What is MITRE ATT&CK®?

First published in 2013 from internal MITRE research, ATT&CK has become the de facto standard for describing attacker behavior. The Enterprise matrix covers 14 tactics (Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, plus Reconnaissance and Resource Development for pre-compromise activity) and several hundred techniques and sub-techniques. A tactic answers "why" (the adversary's objective at that stage); a technique answers "how" (the specific method used to achieve it).

Each technique page documents a behavior description, procedure examples pulled from real campaigns (linking specific threat actors and malware families to that technique), detection guidance naming the data sources that would surface it (process creation logs, DNS query logs, Windows Event ID 4688), and mitigations. Sub-techniques break broad techniques into concrete variants: T1059 (Command and Scripting Interpreter) has sub-techniques for PowerShell, Windows Command Shell, and Unix Shell, each with distinct log signatures.

The ATT&CK Navigator tool visualizes detection coverage as a heat map over the matrix, letting a team mark which techniques have a working detection rule, which are only partially covered, and which have none. That gap map drives detection engineering roadmaps and informs tool procurement: if Lateral Movement techniques are consistently dark, that argues for better East-West network visibility rather than another endpoint agent.

ATT&CK also underpins adjacent frameworks. CTI vendors publish actor profiles as ATT&CK technique lists so defenders can directly compare a group's known TTPs against their own coverage map. Purple team exercises use ATT&CK to script what the red team will attempt and what the blue team should detect, turning a subjective "did we catch it" into a technique-by-technique scorecard. D3FEND, a companion MITRE project, maps specific defensive countermeasures to the offensive techniques they mitigate, closing the loop from technique to control.