MITRE ATT&CK in 2026: tactics, techniques and the new detection model

What it is

MITRE ATT&CK (Adversarial Tactics, Techniques and Common Knowledge) is a curated, freely available catalogue of how real attackers behave, built from public threat reporting. It is organised into three domains: Enterprise (Windows, Linux, macOS, cloud, network devices, containers and more), Mobile and ICS (industrial control systems).

• Tactics are the attacker’s goals, such as Initial Access, Persistence, Lateral Movement or Exfiltration.
• Techniques and sub-techniques are the ways of achieving them, each with an ID such as T1059 (Command and Scripting Interpreter).
• Procedures are specific observed uses, linked to groups, software and campaigns.
• Mitigations and detection guidance describe how to prevent or spot each technique.

Why it matters

Before ATT&CK, each vendor and team described attacks in its own words. ATT&CK gave threat intelligence analysts, detection engineers, red teams and managers one vocabulary. It is used to map threat reports to concrete behaviours, measure detection coverage, plan adversary emulation and purple team exercises, and compare security products against the same behaviours.

What changed recently

Version 18 (October 2025) was a major change on the defensive side. Free-text detection notes in each technique were replaced by structured Detection Strategies, each made up of Analytics that describe what to look for on a given platform. Data Components were heavily revised and the older Data Sources objects were deprecated. The Enterprise domain alone gained hundreds of detection strategies and well over a thousand analytics.

Version 19 (April 2026) split the long-standing Defense Evasion tactic, which had grown into a catch-all, into two tactics: Stealth (TA0005, hiding activity) and Defense Impairment (TA0112, actively disabling or degrading defences such as firewalls and security tools). The Enterprise matrix now has 15 tactics and 222 techniques. New techniques also reflect generative AI, such as querying public AI services and generating content, and ICS gained sub-techniques for the first time. Mobile began receiving detection strategies too.

Note: If your SIEM rules, reports or dashboards are tagged with TA0005 as "Defense Evasion", review them after moving to v19 content. Some techniques now sit under Defense Impairment instead.

How practitioners apply it

1. Threat-informed prioritisation. Pick the groups and campaigns relevant to your sector and region, and list the techniques they use.
2. Coverage mapping. For each priority technique, record whether you have telemetry, a detection and a tested response. ATT&CK Navigator layers are the common way to visualise this.
3. Detection engineering. Use the v18+ detection strategies as a starting point, then adapt analytics to your log sources. Tag rules with technique IDs.
4. Emulation and testing. Run safe, documented tests in a lab or controlled production window to prove that detections fire.
5. Pair with defence models. MITRE D3FEND describes countermeasures in a compatible way.

Here is a short example of the mapping in action. A threat report says an intrusion began with a phishing email carrying a malicious attachment, then used PowerShell to download tools, created a scheduled task to survive reboots and finally copied data to cloud storage. In ATT&CK terms that is Phishing (Initial Access), Command and Scripting Interpreter (Execution), Scheduled Task/Job (Persistence) and Exfiltration Over Web Service (Exfiltration). Each ID points to detection strategies, mitigations and other groups that use the same behaviour, so the team can check its controls behaviour by behaviour rather than reacting only to the specific file hashes in the report.

Network engineers will recognise many techniques, for example Network Service Discovery, Remote Services and protocol tunnelling. Linking ATT&CK coverage to your firewalls and IDS/IPS design is a good exercise.

Limitations and open questions

• It reflects reported behaviour. Techniques that are rarely written up publicly are under-represented, and reporting is biased towards certain regions and sectors.
• Coverage is not security. A heat map full of green squares can hide weak, noisy or untested detections. Depth and quality matter more than breadth.
• Version churn. Twice-yearly releases (with minor updates between) mean mappings drift. Record which version your content uses.
• Granularity varies. Some techniques are very broad, others very narrow, which makes counting coverage misleading.

An open research question is how to weight techniques. Some behaviours appear in almost every intrusion, while others are rare but devastating. Projects that rank techniques by prevalence, choke-point value and ease of detection are useful complements, but there is no single agreed method yet.