MITRE ATT&CK

ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) grew out of MITRE's 2013 Fort Meade Experiment, a research project on post-compromise detection in Windows enterprise networks, and was released publicly in 2015. It now has three domains: Enterprise (Windows, macOS, Linux, cloud platforms, identity providers, SaaS, network devices, containers and ESXi), Mobile and ICS. The Enterprise matrix has 14 tactics, from Reconnaissance (TA0043) and Resource Development (TA0042), both added in 2020, through Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection and Command and Control, to Exfiltration and Impact.

The data model is a set of linked objects with stable identifiers. Tactics (TAxxxx) are the adversary's tactical goals; techniques (Txxxx) are how a goal is achieved, and since version 7 (2020) many are split into sub-techniques (Txxxx.yyy), for example T1003.001, OS Credential Dumping: LSASS Memory, or T1539, Steal Web Session Cookie. Procedures are concrete observed implementations documented as examples. Groups (Gxxxx), software (Sxxxx), campaigns (Cxxxx) and mitigations (Mxxxx) link to the techniques they use or counter. Version 18, released in October 2025, replaced the old per-technique detection text and data-source mappings with detection strategies (DETxxxx) and platform-specific analytics that point to log sources, a significant change for anyone maintaining coverage mappings. The whole corpus is published as STIX 2.1 bundles, and the ATT&CK Navigator lets teams colour matrix layers to show coverage, threat-actor profiles or test results. New versions are released roughly twice a year, so mappings need a recorded ATT&CK version.

Its main uses are detection coverage analysis, threat-intelligence reporting, adversary emulation and red/purple teaming, and gap-driven security investment. MITRE also runs the ATT&CK Evaluations of commercial security products. Related MITRE projects cover adjacent needs: D3FEND catalogues defensive techniques, ATLAS covers attacks on AI and machine-learning systems, CAPEC catalogues attack patterns against software, and the Center for Threat-Informed Defense publishes mappings such as ATT&CK to NIST SP 800-53.

Common misuses are well documented, including by MITRE itself. A coloured-in matrix suggests completeness it cannot measure: a technique is not "covered" by one rule, because techniques have many procedures, and detection quality varies by platform and data source. Not every technique is equally relevant or detectable, so aiming for 100% coverage is a poor goal; prioritising by threat-actor relevance and prevalence works better. ATT&CK describes post-compromise behaviour at a finer grain than the Lockheed Martin Cyber Kill Chain, which models the intrusion as seven sequential phases, and it is not a risk framework or a maturity model. It complements indicators of compromise by operating near the top of the Pyramid of Pain, where attacker behaviour is expensive to change.