MITRE ATT&CK: tactics, techniques and procedures for defenders
In short: MITRE ATT&CK is a free, public knowledge base of how real attackers behave, organised into tactics (goals) and techniques (methods). Defenders use it as a common language to describe incidents, map detections and find gaps in their coverage.
What ATT&CK is
MITRE ATT&CK (Adversarial Tactics, Techniques and Common Knowledge) is a freely available knowledge base maintained by MITRE, a US not-for-profit organisation. It is built from public reports of real intrusions, so every technique describes something attackers have actually done. There are separate matrices for Enterprise (Windows, Linux, macOS, cloud, network devices and more), Mobile and ICS (industrial control systems). It is updated regularly, so always check which version a document refers to.
Its biggest value is a shared language. When one analyst writes "T1566.001" and another reads it, both know they mean spearphishing with an attachment, whichever tool or vendor they use.
Tactics, techniques and procedures
Tactics are the columns of the matrix: the "why" of each step. The Enterprise matrix has around fourteen, including:
| Tactic | Attacker goal | Example technique |
|---|---|---|
| Initial Access | Get a foothold | Phishing (T1566) |
| Execution | Run code | Command and Scripting Interpreter (T1059) |
| Persistence | Survive reboots and resets | Scheduled Task/Job (T1053) |
| Credential Access | Steal passwords and tokens | OS Credential Dumping (T1003) |
| Lateral Movement | Move to other systems | Remote Services (T1021) |
| Exfiltration | Take data out | Exfiltration Over Web Service (T1567) |
| Impact | Disrupt or destroy | Data Encrypted for Impact (T1486) |
Others cover reconnaissance, resource development, privilege escalation, defence evasion, discovery, collection and command and control. Techniques are the "how", and many are split into sub-techniques (for example T1059.001 for PowerShell). Procedures are the specific ways named groups or malware have used a technique, listed on each technique page.
Using ATT&CK in defence
- Describing incidents: tag each step of an incident timeline with technique IDs, so reports are consistent and comparable.
- Detection engineering: tag rules with techniques (see detection engineering) and plan new ones from technique pages.
- Threat hunting: pick a technique used by a relevant group and search your data for signs of it.
- Purple teaming: red and blue teams agree a list of techniques to emulate in a controlled, authorised exercise and check what was detected.
- Mitigation planning: technique pages link to mitigations such as multi-factor authentication or application control.
Gap analysis
The free ATT&CK Navigator tool lets you colour techniques in layers, for example one layer for techniques used by groups that target your sector and another for techniques you can detect. Overlaying them shows where likely attacker behaviour meets weak defences. Prioritise those gaps, considering the data sources you need and the effort involved.
Avoid two traps. First, do not chase 100 per cent coverage: some techniques are rare or nearly impossible to detect reliably, and a fully green map can hide weak rules. Second, ATT&CK is not a maturity model or a checklist for compliance; it is a reference for thinking clearly about behaviour.
Tip: when you write up a home lab investigation for a portfolio, add the ATT&CK technique IDs. Employers notice.
Practice
What is the difference between a tactic and a technique in ATT&CK?
Name two ways a SOC can use ATT&CK day to day.
Why is a fully coloured coverage map not proof of good security?
Key takeaways
- ATT&CK is a public knowledge base of real attacker behaviour.
- Tactics are goals; techniques and sub-techniques are methods; procedures are real examples.
- Technique IDs give analysts and tools a shared language.
- Use it for detection, hunting, purple teaming and mitigation planning.
- Gap analysis compares likely attacker techniques with your real defences.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.