What is the MITRE ATT&CK framework?

MITRE ATT&CK explained

When a security team investigates a breach, the technical details rarely repeat exactly. Malware families change, infrastructure shifts, and tools vary from one intrusion to the next. But the underlying behaviors tend to stay the same: an adversary who steals credentials, moves laterally, and exfiltrates data follows a recognizable pattern across countless investigations. ATT&CK captures those patterns. Each entry is grounded in real incidents documented by security researchers, threat hunters, and incident responders, so defenders can rely on verified behaviors rather than speculative models.

Importantly, ATT&CK focuses on post-compromise behavior. It assumes an adversary has gained access and maps the actions that follow, helping teams understand how an attack progresses and how each step fits into the wider campaign. MITRE began the project internally in 2013 as part of a research effort to improve post-compromise detection using endpoint telemetry, and released it publicly in 2015. It has since grown into an indispensable reference maintained with input from a global community, updated on a regular cadence as adversary tradecraft evolves.

Why MITRE ATT&CK matters

Traditional detection leaned heavily on Indicators of Compromise (IoCs) such as file hashes, IP addresses, and domains. The problem is that attackers can change these trivially, so indicator-based defenses only capture a single moment in time. ATT&CK addresses four gaps that older approaches left open: it centers on adversary behaviors rather than ephemeral indicators; it is detailed enough to map directly to defensive analytics, unlike high-level lifecycle models; it is grounded in observed real-world incidents; and it provides a common taxonomy so behaviors can be compared consistently across different adversary groups. The result is a shared, precise vocabulary that lets analysts, responders, Cyber Threat Intelligence (CTI) teams, and red teams collaborate without ambiguity, turning security from a reactive function into a proactive, threat-informed discipline.

The MITRE ATT&CK matrices

ATT&CK organizes tactics and techniques into visual matrices, with tactics as columns across the top and the techniques that achieve each tactic listed beneath. There are three primary matrices, each covering a different domain:

• Enterprise matrix: Adversary behavior against Windows, macOS, and Linux, plus cloud platforms (AWS, Azure, Google Cloud), Software as a Service (SaaS), network devices, and containers. It also includes a PRE section for pre-attack, preparatory techniques.
• Mobile matrix: Techniques used against Android and iOS devices, including both on-device attacks and network-based mobile attacks.
• ICS matrix: Techniques targeting industrial control systems and operational technology, the machinery, sensors, and networks that run factories, utilities, and other critical services.

Because the matrices are platform-specific, an Enterprise user can filter down to just the techniques relevant to their stack, which keeps analysis focused and practical.

MITRE ATT&CK tactics, techniques, and sub-techniques

The framework is built on a simple but powerful hierarchy: tactics describe what an attacker is trying to achieve, techniques describe how they do it, and sub-techniques describe specific variations of a method. Procedures, at the most granular level, are the actual real-world implementations observed in campaigns.

Tactics: the attacker's objectives

Each tactic represents an adversarial goal at a given phase of an intrusion. The Enterprise matrix currently defines 14 tactics that span the attack lifecycle:

• Reconnaissance: Gathering information to plan the attack.
• Resource development: Acquiring or building infrastructure, accounts, or tools.
• Initial access: Gaining a foothold in the target environment.
• Execution: Running malicious code on a system.
• Persistence: Maintaining access across reboots or credential changes.
• Privilege escalation: Obtaining higher-level permissions.
• Defense evasion: Avoiding detection while operating inside the environment.
• Credential access: Stealing usernames, passwords, and tokens.
• Discovery: Learning about the systems, accounts, and network layout.
• Lateral movement: Moving from one system to another inside the environment.
• Collection: Gathering data of interest to the attacker.
• Command and control (C2): Communicating with and directing compromised systems.
• Exfiltration: Stealing data out of the environment.
• Impact: Disrupting, corrupting, encrypting, or destroying data and systems.

Techniques and sub-techniques: the methods

If tactics are the goal, techniques are the execution. The Enterprise matrix documents hundreds of techniques (over 200) and hundreds more sub-techniques. For example, the broad Phishing technique breaks down into Spearphishing Attachment, Spearphishing Link, and Spearphishing via Service. Each technique entry includes a description, the platforms it affects, the threat groups known to use it, detection data sources, and recommended mitigations. Sub-techniques add the specificity defenders need to build precise detections.

Procedures: real-world implementations

Procedures are the concrete ways a specific tool, malware family, or group carries out a technique. They ground the framework in reality, so a defender can study exactly how an observed adversary put a technique into practice, for example using a tool like Mimikatz for credential access.

The Pyramid of Pain: why behaviors beat indicators

A useful way to understand ATT&CK's value is the Pyramid of Pain, which ranks indicators by how much difficulty they cause an attacker when a defender blocks them. At the bottom sit trivial indicators like file hashes, followed by IP addresses and domain names, all of which an adversary can change in seconds. Higher up are network and host artifacts, then the tools an attacker uses. At the very top are TTPs, the tactics, techniques, and procedures that describe how the adversary actually operates. Forcing an attacker to change their TTPs is the hardest blow a defender can land, because it means rebuilding their entire approach. ATT&CK is a structured catalog of that top tier, which is why detections built around it are so durable.

Beyond the matrix: groups, software, campaigns, and the Navigator

ATT&CK is more than a grid of tactics and techniques. It also provides connected objects that add real-world context, and a tool to work with all of it.

• Groups: Tracked clusters of adversary activity (threat actors or intrusion sets), each linked to the techniques and software they use. Because vendors name groups differently, a single group often carries several aliases.
• Software: The malware and legitimate tools used in intrusions (from custom malware to utilities like Mimikatz or PsExec), each mapped to the techniques it performs and the groups that use it.
• Campaigns: Defined operations over a time period, letting teams study an intrusion end to end, including the techniques, software, and groups involved.
• Mitigations and data sources: Indexes of the defensive measures that address techniques, and the log or telemetry sources that reveal them.
• ATT&CK Navigator: A free, open-source tool for searching, filtering, annotating, and visualizing the knowledge base, for example to overlay detection coverage against the techniques a specific group uses. It can export to JSON, Excel, or SVG.

MITRE ATT&CK vs. Cyber Kill Chain

ATT&CK is often compared to Lockheed Martin's Cyber Kill Chain. Both model attacks as a sequence of adversarial stages, and some stage names even overlap, but they serve different purposes.

The Cyber Kill Chain is a helpful high-level model of an attack, while ATT&CK is the detailed, operational reference that maps specific attacker behaviors to concrete detections and mitigations. Many teams use both: the kill chain to communicate at a strategic level, and ATT&CK to do the hands-on defensive work.

How organizations use MITRE ATT&CK

ATT&CK supports a wide range of security activities, from daily operations to long-term planning. The most common use cases include:

Threat detection and detection engineering

Teams map their alerts, rules, and analytics to ATT&CK techniques to see which behaviors they currently detect and where gaps remain. Because detections are built around behavior rather than signatures, they keep working even when attackers swap tools. This matters more every year, as a large share of intrusions are now malware-free and rely on legitimate tools and stolen credentials.

Threat hunting

Hunters use ATT&CK to guide hypothesis-driven searches. Observing one technique, such as the use of valid credentials, points them toward related techniques for credential theft, lateral movement, and persistence, so they can follow an adversary's likely path rather than searching blindly.

Threat intelligence

Analysts map incident reports and research to ATT&CK, building a durable, structured dataset of adversary behavior. Recurring techniques across many reports reveal which behaviors matter most in a given industry, helping teams prioritize the detections that will have the greatest impact.

Red teaming and adversary emulation

Red teams build exercises around the real techniques a specific adversary uses, rather than generic penetration tests. Emulating a known group means following its documented TTPs step by step, which tests whether defenders can detect and interrupt that exact sequence.

Gap analysis and SOC maturity

By comparing detection coverage against the matrix, organizations run security gap analyses and assess the maturity of their security operations, using the results to prioritize investment where it reduces the most risk.

How to implement MITRE ATT&CK

Most organizations adopt ATT&CK in phases rather than trying to cover the entire matrix at once. A practical path looks like this:

1. Map and analyze gaps: Map existing preventive and detective controls to ATT&CK techniques (the Navigator helps), then identify which techniques lack coverage.
2. Prioritize by relevance: Not every technique carries equal risk. Focus first on techniques that appear frequently in your industry or are used by the adversaries most likely to target you.
3. Ensure the right telemetry: Behavioral detection depends on data. Collect process execution logs, PowerShell logging, file and registry changes, network connections, and authentication events, since many gaps come from missing logs rather than weak logic.
4. Build and test detections: Translate techniques into analytics, then validate them against realistic tests (tools like Atomic Red Team help) and refine until they hold up against variations.
5. Mature over time: Progress from understanding the framework, to tracking techniques in incidents, to analyzing coverage regularly, to fully integrating ATT&CK into detection engineering, hunting, and reporting workflows.

Benefits and limitations

The benefits of ATT&CK are substantial:

• Durable detection: Behavioral detections survive tool changes and infrastructure rotation.
• Shared language: A common taxonomy accelerates collaboration across analysts, hunters, and red teams.
• Data-driven investment: Coverage mapping drives decisions about where to allocate budget and effort.
• Focused prioritization: Teams concentrate on the techniques most used against their sector, not the entire matrix at once.
• Adversary-aligned defense: Detections reflect how attackers actually operate, not how defenders assume they might.

The limitations are worth naming too. ATT&CK does not prescribe tools or vendors, so each organization must decide which controls fit its environment. It depends on mature telemetry, so teams without solid logging and endpoint or cloud visibility face upfront work before they can use it fully. And accurate behavior mapping takes experienced analysts who can distinguish malicious technique execution from legitimate administration. None of these undercut its value; they simply mean ATT&CK is a foundation to build on, not a switch to flip.

Expert insight: ATT&CK is only useful if your detection is actually mapped to it

Mapping a handful of alerts to a few technique IDs is straightforward; maintaining broad, current, behavior-based coverage across the matrix is not. Sekoia builds ATT&CK into the core of its platform. The Sekoia Defend Security Information and Event Management (SIEM) ships with around 1,000 detection rules mapped to MITRE ATT&CK techniques, so coverage is native rather than something each customer has to assemble by hand. Those rules are continuously created and updated by an in-house Threat Detection & Research (TDR) team that tracks named adversary groups first-hand, including actors such as APT28, APT29, Turla, and others, and translates their observed TTPs directly into detections.

This is the practical payoff of a CTI-led model. Because Sekoia Intelligence feeds the platform with first-hand research rather than only third-party feeds, detections track how real groups behave and map cleanly to ATT&CK techniques, which makes gap analysis and threat hunting far more grounded. As a European vendor, Sekoia also brings a data sovereignty posture that large US-based providers rarely match, and its unified SOC platform ties ATT&CK-aligned detection to automated incident response in one place. ATT&CK is free to everyone; what differs is how rigorously and how currently your detection is mapped to it.

‍

Frequently asked questions