA, lockout
Discovery Network scan (T1046) IDS, segmentation
Lateral Movement Remote services (T1021) Microsegmentation
Command and Control Application layer (T1071) Egress filtering, DNS monitoring
Exfiltration Over C2 (T1041) DLP, data monitoring
Impact Ransom encryption (T1486) Backup, incident response

How to use ATT&CK

  1. Model the threat. Who targets you, with which techniques? Combine threat modeling with ATT&CK.
  2. Map detection gaps. Which techniques can you see, which are blind spots? Mark them on the matrix.
  3. Write detection rules. A SIEM/EDR rule for each important technique; tie it to your SOC and SIEM processes.
  4. Run red team drills. Test defense by emulating ATT&CK techniques.
  5. Guide threat hunting. Build threat hunting hypotheses with ATT&CK techniques.
  6. Map to the kill chain. At which stage of the cyber kill chain is an ATT&CK technique? So you layer defense.

Frequently asked questions

What is the difference between MITRE ATT&CK and the Cyber Kill Chain? The Kill Chain divides an attack into 7 high level stages; ATT&CK is far more detailed, listing real observed techniques (hundreds of T numbers) under tactic headings. The two complement each other.

What is the difference between a tactic and a technique? A tactic is the attacker's goal (what they want: access, privilege, data). A technique is how they reach it (phishing, brute force). A tactic can have many techniques.

Is ATT&CK free? Yes. MITRE ATT&CK is public and free; the matrix, technique descriptions and defense recommendations are available at attack.mitre.org.

How does a small organization use ATT&CK? Start with a few of the most common techniques (phishing, valid accounts, ransom). Build detection and defense for those, then widen scope. Do not try to cover everything at once.

Sources

To map your organization to MITRE ATT&CK, close detection gaps and run a red team drill, contact DSET. From our Ankara Hacettepe Teknokent laboratory we provide cybersecurity, SOC and digital forensics services.