{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/mitre-attack","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/mitre-attack/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/mitre-attack/"},"term":{"en":"MITRE ATT&CK","da":"MITRE ATT&CK"},"aka":{"en":["ATT&CK"],"da":["ATT&CK"]},"domain":["security"],"cluster":"security-operations","layer":"governance","status":"current","era":2015,"summary":{"en":"A free, public catalogue of the goals and methods real attackers use, giving defenders a shared language for how attacks unfold.","da":"Et gratis, offentligt katalog over rigtige angriberes mål og metoder, der giver forsvarere et fælles sprog for, hvordan angreb forløber."},"body":{"formal":{"en":"A knowledge base kept by the not-for-profit MITRE, built from observed attacks, that sorts attacker behaviour into tactics (the goal, such as lateral movement) and techniques (how the goal is reached), each with a number, examples and advice on detection.","da":"En vidensbase bygget på observerede angreb og vedligeholdt af den almennyttige organisation MITRE, der inddeler angriberes adfærd i taktikker (målet, fx lateral bevægelse) og teknikker (hvordan målet nås), hver med et nummer, eksempler og råd om detektion."},"plain":{"en":"Like a handbook of every trick known to pickpockets, sorted by stage - picking a victim, distracting them, taking the wallet, getting away - so guards know what to watch for at each step.","da":"Som en håndbog over alle kendte lommetyvetricks, ordnet efter fase - at vælge et offer, aflede det, tage pungen, slippe væk - så vagter ved, hvad de skal holde øje med i hvert trin."},"inPractice":{"en":"A region's SOC maps its detection rules onto the ATT&CK matrix and sees it has no rule at all for attackers stealing browser cookies, so that becomes the next rule it writes.","da":"En regions SOC lægger sine detektionsregler ind over ATT&CK-matricen og ser, at den slet ingen regel har for angribere, der stjæler browsercookies, så det bliver den næste regel, der skrives."},"whyItMatters":{"en":"Attackers can swap addresses and files in minutes, but their methods change slowly; watching for methods gives longer-lasting defence and a common way to report it.","da":"Angribere kan skifte adresser og filer på få minutter, men deres metoder ændrer sig langsomt; at overvåge metoder giver et mere holdbart forsvar og en fælles måde at rapportere det på."}},"deepDive":{"en":"ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) grew out of MITRE's 2013 Fort Meade Experiment, a research project on post-compromise detection in Windows enterprise networks, and was released publicly in 2015. It now has three domains: Enterprise (Windows, macOS, Linux, cloud platforms, identity providers, SaaS, network devices, containers and ESXi), Mobile and ICS. The Enterprise matrix has 14 tactics, from Reconnaissance (TA0043) and Resource Development (TA0042), both added in 2020, through Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection and Command and Control, to Exfiltration and Impact.\n\nThe data model is a set of linked objects with stable identifiers. Tactics (TAxxxx) are the adversary's tactical goals; techniques (Txxxx) are how a goal is achieved, and since version 7 (2020) many are split into sub-techniques (Txxxx.yyy), for example T1003.001, OS Credential Dumping: LSASS Memory, or T1539, Steal Web Session Cookie. Procedures are concrete observed implementations documented as examples. Groups (Gxxxx), software (Sxxxx), campaigns (Cxxxx) and mitigations (Mxxxx) link to the techniques they use or counter. Version 18, released in October 2025, replaced the old per-technique detection text and data-source mappings with detection strategies (DETxxxx) and platform-specific analytics that point to log sources, a significant change for anyone maintaining coverage mappings. The whole corpus is published as STIX 2.1 bundles, and the ATT&CK Navigator lets teams colour matrix layers to show coverage, threat-actor profiles or test results. New versions are released roughly twice a year, so mappings need a recorded ATT&CK version.\n\nIts main uses are detection coverage analysis, threat-intelligence reporting, adversary emulation and red/purple teaming, and gap-driven security investment. MITRE also runs the ATT&CK Evaluations of commercial security products. Related MITRE projects cover adjacent needs: D3FEND catalogues defensive techniques, ATLAS covers attacks on AI and machine-learning systems, CAPEC catalogues attack patterns against software, and the Center for Threat-Informed Defense publishes mappings such as ATT&CK to NIST SP 800-53.\n\nCommon misuses are well documented, including by MITRE itself. A coloured-in matrix suggests completeness it cannot measure: a technique is not \"covered\" by one rule, because techniques have many procedures, and detection quality varies by platform and data source. Not every technique is equally relevant or detectable, so aiming for 100% coverage is a poor goal; prioritising by threat-actor relevance and prevalence works better. ATT&CK describes post-compromise behaviour at a finer grain than the Lockheed Martin Cyber Kill Chain, which models the intrusion as seven sequential phases, and it is not a risk framework or a maturity model. It complements indicators of compromise by operating near the top of the Pyramid of Pain, where attacker behaviour is expensive to change.","da":"ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) voksede ud af MITRE's Fort Meade Experiment fra 2013, et forskningsprojekt om detektion efter kompromittering i Windows-baserede virksomhedsnetværk, og blev offentliggjort i 2015. I dag har den tre domæner: Enterprise (Windows, macOS, Linux, cloudplatforme, identitetsudbydere, SaaS, netværksudstyr, containere og ESXi), Mobile og ICS. Enterprise-matricen har 14 taktikker, fra Reconnaissance (TA0043) og Resource Development (TA0042), der begge kom til i 2020, over Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection og Command and Control til Exfiltration og Impact.\n\nDatamodellen er et sæt sammenkædede objekter med stabile id'er. Taktikker (TAxxxx) er angriberens taktiske mål; teknikker (Txxxx) er måden, målet nås på, og siden version 7 (2020) er mange opdelt i subteknikker (Txxxx.yyy), fx T1003.001, OS Credential Dumping: LSASS Memory, eller T1539, Steal Web Session Cookie. Procedurer er konkrete, observerede udførelser dokumenteret som eksempler. Grupper (Gxxxx), software (Sxxxx), kampagner (Cxxxx) og mitigeringer (Mxxxx) er knyttet til de teknikker, de bruger eller modvirker. Version 18, udgivet i oktober 2025, erstattede den gamle detektionstekst og kortlægningen til datakilder pr. teknik med detection strategies (DETxxxx) og platformspecifikke analytics, der peger på logkilder, hvilket er en væsentlig ændring for alle, der vedligeholder dækningskortlægninger. Hele materialet udgives som STIX 2.1-bundter, og ATT&CK Navigator lader teams farvelægge lag af matricen for at vise dækning, profiler af trusselsaktører eller testresultater. Nye versioner udkommer cirka to gange om året, så kortlægninger bør angive, hvilken ATT&CK-version de bygger på.\n\nDe vigtigste anvendelser er analyse af detektionsdækning, rapportering af threat intelligence, emulering af angribere og red/purple teaming samt prioritering af sikkerhedsinvesteringer ud fra huller. MITRE står også for ATT&CK Evaluations af kommercielle sikkerhedsprodukter. Beslægtede MITRE-projekter dækker nabobehov: D3FEND katalogiserer defensive teknikker, ATLAS dækker angreb på AI- og maskinlæringssystemer, CAPEC katalogiserer angrebsmønstre mod software, og Center for Threat-Informed Defense udgiver kortlægninger som ATT&CK til NIST SP 800-53.\n\nTypiske fejlanvendelser er veldokumenterede, også af MITRE selv. En farvelagt matrix antyder en fuldstændighed, den ikke kan måle: en teknik er ikke \"dækket\" af én regel, fordi teknikker har mange procedurer, og detektionskvaliteten varierer med platform og datakilde. Ikke alle teknikker er lige relevante eller lige mulige at opdage, så 100 % dækning er et dårligt mål; prioritering efter relevans for de trusselsaktører, man møder, og efter udbredelse virker bedre. ATT&CK beskriver adfærd efter kompromittering mere finkornet end Lockheed Martins Cyber Kill Chain, der modellerer indbruddet som syv faser i rækkefølge, og den er hverken et risikorammeværk eller en modenhedsmodel. Den supplerer kompromitteringsindikatorer ved at arbejde nær toppen af Pyramid of Pain, hvor angriberens adfærd er dyr at ændre."},"edges":[{"type":"requires","to":"security/threat-actor","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/threat-hunting","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/threat-intelligence","why":{"en":"Reports about attacker groups use its numbers to say exactly which methods each group uses.","da":"Rapporter om angrebsgrupper bruger dens numre til at angive præcis, hvilke metoder hver gruppe bruger."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"security/threat-modelling","confidence":"high","strength":"normal"}],"depth":2,"sources":[{"title":"MITRE ATT&CK","url":"https://attack.mitre.org/","tier":"official-doc","publisher":"MITRE"},{"title":"MITRE ATT&CK: Design and Philosophy","tier":"official-doc","publisher":"MITRE"},{"title":"ATT&CK v18 - Detection Strategies, More Adversary Insights","url":"https://medium.com/mitre-attack/attack-v18-8f82d839ee9e","tier":"official-doc","publisher":"MITRE"}],"draft":true}