Quick answer: MITRE ATT&CK is a free, internationally recognized knowledge base cataloguing attacker behaviors (tactics and techniques) observed in real attacks. It describes not which tool an attack used but what the attacker was trying to do: initial access, persistence, privilege escalation, lateral movement, exfiltration and so on. Its structure has two layers: tactics show the attacker's goal (why), and techniques show the method of reaching that goal (how). Defense teams use ATT&CK to map detection rules, see security gaps and make red and blue teams speak the same language. Describing an attack as "initial access via T1566, injection via T1055" rather than "this machine was hacked" is the common language ATT&CK provides.

For a long time in cybersecurity everyone described attacks in their own words. What one team called "lateral movement" another called "internal spread"; the same technique had ten different names. MITRE ATT&CK ended that chaos, bringing a common, structured language to real attacker behaviors. Today detection rules, threat intelligence and security products speak through this language. This article explains what ATT&CK is and how to use it.

What ATT&CK is and what it solves

ATT&CK is a knowledge base developed and maintained by MITRE. The name is short for Adversarial Tactics, Techniques and Common Knowledge. It systematically catalogues attacker behaviors documented in real incidents.

The core problem it solves is a common language. Before ATT&CK, one security team's finding did not easily map to another product or another team. Because ATT&CK gives each technique an identifier (for example T1566 phishing), everyone can now describe the same thing by the same name. Threat intelligence reports, security products and detection rules connect to each other through these identifiers.

An important distinction: ATT&CK is not a defense framework but an observation catalogue. It tells you not what you must do but what attackers actually do. You design your defense around these observations.

Tactic and technique: two layers

To understand ATT&CK's structure, separate two concepts.

A tactic is the attacker's goal at that step, the why. For example "persistence" is a tactic: the attacker wants to stay in the system.

A technique is the way of reaching that goal, the how. Under the persistence tactic there are dozens of techniques: creating a scheduled task, adding a registry key, installing a service.

The Enterprise ATT&CK matrix consists of 14 tactic columns, with relevant techniques listed under each:

Tactic Attacker's goal
Reconnaissance Gathering information about the target
Resource Development Preparing attack infrastructure
Initial Access Obtaining initial access
Execution Running code
Persistence Staying present
Privilege Escalation Escalating privileges
Defense Evasion Avoiding detection
Credential Access Obtaining credentials
Discovery Exploring the environment
Lateral Movement Moving laterally
Collection Gathering data
Command and Control Establishing a command channel
Exfiltration Exfiltrating data
Impact Creating impact (deletion, encryption)

A ransomware incident moves left to right across these columns: initial access via phishing, privilege escalation, lateral movement to compromise Active Directory, and finally impact via encryption.

How ATT&CK is used in defense

Seeing detection gaps

The most common use is painting your existing detection capabilities onto the ATT&CK matrix. Which techniques can you detect, which can you not. The matrix turns into a heat map and blind spots become visible. This gives a concrete answer to "where should I spend money."

Mapping detection rules

You label your SIEM rules and EDR alerts with ATT&CK techniques. When an alert arrives, you instantly see which stage the attacker is at. This forms the foundation of SIEM and SOC operations.

A common language for red and blue teams

When a red team runs an attack simulation, it reports every technique used with its ATT&CK identifier. The blue team maps its defense with the same identifiers. This makes "we tried this technique, you did not see it" objective and measurable. For how our red team service works, see our article on the penetration test process and scope.

Making threat intelligence concrete

Instead of saying a threat actor "uses advanced techniques," a report lists the ATT&CK techniques that actor prefers. This clarifies which defenses to prioritize against that actor.

Misconceptions about ATT&CK

  • "ATT&CK is a checklist." It is not. Trying to detect every technique is neither possible nor wise. Focus on techniques genuinely likely in your environment.
  • "My product is ATT&CK compliant, so my protection is complete." A product referencing techniques does not mean it actually detects them. The proof is testing.
  • "ATT&CK is a maturity score." Closing more boxes on the matrix does not make you more secure. Reliably detecting a few critical techniques beats weakly covering many.

ATT&CK matrix variants

ATT&CK is not a single matrix. There are separate matrices for different environments:

  • Enterprise: Windows, Linux, macOS, cloud, network and container environments.
  • Mobile: techniques specific to Android and iOS.
  • ICS: industrial control systems, SCADA environments.

Choosing the matrix matching your organization's attack surface directs your effort to the right place.

Frequently asked questions

Is ATT&CK free? Yes. It is provided openly and free of charge by MITRE.

What is the difference between ATT&CK and the Cyber Kill Chain? The Kill Chain summarizes an attack in seven broad stages, while ATT&CK offers hundreds of concrete techniques under each stage. ATT&CK is far more detailed and suited to real detection work.

Can a small organization use ATT&CK? Yes. Starting by focusing on the few most likely techniques is the recommended approach even for large teams.

Should I detect every ATT&CK technique? No. Spending resources on techniques unlikely in your environment is inefficient. Prioritize based on risk.

What is the ATT&CK Navigator? A free tool that lets you paint the matrix and visualize your detection coverage. It is widely used in gap analysis.

Is ATT&CK only for large attacks? No. Even an ordinary ransomware or phishing incident can be clearly mapped with ATT&CK techniques.

Sources

To map your defense with MITRE ATT&CK, see your blind spots and test them with a red team simulation, contact DSET. From our Ankara Hacettepe Teknokent laboratory we provide red team, detection engineering and SOC consultancy.