MITRE ATT&CK
Also known as: ATT&CK, MITRE ATT&CK framework, ATT&CK framework, MITRE ATTACK
MITRE ATT&CK, pronounced 'attack,' is a free, publicly available knowledge base that catalogues the tactics, techniques, and procedures real cyber attackers use, organized by stage of an attack, such as initial access, privilege escalation, and exfiltration.
Security teams use it as a common language to describe attacks, test defences, and spot gaps in detection. While ATT&CK is extremely useful, trying to 'cover every technique' can become a box-ticking exercise that distracts from the threats most likely to hit you.
MITRE ATT&CK, explained at three levels
At home
MITRE ATT&CK is like a field guide to burglars' habits, built from real break-ins. Each entry describes a specific trick, such as phishing or stealing saved passwords, gives it an ID number, and groups it under the goal it serves, from getting in to taking data out. Defenders use the guide to check, trick by trick, whether they would notice each one.
At work
MITRE ATT&CK is a free public catalogue of the techniques real attackers use, organized by the stage of an attack where each one appears. Security teams use it as a shared vocabulary for describing incidents, and as a checklist to see which techniques their tools can detect and which they can't. For a business, it turns 'are we secure?' into a list of specific, testable gaps.
At home
ATT&CK is built from real incident reports. MITRE researchers read how attackers actually behaved, then sort each action into a goal, called a tactic, and a method, called a technique. Phishing, for example, is technique T1566 under the Initial Access tactic. Each technique page lists real groups that used it, how defenders can spot it and how to reduce the risk. When a news story says attackers used T1566, it points to that shared, public description.
At work
The Enterprise matrix has 14 tactics as columns, from Reconnaissance to Impact, with techniques and more specific sub-techniques underneath, such as T1566.001 for spearphishing attachments. Separate matrices cover mobile devices and industrial control systems. Each technique lists data sources that could reveal it and mitigations that reduce it. Teams use the free ATT&CK Navigator to colour techniques by detection coverage, and MITRE's ATT&CK Evaluations test vendor products against emulations of specific threat groups.
At home
While ATT&CK lists hundreds of techniques, knowing their names does not make you safer by itself. Its real value is as a shared vocabulary and a checklist: for each technique, would we notice it, and could we stop it? Attackers also mix techniques in ways the framework cannot predict. In my view, that question of 'would we notice this?' is the most useful thing it offers, and you can ask it even with a very small security setup.
At work
Effective use starts with threat-informed prioritization: pick the techniques used by groups that target your sector, then test detections for those through emulation tools such as Atomic Red Team or MITRE's own adversary emulation plans. Coverage heat maps are misleading if they mark a technique green because one rule exists, since sub-techniques and procedure variations differ widely. Track detection fidelity, false positive rate and response time per technique. ATT&CK pairs with D3FEND, MITRE's countermeasure catalogue, to map defensive controls.
Real-world examples
At home
Thomas read a news article about a hacking group and noticed it listed technique IDs like T1566. He looked them up and learned they referred to phishing and stolen credentials.
At work
Aisha leads detection engineering at a Canadian retailer. She mapped her SIEM rules to ATT&CK and discovered the team had no detections for common credential theft techniques, which became the next quarter's priority.
How it compares
| feature | MITRE ATT&CK | Cyber kill chain |
|---|---|---|
| Detail level | Hundreds of specific techniques | Seven broad stages |
| Focus | What attackers do at every step | Overall attack sequence |
| Updates | Regular, community-driven | Rarely changes |
| Best use | Detection engineering and testing | Explaining attacks to leaders |
The kill chain tells the story. ATT&CK lists every move.
For analysts
I'd use ATT&CK to ask a focused question: of the techniques used against our industry, which would we miss? That keeps the framework practical rather than academic.
History & origin
MITRE, a US non-profit that runs federally funded research centres, started ATT&CK internally in 2013 during a research project called the Fort Meade Experiment, which studied how to detect attackers after they had broken in. MITRE released ATT&CK publicly in 2015, initially focused on Windows enterprise networks. It expanded to cover macOS, Linux, cloud platforms, mobile devices, and industrial control systems. Security vendors began mapping their detections to ATT&CK, and MITRE launched ATT&CK Evaluations in 2018 to test vendor products against emulated threat groups. Government advisories, including those from the Canadian Centre for Cyber Security, now routinely list ATT&CK technique IDs. In my view, ATT&CK's greatest achievement is giving attackers and defenders a shared dictionary.