Use MITRE ATT&CK tactics and techniques to describe an intrusion step by step and find detection gaps.
Why it matters
Defenders need a shared language for what attackers actually do. "We got hacked" is not useful. "Initial access by spearphishing attachment, execution through PowerShell, persistence with a scheduled task, then credential dumping" tells everyone which controls failed and which detections to build. MITRE ATT&CK is that language. It is used in SOC reports, threat intelligence, detection engineering, red team plans and vendor products, and you will be expected to use it.
What ATT&CK is
ATT&CK (Adversarial Tactics, Techniques and Common Knowledge) is a free, publicly available knowledge base maintained by MITRE, a US non-profit. It is built from real, publicly reported intrusions. Browse it at attack.mitre.org. Checked on 2026-10-23.
There are matrices for Enterprise (Windows, macOS, Linux, cloud, network, containers), Mobile and ICS (industrial control systems). Its building blocks:
- Tactics: the attacker's goal at a stage, the "why". Enterprise has 14.
- Techniques: how they achieve the goal, with IDs like
T1566. Many have sub-techniques, such asT1566.001(Spearphishing Attachment). - Procedures: specific ways a real group or malware used a technique.
- Groups and software: profiles of known threat actors and tools, with the techniques they use.
- Mitigations and detection guidance for each technique.
The 14 Enterprise tactics
| Tactic | Attacker's goal | Example technique |
|---|---|---|
| Reconnaissance | Gather information for planning | Gather victim identity information |
| Resource Development | Set up infrastructure and tools | Acquire infrastructure (domains, servers) |
| Initial Access | Get in | T1566 Phishing; T1190 Exploit Public-Facing Application |
| Execution | Run code | T1059 Command and Scripting Interpreter |
| Persistence | Stay in across reboots and resets | T1053 Scheduled Task/Job |
| Privilege Escalation | Get higher permissions | Exploitation for privilege escalation |
| Defense Evasion | Avoid being detected | T1070 Indicator Removal (for example clearing logs) |
| Credential Access | Steal passwords and tokens | T1003 OS Credential Dumping; T1110 Brute Force |
| Discovery | Learn the environment | Account and network discovery |
| Lateral Movement | Move to other systems | T1021 Remote Services (RDP, SSH, SMB) |
| Collection | Gather the data they want | Data from local system |
| Command and Control | Communicate with compromised systems | T1071 Application Layer Protocol (for example HTTPS) |
| Exfiltration | Steal the data | T1567 Exfiltration Over Web Service |
| Impact | Disrupt or destroy | T1486 Data Encrypted for Impact (ransomware) |
Attacks do not have to use every tactic or go in this order, but the columns roughly follow an intrusion from start to finish.
T1078 Valid Accounts is worth remembering separately: using stolen but real credentials appears under several tactics (initial access, persistence, privilege escalation, defense evasion), and it is one of the hardest things to detect because the logins look legitimate.
Worked example: mapping an incident
An incident report summary:
- An accountant opened an emailed Word document and enabled macros.
- The macro launched PowerShell, which downloaded a tool.
- The tool created a scheduled task to run at every logon.
- The attacker dumped credentials from memory and found a domain admin's password.
- They used Remote Desktop to reach the file server.
- They compressed the finance share and uploaded it to a cloud storage service.
- They encrypted the file server and left a ransom note.
Mapped to ATT&CK:
| Step | Tactic | Technique |
|---|---|---|
| 1 | Initial Access | T1566.001 Phishing: Spearphishing Attachment |
| 1 | Execution | T1204.002 User Execution: Malicious File |
| 2 | Execution | T1059.001 Command and Scripting Interpreter: PowerShell |
| 3 | Persistence | T1053.005 Scheduled Task/Job: Scheduled Task |
| 4 | Credential Access | T1003 OS Credential Dumping |
| 5 | Lateral Movement | T1021.001 Remote Services: Remote Desktop Protocol |
| 5 | Defense Evasion / Persistence | T1078 Valid Accounts |
| 6 | Collection / Exfiltration | T1560 Archive Collected Data; T1567 Exfiltration Over Web Service |
| 7 | Impact | T1486 Data Encrypted for Impact |
Note that one step can map to more than one technique, and that is normal. Mapping with the exact sub-technique where you can makes the result more useful.
Using the map
Once mapped, ATT&CK becomes a planning tool:
- Detection gaps. For each technique, ask: did we have a log source and an alert? Here, Office spawning PowerShell (step 2) and new scheduled tasks (step 3) are both detectable with Sysmon or EDR; if nothing fired, those are the first detections to build.
- Mitigations. Blocking macros from internet files, restricting PowerShell, protecting credential memory (for example Credential Guard on Windows) and limiting RDP would each break the chain.
- Coverage heat maps. The free ATT&CK Navigator lets you colour techniques by coverage, compare to the techniques a threat group uses, and share layers with your team.
- Testing. Red teams and open-source tools such as Atomic Red Team run small, safe tests per technique so you can check that detections fire (in a lab or with permission).
Related models you will see: the Cyber Kill Chain (Lockheed Martin, seven high-level stages) and the Pyramid of Pain (detecting attacker behaviour hurts them more than blocking an IP or hash). ATT&CK is the most detailed and the most used day to day.
Common mistakes
- Treating ATT&CK as a checklist to "complete". Covering every technique is impossible; prioritise the ones relevant to your environment and threats.
- Mapping guesses as facts. Map what evidence shows; mark assumptions.
- Stopping at the tactic. "Persistence" is too vague to build a detection; the technique is the useful level.
Quick recap
- MITRE ATT&CK is a free knowledge base of real attacker behaviour: tactics (why), techniques and sub-techniques (how), procedures (real examples).
- Enterprise has 14 tactics from Reconnaissance to Impact.
- Map each step of an incident to techniques, then use the map to find detection gaps, choose mitigations and plan tests.