How do you implement MITRE ATT&CK techniques in your detections?

Implementing ATT&CK techniques means choosing a small set that matter to you, confirming you collect the data that reveals them, writing detections with matching tests, and tracking coverage honestly. Do not try to cover the whole matrix. Start with five techniques and prove each one works.

What is ATT&CK for, in MITRE's words?

MITRE's FAQ describes ATT&CK as a knowledge base of cyber adversary behavior and taxonomy for adversarial actions across their lifecycle. It started in 2013 to document common tactics, techniques and procedures used by advanced persistent threats against Windows enterprise networks, and it covers enterprise systems, cloud and mobile today. The content comes mainly from public threat intelligence and incident reporting. MITRE says it can be used for security operations, threat intelligence and security architecture, and that it is updated twice a year. It also notes ATT&CK complements other models rather than replacing them.

How do you choose the first five?

Do not start from the matrix grid. Start from risk.

1. List the intrusions you fear most or have seen: ransomware, business email compromise, a stolen cloud key.
2. For each, ask which techniques appear. Technique pages list procedure examples, which are observed uses by named groups and software, so you can see which techniques are common in your threat type.
3. Pick five that are common, high impact and visible in logs you already have.

Constructed example for a company worried about ransomware: PowerShell execution (T1059.001), because the technique page lists a ransomware family running PowerShell commands to delete system volume shadow copies; remote access tools (T1219), because attackers keep access with legitimate tools; plus credential dumping, valid account use and one exfiltration technique.

How do you turn a technique into a detection?

For each technique, work through the same short sheet:

1. Read the technique page and write down the behavior in one plain sentence.
2. Identify the data that would show it. Process creation with command lines for PowerShell. Software inventory and network logs for remote tools.
3. Confirm the data actually reaches your log system with the fields you need. This step fails more often than any other.
4. Write the detection at the right level. A rule on one command string catches one procedure. A rule on the behavior catches more but alerts more often.
5. Test it by running a benign simulation that performs the behavior in a lab, and confirm the alert fires. A rule that has never fired in a test is a guess.
6. Record the false positives you saw and how you tuned them.
7. Add a response step: what an analyst should do when it fires.

How do you track coverage honestly?

Tag each rule with a technique or sub-technique ID, and tag each test with the procedure it simulates. Then report coverage as three states, not one: data available, rule exists and tested, and rule exists but untested. A colored heat map that marks a technique green because one rule exists will mislead leadership.

Remember that sub-techniques are categories and procedures are observed implementations. A rule that fires on one procedure does not cover the whole sub-technique. PowerShell, for instance, can run through the underlying .NET interfaces without launching the usual executable, as the technique page notes, so a rule that depends on that process name has a gap.

How do you keep up with changes?

MITRE publishes new versions about twice a year and data is available through its published data and tools, which include APIs. Re-pull IDs on each release, review deprecated or merged techniques, and update your mapping. The live site currently carries a banner for version 20, so check which version your tools reference.

How to check or apply this

1. Choose five techniques from your own threat list.
2. Fill in the sheet above for each one.
3. Run a test for each and keep the result.
4. Publish a coverage table with the three states.
5. Review it every quarter and after any real incident.
6. Add five more only when the first five are tested and tuned.

Quick check

Sources

• MITRE ATT&CK FAQ
• T1059.001, Command and Scripting Interpreter: PowerShell
• T1219, Remote Access Tools

Last reviewed: 18 October 2026.