THREATNOIR
Subscribe
Attacker knowledge bases

MITRE ATT&CK

A public knowledge base of attacker tactics and techniques, used to plan detection and defence.

Official source Published by MITRE. Reused with attribution under MITRE's terms of use.

What it is

MITRE ATT&CK is a public knowledge base of the tactics and techniques that real attackers use, based on observed intrusions. It exists to give defenders a common language for describing attacker behaviour and to help them plan detection, testing and defence.

Who it applies to

  • Security operations and detection engineering teams
  • Threat intelligence analysts describing adversary behaviour
  • Red teams and purple teams planning realistic tests
  • Security leaders measuring detection coverage
  • Vendors, who map their products and alerts to ATT&CK techniques
Status
A free, openly available knowledge base maintained by MITRE, not a standard or law. It is updated regularly, typically twice a year, with new techniques and data.
Enforcement
Voluntary: no one certifies against ATT&CK. It is used as a reference in threat reports, product evaluations and detection programmes, and sometimes requested in threat led testing scopes.

Key points

  • ATT&CK describes behaviour after and around initial access, which is harder for attackers to change than indicators such as IP addresses
  • Use it to map detections and find gaps, but do not aim for 100 percent coverage, as techniques differ in relevance and detectability
  • Prioritise techniques used by groups that target your sector and region
  • Each technique has procedure examples that help when writing realistic detections and tests
  • Tools such as ATT&CK Navigator help visualise coverage and threat profiles
  • It fits threat led testing approaches such as TIBER-EU, where scenarios are described in ATT&CK terms

Where to start

  1. 1Pick a few threat groups relevant to your sector from ATT&CK and list their techniques
  2. 2Map your existing detections and controls to those techniques in ATT&CK Navigator
  3. 3Prioritise and close the most relevant gaps, then test them with purple team exercises
  4. 4Tag incidents and alerts with technique IDs to build your own picture over time

How it is structured

MatricesSeparate matrices for Enterprise (including cloud), Mobile and ICS
TacticsThe attacker's goal at each stage, such as initial access, persistence or exfiltration
Techniques and sub-techniquesHow the goal is achieved, with procedure examples
Groups, software and campaignsKnown threat actors and tools with the techniques they use
Mitigations and detection guidanceHow each technique can be prevented or detected

A plain-language overview to help you learn, written by ThreatNoir. The official source prevails; this is not legal advice.

Items explained (82)

Ordered by how often our lessons cite them.