What is MITRE ATT&CK and how do teams actually use it?

MITRE ATT&CK is a public knowledge base of adversary tactics and techniques built from real-world observations. It gives defenders a shared vocabulary for describing what attackers do after they get in. Teams use it to map detection coverage, structure threat reports and plan adversary emulation. It is a reference, not a checklist or a product.

Where did it come from?

MITRE's FAQ says it started ATT&CK in 2013 to document common tactics, techniques and procedures that advanced persistent threats use against Windows enterprise networks. It grew out of a MITRE research project called FMX, which investigated using endpoint telemetry and analytics to improve detection of adversaries operating inside enterprise networks. ATT&CK served as the basis for testing the sensors and analytics in that project.

Today it covers more than Windows. The FAQ lists Windows, macOS, Linux, network infrastructure devices and containers, cloud systems including IaaS, SaaS, office suites and identity providers, and mobile devices on Android and iOS. MITRE says the content is updated twice a year, and it draws mainly on publicly available threat intelligence and incident reporting.

How is it organized?

Four words carry most of the model, and MITRE defines each one.

Tactics are the why: the adversary's goal, such as credential access. Techniques are the how: dumping credentials is a technique for reaching that goal. Sub-techniques are more specific behaviors, such as dumping credentials from a particular secrets store. Procedures are the specific implementation seen in the wild, such as a named group using a particular tool to scrape a process's memory. Procedures appear in the Procedure Examples section on technique pages.

When we fetched the Enterprise matrix page on 18 October 2026, it listed fifteen tactics: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration and Impact. Older articles show a tactic called Defense Evasion where this page now shows Stealth and Defense Impairment, so check the version you are reading. The site also announced version 20 and has sections for detections, detection strategies, analytics and data components.

What are the three common uses?

Detection coverage mapping. Take your detections, tag each with the technique it addresses, and shade the matrix. The blank areas are your conversation with leadership. It does not tell you the detections work, only that they exist.

Threat intelligence and reporting. When a report says a group uses a technique, you can look up what the technique means, how it is detected and what mitigations exist. Using the same IDs across teams removes arguments about what a word means.

Adversary emulation and testing. A purple team picks a few techniques that a relevant group has used, runs them safely in your environment and checks whether detections fired.

What does this look like with a small team?

Constructed example: a ten-person security team has two analysts. They list the five most likely intrusion paths for their business: phishing, stolen credentials on a SaaS account, a vulnerable internet-facing server, a malicious dependency and a rogue insider. For each they pick the three or four techniques that matter, check whether they have logs and a detection for each, and write down the gaps. Twelve techniques, a one-page table, and a quarter of work that is easy to justify.

What are the limits?

ATT&CK describes known behavior. Anything not yet public or not yet observed will not be there. Coverage of a technique is not binary: detecting one sub-technique in one way is not the same as covering it. And a high count of mapped techniques is not a measure of security. MITRE notes ATT&CK is complementary to other models such as the Diamond Model and the Cyber Kill Chain, so you do not have to choose one.

How to check or apply this

1. Pick the three to five attack paths most relevant to your business before you open the matrix.
2. For each path, list the techniques you expect, using the technique pages and their Procedure Examples.
3. Record, per technique, the log source you need and whether you collect it. Missing logs come before missing detections.
4. Write or tune one detection per priority technique, and note the sub-technique it covers.
5. Test each detection with a safe, authorized exercise and record the result.
6. Re-check after each ATT&CK release, since technique and tactic names change.
7. Use the IDs in tickets and reports so everyone reads the same thing.

Quick check

Sources

• MITRE ATT&CK, Frequently Asked Questions
• MITRE ATT&CK, Enterprise Matrix

Last reviewed: 18 October 2026.