The MITRE ATT&CK Framework: Tactics, Techniques & Coverage
What MITRE ATT&CK is: tactics vs techniques vs sub-techniques, the Enterprise, Mobile and ICS matrices, groups and software, and coverage mapping.
Defenders used to describe attacks in whatever words came to hand. One team's "lateral movement" was another team's "pivoting", and neither could tell whether their detections overlapped or left a hole. MITRE ATT&CK fixed that by giving the whole field a shared, structured vocabulary for how adversaries actually behave.
ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge. It is a free knowledge base, curated by MITRE from observed real-world intrusions, that catalogs what attackers do once they are inside or trying to get in. It is descriptive rather than prescriptive: it documents behaviour seen in the wild, gives each behaviour a stable identifier, and lets defenders map their own coverage against it.
The three layers: tactics, techniques, sub-techniques
The framework's structure is the first thing to learn, because everything else hangs off it.
Tactics are the adversary's goals, the "why" of a step. Examples include Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Lateral Movement, Exfiltration, and Impact. A tactic answers what the attacker is trying to accomplish at that moment.
Techniques are the "how", the general methods used to achieve a tactic. Each technique has a stable ID. For instance, T1059 (Command and Scripting Interpreter) is a technique under the Execution tactic. Citing the ID rather than a description removes ambiguity.
Sub-techniques are narrower variants of a technique. T1059 has sub-techniques for specific interpreters, for example PowerShell or Unix shell, written as T1059.001 and so on. Sub-techniques let you be precise about exactly which variant you detect or observe.
| Layer | Question it answers | Example |
|---|---|---|
| Tactic | Why is the adversary doing this | Execution |
| Technique | How, in general | T1059 Command and Scripting Interpreter |
| Sub-technique | How, specifically | T1059.001 PowerShell |
A single intrusion touches many tactics in sequence, and within each tactic the attacker picks specific techniques. Laid out left to right, the tactics form the columns of a matrix and the techniques fill them in.
The matrices: Enterprise, Mobile, ICS
ATT&CK is not one grid. It is a set of matrices, each covering a different domain, because the attack surface of a corporate network is not the attack surface of a phone or a factory.
- Enterprise covers Windows, macOS, Linux, cloud, containers, and networks. It is the largest and most used matrix, spanning tactics from Reconnaissance and Resource Development through to Impact.
- Mobile covers iOS and Android, with techniques specific to mobile platforms such as abuse of device permissions and mobile-specific persistence.
- ICS covers industrial control systems, the operational technology behind physical processes, where the tactics and impacts differ from IT (for example, disrupting a physical process rather than stealing data).
Each matrix shares the same tactic-technique structure, so once you can read one you can read them all. The domain just changes which behaviours are relevant.
The columns of an ATT&CK matrix are tactics, roughly ordered by how an intrusion progresses. Reading left to right gives you a rough narrative of an attack, from getting in, to establishing a foothold, to acting on objectives. It is a useful mental model even though real attacks skip around.
Groups and software
Beyond behaviours, ATT&CK tracks who uses them and what they use.
Groups are named clusters of adversary activity, each with an identifier like G0016. A group's page lists the techniques it has been observed using and the software it deploys. This is how threat intelligence becomes concrete: instead of "an advanced actor targeted us", you get a specific set of techniques to hunt for.
Software covers the malware and tools associated with intrusions, each with an identifier like S0002. Every software entry maps to the techniques it implements, so a piece of malware becomes a checklist of behaviours your detections should catch.
The links run in every direction. From a technique you can see which groups and software use it. From a group you can see its techniques and its toolkit. That cross-referencing is what turns a static catalog into an intelligence graph.
When intel names a group as relevant to your sector, pull that group's technique list from ATT&CK and treat it as a prioritised backlog. You are no longer defending against an abstraction; you have a concrete, ranked set of behaviours to build detections for.
How defenders use ATT&CK
The framework earns its place through coverage mapping. The workflow is roughly this:
- Inventory your detections and controls, and tag each one with the ATT&CK technique it addresses.
- Plot them on the matrix. MITRE's free ATT&CK Navigator lets you colour techniques by how well you cover them, producing a heat map of strengths and blind spots.
- Overlay threat intelligence. Layer the techniques used by groups that target your industry on top of your coverage map. Where a relevant technique is red, you have a gap that matters.
- Prioritise the gaps. Close the holes that sit under techniques your likely adversaries actually use, before the ones that are merely theoretically uncovered.
- Measure over time. Re-run the map after each detection sprint to show coverage improving against real behaviour.
This is why ATT&CK became the common language of blue teams, red teams, and threat intel. A red team can report findings as technique IDs, the blue team can check those IDs against its coverage map, and intel can express adversary tradecraft in the same terms. Everyone points at the same cells.
The framework also anchors related disciplines. Threat hunting uses technique definitions to form hypotheses about what to look for. Detection engineering uses them as the specification for what a rule should catch. Purple teaming uses them as the shared scorecard for an exercise. See our MITRE ATT&CK for Defenders guide for the operational detail, and the MITRE ATT&CK Tactics Reference for a walk through each tactic.
Our Threat Groups directory maps tracked adversaries to the ATT&CK techniques and software they use, so you can go from a named group straight to the concrete behaviours to hunt for and defend against.
The data model beneath the matrix
The grid you see on the ATT&CK website is a rendering of a richer data model, and understanding that model explains why the framework holds together. ATT&CK is built from a small set of object types that reference each other. Techniques and sub-techniques describe behaviour. Tactics group techniques by goal. Groups describe adversary activity clusters. Software describes malware and tools. Two further object types do a lot of quiet work: Mitigations and Data Sources.
Mitigations (identified with M-IDs) describe defensive measures that reduce the effectiveness of a technique, for example user training or multi-factor authentication. Each technique lists the mitigations that apply to it, which gives a defender a starting point when a coverage map turns up a red cell. Data Sources (identified with DS-IDs) describe the raw telemetry that would reveal a technique in action, such as process creation, network traffic flow, or file modification. Each technique lists the data sources and specific data components that would let you observe it. This is the single most useful part of the model for detection engineers, because it answers the question a coverage map raises: if I cannot see this technique today, what log or sensor would let me see it.
The relationships between these objects are the real product. A technique points to the groups and software that use it, the mitigations that blunt it, and the data sources that reveal it. Read as a graph, ATT&CK lets you start from any node and pivot. From a data source you own, you can find the techniques it illuminates. From a technique, you can find who uses it and how to detect it. This graph structure is published in a machine-readable STIX format, which is why so many security products can ingest ATT&CK directly and tag their own detections with technique IDs.
When ATT&CK Navigator shows a technique in red, the technique's Data Sources field tells you what telemetry would turn it green. If the listed data source is process creation logging and you are not collecting that, the gap is not a missing rule, it is a missing sensor. Fix the collection first, then write the detection.
A worked example: mapping a single intrusion
Abstract structure becomes concrete when you walk one intrusion through the model. Consider a common commodity intrusion pattern and watch how each observed action lands on a tactic and technique. No specific breach is named here; this is the generic shape such an event takes.
The intrusion begins with a phishing email carrying an attachment. That maps to the Initial Access tactic, technique Phishing (T1566), and if the attachment is a document, the sub-technique Spearphishing Attachment (T1566.001). The user opens the attachment and a macro runs, spawning a scripting interpreter. That is the Execution tactic, technique Command and Scripting Interpreter (T1059), sub-technique for the specific interpreter used, for example PowerShell (T1059.001).
The script writes a copy of itself to disk and adds a registry run key so it survives reboot. That is the Persistence tactic, technique Boot or Logon Autostart Execution (T1547), sub-technique Registry Run Keys (T1547.001). The payload then queries the system for its privilege level and looks for a way to elevate. Enumeration of that kind is Discovery, and the elevation attempt is Privilege Escalation. The payload harvests credentials from memory, which is Credential Access, technique OS Credential Dumping (T1003). With credentials in hand it reaches another host over a remote service, which is Lateral Movement, technique Remote Services (T1021). Finally it beacons out to a controller over web protocols, which is Command and Control, technique Application Layer Protocol (T1071), sub-technique Web Protocols (T1071.001), and stages data for theft, which is Collection followed by Exfiltration.
Laid out, the single intrusion becomes a row of technique IDs across the tactics, left to right. That row is exactly what a red team reports, what a detection engineer builds rules against, and what a threat intel analyst compares to known group behaviour. The value is that everyone is pointing at the same labelled cells rather than describing the same event in three different vocabularies.
| Step in the intrusion | Tactic | Technique (ID) |
|---|---|---|
| Malicious attachment delivered | Initial Access | Phishing (T1566) |
| Macro runs a script | Execution | Command and Scripting Interpreter (T1059) |
| Registry run key added | Persistence | Boot or Logon Autostart Execution (T1547) |
| Credentials pulled from memory | Credential Access | OS Credential Dumping (T1003) |
| Reach a second host | Lateral Movement | Remote Services (T1021) |
| Beacon to controller | Command and Control | Application Layer Protocol (T1071) |
| Data stolen | Exfiltration | Exfiltration Over C2 Channel (T1041) |
ATT&CK next to related models
ATT&CK is not the only framework a defender meets, and confusing it with its neighbours leads to misuse. The Cyber Kill Chain describes an intrusion as a linear sequence of phases and is useful for high level narrative. ATT&CK is more granular and more of a matrix than a straight line, cataloguing many techniques per phase rather than one step per phase. MITRE D3FEND is the defensive counterpart, cataloguing defensive techniques and mapping them back to the offensive techniques they counter. CAPEC catalogues attack patterns at the level of application and design weaknesses, and links to CWE, the weakness catalogue. Each answers a different question, and they interlock rather than compete.
| Model | What it catalogues | Best used for |
|---|---|---|
| MITRE ATT&CK | Adversary tactics and techniques seen in the wild | Coverage mapping, detection, threat intel |
| Cyber Kill Chain | Linear phases of an intrusion | High level narrative and briefing |
| MITRE D3FEND | Defensive countermeasures | Pairing controls to techniques |
| CAPEC | Application and design attack patterns | Threat modelling, secure design |
| CWE | Software and hardware weakness types | Root-cause and vulnerability classification |
The clean way to hold these together is by altitude. Kill Chain is the highest and coarsest. ATT&CK sits below it with observable behaviours. D3FEND mirrors ATT&CK on the defensive side. CAPEC and CWE go lower still, into how a specific weakness is attacked and what the underlying flaw is. A finding can be expressed at several of these levels at once, and mature teams cross-reference them.
Common misconceptions
A few misreadings of ATT&CK recur often enough to call out directly.
The first is treating full matrix coverage as the goal. The matrix is a catalogue of possibilities, not a checklist to complete. Many techniques will never be relevant to your environment, and chasing green cells for their own sake wastes effort that belongs on the techniques your actual adversaries use. Coverage is a means of prioritisation, not a score to maximise.
The second is reading the tactic columns as a strict, mandatory order. Real intrusions skip tactics, revisit them, and run several in parallel. An attacker may achieve persistence before privilege escalation, or exfiltrate continuously rather than in one final step. The left-to-right ordering is a teaching aid and a rough narrative, not a state machine that every attack follows.
The third is assuming a technique is inherently malicious. Most techniques describe behaviour that is also used legitimately every day. Command and Scripting Interpreter covers ordinary administration. Remote Services covers normal remote work. Mapping a detection to a technique is where tuning starts, because the same behaviour appears in benign activity, and a rule that fires on the technique without context will drown you in false positives.
The fourth is confusing a Group in ATT&CK with a single named organisation. ATT&CK Groups are clusters of activity assembled from public reporting, and different vendors track overlapping clusters under different names. A Group entry is a convenience for pulling a coherent set of behaviours, not a definitive attribution to a specific real-world entity.
The temptation with any matrix is to colour it green and declare victory. Resist it. A team with deep, well tuned detection across the ten techniques its adversaries actually use is in far better shape than a team with shallow, noisy coverage of a hundred. Weight the map by relevance and exploitability, not by cell count.
How ATT&CK evolved
ATT&CK began inside MITRE as a way to document post-compromise adversary behaviour on Windows enterprise networks, growing out of research into how intrusions actually unfolded once an attacker was past the perimeter. It was made public and has since expanded in several directions. The Enterprise matrix grew beyond Windows to cover macOS, Linux, cloud platforms, containers, and network devices. Separate matrices were added for Mobile and for Industrial Control Systems, reflecting that those environments have their own tactics and impacts.
The introduction of sub-techniques was a significant structural change. Earlier versions had a flatter list of techniques, some broad and some narrow, which made the catalogue uneven. Sub-techniques reorganised the content so that a broad technique carries a set of specific variants beneath it, which made the model more consistent and detections easier to scope. The framework is versioned and updated on a regular cadence, so detections and mappings should record which version they were built against. Techniques are occasionally deprecated, renamed, or restructured, and a mapping made two versions ago may reference an ID that has moved.
This living quality is a feature. Because ATT&CK is curated from observed behaviour, it trails the newest tradecraft slightly, and it gains new techniques as the community reports fresh behaviour. Treating it as a fixed poster on the wall misses the point. It is a maintained knowledge base, and staying current with its releases is part of using it well.
Frequently asked questions
Is ATT&CK free to use? Yes. The knowledge base, the matrices, ATT&CK Navigator, and the underlying STIX data are all published by MITRE at no cost, and they are widely embedded in both open-source and commercial security tooling.
What is the difference between a tactic and a technique? A tactic is the adversary's goal for a step, the why, such as Persistence or Exfiltration. A technique is a general method for achieving that goal, the how, such as Registry Run Keys for persistence. A sub-technique is a narrower variant of a technique. Tactics are the columns of the matrix and techniques fill them.
How is ATT&CK different from the Cyber Kill Chain? The Kill Chain describes an intrusion as a short linear sequence of phases and is good for high level storytelling. ATT&CK is a granular matrix with many techniques per phase, built for coverage mapping, detection engineering, and threat intelligence. They work at different altitudes and are often used together.
What is ATT&CK Navigator? Navigator is a free web tool from MITRE for annotating the matrix. You can colour techniques by coverage, overlay the techniques used by a specific group, and export the result. It is the standard way to turn a scattered set of detections into a visible heat map of strengths and gaps.
Should I aim to cover every technique in the matrix? No. Full coverage is neither achievable nor the goal. Prioritise the techniques used by the groups that target your sector and the ones that are most exploitable in your environment. Use the matrix to rank effort, not to chase a perfect score.
How do Groups and Software help detection? Each Group and Software entry links to the techniques it has been observed using. When intelligence names a relevant actor or malware family, you can pull its technique list and treat it as a prioritised detection backlog, turning an abstract threat into a concrete set of behaviours to build rules for.
How often does ATT&CK change? MITRE releases updated versions on a regular cadence, adding techniques, refining sub-techniques, and occasionally deprecating or renaming entries. Record the version your detections and mappings were built against so you can reconcile them when the catalogue moves.
A few cautions
ATT&CK is a description of observed behaviour, so it lags the very newest tradecraft and it is not a compliance checklist. Full green coverage of the matrix is neither achievable nor the goal; some techniques are far more relevant to your environment and adversaries than others. Use it to prioritise against real threats, not to chase a perfect score. And remember that a technique can be used benignly as well as maliciously, so mapping a detection to a technique is the start of tuning, not the end.
One more caution concerns attribution. ATT&CK Groups are convenient bundles of behaviour, and it is easy to slide from "these techniques match this Group" into "this Group attacked us". Technique overlap is weak evidence of identity, because commodity techniques are shared across many actors. Use Group pages to prioritise behaviours to hunt, and leave firm attribution to the people who weigh the full body of evidence.
Used well, ATT&CK converts vague anxiety about attackers into a concrete, shared map of what they do, what you can see, and where the holes are. It gives a red team, a blue team, and a threat intel function one vocabulary, one graph of relationships, and one heat map to argue over. That shared surface is why the framework sits at the centre of modern detection and threat-intel work, and why learning to read it is a core skill rather than a nice-to-have.
Related guides
Sources & further reading
- MITRE ATT&CK — MITRE
- ATT&CK Matrices — MITRE
- Getting Started with ATT&CK — MITRE
Related guides
- MITRE ATT&CK Tactics: The 14 Enterprise Tactics in Order
A one-line reference to the 14 MITRE ATT&CK Enterprise tactics in order: tactic name, tactic ID, the attacker's goal, and one example technique for each.
- What Is an APT? Advanced Persistent Threats Explained
What an Advanced Persistent Threat is: the three words decoded, how APTs differ from crime, the intrusion lifecycle, attribution, and naming schemes.
- The Bug Bounty Economy: Platforms, Triage & Payouts
How the bug bounty economy works: platforms, triage and payouts, VDPs versus paid programs, researcher incentives, and what bounties do and do not cover.