What are MITRE ATT&CK techniques, tactics and sub-techniques?

In MITRE ATT&CK, a tactic is the adversary's goal at a stage of an operation, a technique is how they achieve it, and a sub-technique is a more specific way of doing that. Together they give security teams a shared vocabulary for describing and testing attacker behavior.

How does ATT&CK organize behavior?

MITRE describes ATT&CK as a knowledge base of adversary tactics and techniques based on real-world observations. Its Enterprise matrix covers these platforms: Windows, macOS, Linux, PRE, Office Suite, Identity Provider, SaaS, IaaS, Network Devices, Containers and ESXi. Mobile and ICS have their own matrices.

Tactics answer why. MITRE's tactics page gives the example that an adversary may want to achieve credential access. Techniques answer how: the page says an adversary may dump credentials to achieve credential access. Sub-techniques break a technique into specific variants.

On 18 October 2026, the MITRE site listed 15 Enterprise tactics, 227 techniques and 479 sub-techniques. These numbers change between releases, so check the current page rather than quoting this one.

What are the Enterprise tactics?

As listed on MITRE's site, each described as what the adversary is trying to do:

1. Reconnaissance: gather information to plan future operations.
2. Resource Development: establish resources to support operations.
3. Initial Access: get into your network.
4. Execution: run malicious code or instructions on a system.
5. Persistence: maintain a foothold.
6. Privilege Escalation: gain higher-level permissions.
7. Stealth: hide and conceal actions, appearing as normal behavior.
8. Defense Impairment: break security mechanisms, pipelines and tooling so defenders cannot see or trust what is happening.
9. Credential Access: steal account names and passwords.
10. Discovery: figure out your environment.
11. Lateral Movement: move through your environment.
12. Collection: gather data of interest.
13. Command and Control: communicate with compromised systems.
14. Exfiltration: steal data.
15. Impact: manipulate, interrupt or destroy systems and data.

The order is a rough lifecycle, not a script. Real intrusions skip, repeat and reorder.

How do you read a technique page?

Take T1078.003, Valid Accounts: Local Accounts. The ID tells you the technique (T1078) and sub-technique (.003). The description says adversaries may obtain and abuse credentials of a local account for initial access, persistence, privilege escalation or defense evasion, and that password reuse may allow lateral movement across machines. The page then lists groups and campaigns that used it. For example, it records that APT29 targets dormant or inactive accounts, such as those of people who no longer work at the organization.

Technique pages are linked to defenses as well: mitigations, detection strategies, analytics, assets and data components, plus threat intelligence in the form of groups, software and campaigns. That linkage is the reason to use ATT&CK instead of a flat list.

A constructed example

A security engineer wants to test whether the team would notice an attacker moving between servers. She picks the Lateral Movement tactic, chooses a technique that applies to the environment, and reads its detection strategies. She runs a small, authorized simulation, checks which log source recorded it, and writes down that the alert did not fire. The gap becomes a ticket with an ATT&CK ID, so everyone knows exactly what was tested.

How to check or apply this

1. Pick the matrix and platforms that match what you run, and ignore the rest.
2. Choose a short list of techniques tied to threats you care about, using the groups and campaigns listed on technique pages.
3. For each, record whether you can prevent it, detect it, or neither.
4. Test detections with authorized simulations and record the result per technique ID.
5. Tag alerts, incidents and reports with ATT&CK IDs, so trends are searchable.
6. Re-check after each ATT&CK release, since techniques are added, merged and renamed.

Quick check

Sources

• MITRE ATT&CK, Enterprise Tactics, fetched 18 October 2026.
• MITRE ATT&CK, Enterprise Techniques, fetched 18 October 2026.
• MITRE ATT&CK, Enterprise Matrix and Resources.
• MITRE ATT&CK T1078.003, Valid Accounts: Local Accounts.

Last reviewed: 18 October 2026.