MITRE ATT&CK is a knowledge base of adversary behavior. It organizes behavior into tactics, which are the attacker's goals; techniques, which are the ways they reach those goals; and sub-techniques, which describe the behavior more specifically. It gives defenders a shared vocabulary instead of vendor specific names.
The three levels
MITRE's own FAQ puts it simply. Tactics are the why: the tactical goal, such as credential access. Techniques are the how: the way an attacker achieves that goal. Sub-techniques describe the behavior at a more specific level than a technique.
An example from the knowledge base: Credential Access is the tactic. OS Credential Dumping is a technique. LSASS Memory is a sub-technique, with the identifier T1003.001. The identifier is useful because it is stable across tools and reports.
What is in the matrices
The FAQ describes ATT&CK for Enterprise, covering behavior against enterprise IT networks and cloud, and ATT&CK for Mobile, covering behavior against mobile devices. The site navigation also lists an industrial control systems matrix. MITRE began the work in 2013.
What defenders do with it
Label detections. Tag each rule with the technique it covers. Now you can see which areas have rules and which have none.
Read threat reports. Reports that cite technique IDs can be compared directly with your coverage list.
Plan exercises. A red team or tabletop can be built around techniques relevant to your environment.
Report to leadership. A coverage view by tactic is easier to explain than a list of rule names.
Cautions
A label on a rule is not proof it works. A rule tagged with a technique may catch one tool or one variant. Test each rule with real or simulated activity before counting it.
Coverage numbers can mislead. A matrix that is "covered" at the technique level may have no depth at the sub-technique level. Also, techniques are not equal. Some matter far more to your environment than others.
Finally, ATT&CK describes behavior, not your risk. Decide what to cover first based on what your assets and likely adversaries are.
A small starting exercise
- Pick three techniques that fit your environment, for example credential theft on Windows servers.
- For each, write down which log source would show it.
- Check you actually collect that log.
- Check you have a rule, and when it was last tested.
The gaps you find are your backlog.
Where beginners get stuck
Newcomers often try to memorize the matrix. Do not. Learn the tactic names, which tell the story of an intrusion from entry to goal, and look up techniques when a report or an alert points at one.
Another trap is treating the matrix as a checklist to be filled in green. Coverage is a conversation about evidence: which log shows it, which rule catches it, when it was last tested.
Quick check
Is ATT&CK a framework I must comply with?
No. It is a free knowledge base and vocabulary. It is not a regulation or a certification.
Do I need to cover every technique?
No. Prioritize by your environment and threats, then deepen coverage over time.
Sources
Last reviewed: 19 October 2026.
