Cybersecurity glossary
What is MITRE ATT&CK?
Learn what MITRE ATT&CK is, how the matrix of tactics and techniques is used for coverage mapping, threat intel, and purple teaming, and how to avoid treating the matrix as a checklist.
Definition
MITRE ATT&CK is a publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, used by defenders to describe behavior, map detections and controls, and plan exercises in a shared language.
Why a shared language beats vendor folklore
Every tool names “lateral movement” differently. MITRE ATT&CK gives defenders a public, evidence-based vocabulary: technique IDs, descriptions, and procedure examples drawn from real intrusions.
That vocabulary is a map. It is not a mandate to paint every square green.
What lives in the knowledge base
Tactics
Adversary objectives such as Initial Access, Privilege Escalation, and Exfiltration.
Techniques and sub-techniques
How those objectives are pursued, with IDs like T1078 Valid Accounts that survive vendor branding.
Procedure examples
Concrete implementations and software/actor notes that keep the catalog grounded in observed use.
Matrices
Enterprise, Mobile, and ICS views so industrial and phone-centric threats are not forced into a Windows-only grid.
A practical ATT&CK workflow
Scope the threat model
Choose techniques tied to your incidents, sector, and crown jewels—not the entire Enterprise matrix.
Map prevent vs detect vs gap
A control that blocks phishing is not the same as a detection that fires after a click. Record both.
Check telemetry, not slides
If you cannot see the technique, the cell is a logging problem before it is a SIEM-rule problem.
Exercise the risky gaps
Purple-team the procedures you claimed to cover; update the map with evidence.
Maintain the overlay
New cloud services and identity paths add techniques. Heatmaps rot like any other inventory.
Healthy versus theatrical use
| Use | Healthy | Theater |
|---|---|---|
| Detection backlog | IDs on detections with tested procedures | One regex labeled “covers T1059” |
| Intel sharing | Actor reports mapped to techniques you can hunt | Name-dropping groups with no telemetry match |
| Vendor evaluation | Ask which procedures were tested, on which OS | Believe a 90% “ATT&CK coverage” marketing number |
| Board reporting | Trend in closed gaps for top 15 techniques | A full Navigator screenshot as a KPI |
- Pick a short list of priority techniques from incidents and intel, then expand.
- Store ATT&CK IDs on detections, IR reports, and purple-test results.
- Distinguish prevention, detection, and logging gaps in any coverage map.
- Retest coverage after EDR, IdP, or cloud-audit changes.
- Include identity and SaaS techniques, not only host execution.
- Treat sub-techniques as the real unit of work when the parent technique is huge.
- Do not chase 100% matrix coverage; chase the paths that would ruin a quarter.
- Review MITRE updates; techniques and descriptions evolve with the threat landscape.
The practical takeaway
MITRE ATT&CK is the common map of adversary behavior. Use it to name gaps, plan tests, and share intel—then prove coverage with telemetry and exercises, not with a fully painted matrix.
Related security terms
Tactics, Techniques and Procedures (TTP)
The behavioral layer ATT&CK standardizes into tactics and techniques.
Detection Engineering
Uses ATT&CK IDs to organize and test detection content.
Purple Team
Exercises often scoped to specific ATT&CK techniques.
Threat Intelligence
Reports that map actor behavior onto ATT&CK for comparison.
Red Team
Emulates techniques from the matrix against live controls.
Frequently asked questions
What is MITRE ATT&CK in simple terms?
It is a catalog of how real attackers get in, stay in, and steal or destroy—written as tactics (goals) and techniques (methods) that vendors, SOCs, and intel teams can all point to.
Is ATT&CK a product or a compliance standard?
Neither. It is a knowledge base. You are not “ATT&CK certified” by filling every cell. You use it to talk about coverage honestly.
What are tactics versus techniques versus sub-techniques?
Tactics are columns of goals (Persistence, Credential Access). Techniques are methods (OS Credential Dumping). Sub-techniques specialize further (LSASS Memory).
Which ATT&CK matrix should I use?
Enterprise is the default for IT and cloud. Mobile and ICS matrices exist for those environments. Pick the matrix that matches where you actually operate.
How do teams use ATT&CK Navigator?
They color techniques by detect, prevent, or gap, then plan purple tests for the high-risk empty cells—not to produce a pretty heatmap for slides only.
Does one SIEM rule “cover” a technique?
Rarely. A technique has many procedures. Coverage means you have a tested control or detection for the procedures that matter in your environment.
How does ATT&CK relate to D3FEND or CAPEC?
ATT&CK describes offense. D3FEND catalogs defensive techniques. CAPEC focuses on attack patterns, often at a design/abuse-case level. They complement; they do not replace each other.
References
Explore authoritative guidance and frameworks related to mitre att&ck.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.