MITRE ATT&CK

MITRE ATT&CK is a comprehensive knowledge base of adversary tactics and techniques based on real-world cyberattack observations. MITRE ATT&CK consists of techniques and sub-techniques that describe adversary behavior at a high level of detail. Each technique includes a description of the adversary's goal, the data sources that can detect the technique, and recommended mitigations.

The MITRE ATT&CK framework is organized into 14 tactics, from initial access to impact. Each tactic contains a number of techniques, and each technique may have a number of sub-techniques. The tactics and techniques are organized in a matrix, which allows security teams to quickly see what techniques are associated with each tactic and how they relate to each other.