MITRE ATT&CK

Why it matters

Before ATT&CK, every vendor, red team and SOC described attacks in its own words. ATT&CK gives everyone the same nouns. That has three practical effects:

• SOC analysts tag alerts with technique IDs, so "T1003.001 — LSASS Memory" means the same thing on the ticket, in the SIEM rule and in the vendor report.
• Red teams and pentesters plan and report engagements as a sequence of techniques, which lets the blue team ask the only question that matters afterwards: "which of these did we detect?"
• GRC and management get a heat map of coverage — not "we have an EDR" but "we detect 60 % of the techniques ransomware crews actually use".

It is not a compliance standard and it does not certify anything. It is a shared vocabulary with evidence behind every entry.

How it is structured

The Enterprise matrix is a grid. Columns are tactics — the attacker's why at each stage, fourteen of them in order from Reconnaissance through Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration to Impact. A technique can sit under more than one tactic (Valid Accounts serves persistence, privilege escalation, defense evasion and initial access).

Cells are techniques — the how, identified as T plus four digits: T1059 is Command and Scripting Interpreter. Most techniques split into sub-techniques with a dotted suffix: T1059.001 is PowerShell, T1059.003 the Windows command shell. Each entry carries a description, the platforms it applies to, known procedures (named groups and malware seen using it), detection guidance with data sources, and mitigations.

Two sibling matrices exist — Mobile and ICS — and a separate MITRE project, ATLAS, does the same job for attacks on AI systems. Everything is versioned; ATT&CK is updated twice a year, and IDs are never reused, which is why a technique ID is safe to put in a detection rule.

Common misreadings

• "We cover 300 techniques" is not a security claim. Coverage means a rule exists, not that it fires reliably on the procedure the attacker actually uses. Test it.
• ATT&CK is post-compromise heavy. Reconnaissance and Resource Development exist, but the framework shines once someone is inside; pair it with a vulnerability view (CVSS, EPSS) for the "how they got in" question.
• Technique ≠ severity. T1082 System Information Discovery is noisy and mostly benign; T1486 Data Encrypted for Impact is the ransomware payload. The ID tells you what, not how bad.

Related terms

• TTP — TTPs are the three levels at which attacker behaviour is described — the tactic is why (steal credentials), the technique is how (dump LSASS memory), the procedure is exactly how this actor does it (procdump renamed to dump64.exe, run via a scheduled task).
• Sigma — A Sigma rule is a detection written once, in a small YAML format, that describes what to look for in which kind of log — and is then converted into the query language of whatever SIEM you happen to run.
• IOC — An IOC is a piece of forensic evidence — a file hash, an IP address, a domain, a registry key, a mutex — whose presence on a system or in traffic indicates that a known intrusion has occurred.
• IOA — An IOA describes what an attacker is doing rather than what they left behind — a sequence of actions such as "a document opens a shell that downloads and executes a file" — so it detects the technique regardless of which hash, IP or domain is used this time.