The MITRE ATT&CK Framework: The 14 Tactics, Techniques & Coverage Mapping

Defenders used to describe attacks in whatever words came to hand. One team's "lateral movement" was another team's "pivoting", and neither could tell whether their detections overlapped or left a hole. MITRE ATT&CK fixed that by giving the whole field a shared, structured vocabulary for how adversaries actually behave.

ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge. It is a free knowledge base, curated by MITRE from observed real-world intrusions, that catalogs what attackers do once they are inside or trying to get in. It is descriptive: it documents behaviour seen in the wild, gives each behaviour a stable identifier, and lets defenders map their own coverage against it.

The three layers: tactics, techniques, sub-techniques

The framework's structure is the first thing to learn, because everything else hangs off it.

Tactics are the adversary's goals, the "why" of a step: Initial Access, Execution, Persistence, Credential Access, Exfiltration, and so on. A tactic answers what the attacker is trying to accomplish at that moment, and each carries a stable ID in the TA00xx form.

Techniques are the "how", the general methods used to achieve a tactic. Each has a stable ID. For instance, T1059 (Command and Scripting Interpreter) is a technique under the Execution tactic.

Sub-techniques are narrower variants of a technique. T1059 has sub-techniques for specific interpreters, for example PowerShell or Unix shell, written as T1059.001 and so on. Sub-techniques let you be precise about exactly which variant you detect or observe.

Layer	Question it answers	Example
Tactic	Why is the adversary doing this	Execution (TA0002)
Technique	How, in general	T1059 Command and Scripting Interpreter
Sub-technique	How, specifically	T1059.001 PowerShell

A single intrusion touches many tactics in sequence, and within each tactic the attacker picks specific techniques. Laid out left to right, the tactics form the columns of a matrix and the techniques fill them in. One technique can serve more than one tactic: a signed Windows binary can serve Execution and Defense Evasion at once, which is why living-off-the-land activity shows up under several tactics in a single incident. LOLBins Explained covers that dual use in detail.

The 14 Enterprise tactics in order

The Enterprise matrix has 14 tactics, and knowing them in order gives you a mental map of an intrusion from first look to final damage. The order below is the standard left-to-right column order of the matrix.

Tactic	ID	Attacker's goal	Example technique
Reconnaissance	TA0043	Gather information to plan the operation	Active Scanning (T1595)
Resource Development	TA0042	Build or acquire the infrastructure and tools	Acquire Infrastructure (T1583)
Initial Access	TA0001	Get a first foothold inside the environment	Phishing (T1566)
Execution	TA0002	Run attacker-controlled code on a host	Command and Scripting Interpreter (T1059)
Persistence	TA0003	Keep access across reboots and credential changes	Create Account (T1136)
Privilege Escalation	TA0004	Gain higher-level permissions	Exploitation for Privilege Escalation (T1068)
Defense Evasion	TA0005	Avoid being detected	System Binary Proxy Execution (T1218)
Credential Access	TA0006	Steal account names and passwords	OS Credential Dumping (T1003)
Discovery	TA0007	Learn the internal environment	System Information Discovery (T1082)
Lateral Movement	TA0008	Move from host to host	Remote Services (T1021)
Collection	TA0009	Gather the data of interest	Data from Local System (T1005)
Command and Control	TA0011	Communicate with compromised hosts	Application Layer Protocol (T1071)
Exfiltration	TA0010	Steal the collected data out of the network	Exfiltration Over C2 Channel (T1041)
Impact	TA0040	Manipulate, interrupt, or destroy	Data Encrypted for Impact (T1486)

The IDs are not sequential with the visual order, which is a common source of confusion. Reconnaissance and Resource Development were added to Enterprise later and kept high numbers (TA0043, TA0042), while the original matrix ran from Initial Access (TA0001) onward.

What each tactic covers

Reconnaissance (TA0043) is the attacker studying the target: scanning infrastructure, harvesting email addresses, reading job postings and public documents for names, technologies, and relationships. Your visibility is limited to the edges where probing touches your systems.

Resource Development (TA0042) is building or acquiring the operation's tooling: registering domains, standing up servers, buying or developing malware, and setting up accounts. It matters more for intelligence and attribution than for endpoint detection.

Initial Access (TA0001) is the first foothold. Phishing is the archetype, and the tactic also covers exploiting a public-facing application, abusing valid accounts, and compromising the supply chain. It is the seam between the pre-compromise tactics and everything you can actually see, which makes it a high-value place to invest.

Execution (TA0002) is running attacker-controlled code on a host, through command interpreters, scripting engines, or scheduled tasks. Almost every intrusion passes through it repeatedly, so it is one of the densest tactics for detection opportunities.

Persistence (TA0003) keeps access across reboots, logouts, and credential changes: created accounts, scheduled tasks, services, startup entries. Its artifacts often outlive the initial intrusion.

Privilege Escalation (TA0004) is gaining higher permissions than the initial access granted, by exploiting a vulnerability or abusing a misconfiguration or a token. It overlaps with persistence and defense evasion, since higher privileges make both easier.

Defense Evasion (TA0005) is avoiding detection, and it is the largest tactic by technique count: clearing logs, disabling security tools, abusing signed binaries, obfuscating files. Because so many techniques serve it, coverage gaps here accumulate without anyone noticing.

Credential Access (TA0006) is stealing account names and passwords by dumping credentials from memory, capturing input, or abusing stored secrets. It turns a single compromised host into a route across the whole environment, which is why it deserves heavy investment.

Discovery (TA0007) is learning the internal environment by enumerating accounts, systems, shares, and security tooling. The activity is noisy and repetitive, which makes it a productive place to hunt.

Lateral Movement (TA0008) is moving from host to host using remote services, remote management tooling, and stolen credentials. It is where a contained incident becomes an enterprise one. See Lateral Movement Explained for the specific mechanisms.

Collection (TA0009) is gathering the data of interest before it leaves: staging files, capturing screens, pulling data from local systems and shares. It immediately precedes exfiltration and often shares its telemetry.

Command and Control (TA0011) is communicating with compromised hosts, usually disguised as ordinary web traffic. Network telemetry is the primary lens on this tactic.

Exfiltration (TA0010) is moving the collected data out. It may ride the command-and-control channel or use a separate route such as a cloud storage service. Volume and destination anomalies are the classic signals.

Impact (TA0040) is manipulating, interrupting, or destroying systems and data: ransomware encryption, data wiping, service disruption. It is usually the final act, the point where the intrusion announces itself.

Reading the tactics as a lifecycle

The two leftmost tactics are pre-compromise. Reconnaissance and Resource Development largely happen on the attacker's own infrastructure and the open internet, so you rarely have telemetry for them.

From Initial Access onward you are usually inside your own visibility, and this is the stretch where a strong logging posture pays off: a phishing email lands (Initial Access), a macro runs a script (Execution), a scheduled task is created (Persistence), a token is stolen (Privilege Escalation).

The middle is a loop, and it is where detections belong

A real intrusion does not march through the matrix once. After gaining access, an adversary cycles through Execution, Discovery, Credential Access, Privilege Escalation, and Lateral Movement repeatedly, often revisiting the same four tactics on a dozen hosts. The pre-compromise tactics are hard to see and the final tactics fire late, when damage is underway. Weighting detection investment toward that repeating middle cluster catches attackers while they are still expanding and before they reach Impact.

The matrices: Enterprise, Mobile, ICS

ATT&CK is a set of matrices, each covering a different domain, because the attack surface of a corporate network differs from that of a phone or a factory.

Enterprise covers Windows, macOS, Linux, cloud, containers, and networks. It is the largest and most used matrix, and it holds the 14 tactics above.
Mobile covers iOS and Android, with techniques specific to mobile platforms such as abuse of device permissions and mobile-specific persistence.
ICS covers industrial control systems, the operational technology behind physical processes, where the tactics and impacts differ from IT (for example, disrupting a physical process rather than stealing data).

Each matrix shares the same tactic-technique structure, so once you can read one you can read them all. The domain changes which behaviours are relevant.

Groups and software

Beyond behaviours, ATT&CK tracks who uses them and what they use.

Groups are named clusters of adversary activity, each with an identifier like G0016. A group's page lists the techniques it has been observed using and the software it deploys. This is how threat intelligence becomes concrete: instead of "an advanced actor targeted us", you get a specific set of techniques to hunt for.

Software covers the malware and tools associated with intrusions, each with an identifier like S0002. Every software entry maps to the techniques it implements, so a malware family becomes a checklist of behaviours your detections should catch.

The links run in every direction. From a technique you can see which groups and software use it. From a group you can see its techniques and its toolkit. That cross-referencing turns a static catalog into an intelligence graph, and it is how you go from a cold column on the matrix to a ranked plan: if the groups that target your sector lean on Credential Access, that column is where your next detection should go.

From technique to threat actor

Our Threat Groups directory maps tracked adversaries to the ATT&CK techniques and software they use, so you can go from a named group straight to the concrete behaviours to hunt for and defend against.

The data model beneath the matrix

The grid on the ATT&CK website is a rendering of a richer data model. ATT&CK is built from a small set of object types that reference each other: techniques and sub-techniques describe behaviour, tactics group techniques by goal, Groups describe activity clusters, and Software describes malware and tools. Two further object types do a lot of quiet work.

Mitigations (M-IDs) describe defensive measures that reduce the effectiveness of a technique, for example user training or multi-factor authentication, and each technique lists the ones that apply to it. Data Sources (DS-IDs) describe the raw telemetry that would reveal a technique in action, such as process creation, network traffic flow, or file modification, broken down into specific data components. Data Sources are the most useful part of the model for detection engineers, because they answer the question a coverage map raises: if I cannot see this technique today, what log or sensor would let me see it.

The relationships between these objects are the real product. A technique points to the groups and software that use it, the mitigations that blunt it, and the data sources that reveal it, so you can start from any node and pivot. From a data source you own, you can find the techniques it illuminates. From a technique, you can find who uses it and how to detect it. The graph is published in a machine-readable STIX format, which is why so many security products ingest ATT&CK directly and tag their own detections with technique IDs.

Data sources answer the coverage question

When ATT&CK Navigator shows a technique in red, the technique's Data Sources field tells you what telemetry would turn it green. If the listed data source is process creation logging and you are not collecting that, the gap is a missing sensor rather than a missing rule. Fix the collection first, then write the detection.

A worked example: mapping one intrusion

No specific breach is named here; this is the generic shape a commodity intrusion takes.

It begins with a phishing email carrying an attachment: Initial Access, technique Phishing (T1566), and if the attachment is a document, sub-technique Spearphishing Attachment (T1566.001). The user opens it, a macro runs and spawns a scripting interpreter: Execution, technique Command and Scripting Interpreter (T1059), sub-technique for the interpreter used, for example PowerShell (T1059.001). The script writes a copy of itself to disk and adds a registry run key so it survives reboot: Persistence, technique Boot or Logon Autostart Execution (T1547), sub-technique Registry Run Keys (T1547.001). A scheduled task would serve the same tactic.

Then the loop begins. The payload enumerates the host and the network (Discovery), queries its privilege level and looks for a way to elevate (Privilege Escalation), and harvests credentials from memory (Credential Access, OS Credential Dumping, T1003). Those credentials let it authenticate to another machine over a remote service (Lateral Movement, Remote Services, T1021). On the new host it runs more code and enumerates again, and the same four or five tactics repeat as it expands.

Only when the attacker reaches the systems holding the data they want do the later tactics engage. The implant beacons to a controller over web protocols (Command and Control, Application Layer Protocol T1071, sub-technique Web Protocols T1071.001), staging the data is Collection, sending it out is Exfiltration, and encrypting what remains is Impact.

Step in the intrusion	Tactic	Technique (ID)
Malicious attachment delivered	Initial Access	Phishing (T1566)
Macro runs a script	Execution	Command and Scripting Interpreter (T1059)
Registry run key added	Persistence	Boot or Logon Autostart Execution (T1547)
Host and network enumerated	Discovery	System Information Discovery (T1082)
Credentials pulled from memory	Credential Access	OS Credential Dumping (T1003)
Reach a second host	Lateral Movement	Remote Services (T1021)
Beacon to controller	Command and Control	Application Layer Protocol (T1071)
Data stolen	Exfiltration	Exfiltration Over C2 Channel (T1041)

The intrusion becomes a row of technique IDs across the tactics, which is exactly what a red team reports, what a detection engineer builds rules against, and what an intel analyst compares to known group behaviour.

Turning the matrix into a detection roadmap

The framework earns its place through coverage mapping. The workflow is repeatable:

Inventory your detections and controls, and tag each one with the ATT&CK tactic and technique it addresses.
Plot them on the matrix. MITRE's free ATT&CK Navigator lets you colour techniques by how well you cover them, producing a heat map: columns glow where reliable detections sit and stay dark where nothing does.
Overlay threat intelligence. Layer the techniques used by groups that target your industry on top of your coverage map. Where a relevant technique is red, you have a gap that matters.
Prioritise the gaps. Read the dark columns against your threat model rather than against a wish to cover everything evenly. A hole in Credential Access or Lateral Movement is urgent if your likely adversaries lean on those; a hole in a tactic they rarely use can wait.
Measure over time. Re-map after each detection sprint so the heat map stays current and shows coverage improving against real behaviour.

One habit keeps this honest: revisit the map after every significant incident, because an intrusion that slipped through shows exactly which tactic your coverage was thin on in the real world, where a paper heat map can look deceptively complete.

This is why ATT&CK became the common language of blue teams, red teams, and threat intel. A red team reports findings as technique IDs, the blue team checks those IDs against its coverage map, and intel expresses adversary tradecraft in the same terms. Everyone points at the same cells. The framework also anchors related disciplines: threat hunting uses technique definitions to form hypotheses, detection engineering uses them as the specification for what a rule should catch, and purple teaming uses them as the shared scorecard for an exercise. See the Threat Hunting Guide for hypothesis-driven hunts built on technique definitions.

Fourteen tactics is a small enough list to hold in your head and structured enough to organise hundreds of individual detections beneath.

ATT&CK is one of several frameworks a defender meets, and confusing it with its neighbours leads to misuse.

Model	What it catalogues	Granularity	Best used for
ATT&CK tactics	Adversary objectives across an intrusion	14 goals	Coverage mapping, shared vocabulary
ATT&CK techniques	Specific ways objectives are achieved	Hundreds of Txxxx entries	Building and tagging detections
Cyber Kill Chain	Linear phases of an intrusion	7 sequential phases	High level narrative and briefing
Diamond Model	Adversary, capability, infrastructure, victim	4 linked features	Intrusion analysis and attribution
MITRE D3FEND	Defensive countermeasures	Defensive technique catalogue	Pairing controls to techniques
CAPEC	Application and design attack patterns	Attack pattern catalogue	Threat modelling, secure design
CWE	Software and hardware weakness types	Weakness catalogue	Root-cause and vulnerability classification

The clean way to hold these together is by altitude. The Cyber Kill Chain is the highest and coarsest, and it works well for explaining an attack to a non-technical audience. ATT&CK sits below it with observable behaviours, cataloguing many techniques per phase rather than one step per phase. D3FEND mirrors ATT&CK on the defensive side, mapping defensive techniques back to the offensive ones they counter. CAPEC and CWE go lower still, into how a specific weakness is attacked and what the underlying flaw is. The Diamond Model sits to one side as an analytic tool, focused on the relationships between an adversary, their tooling, their infrastructure, and their victims, which makes it strong for attribution work. A finding can be expressed at several altitudes at once, and mature teams use ATT&CK as the backbone while reaching for the kill chain or the Diamond Model when the audience or the analytic task calls for it.

Common misconceptions

Four misreadings of ATT&CK recur often enough to call out directly.

Full matrix coverage is the goal. The matrix is a catalogue of possibilities rather than a checklist to complete. Many techniques will never be relevant to your environment, and chasing green cells wastes effort that belongs on the techniques your actual adversaries use. Covering a technique with a weak, noisy, or easily evaded detection counts for very little, so depth on what matters for your threat model beats a thin layer spread across every cell.

The columns are a strict order. Real intrusions skip tactics, revisit them, and run several in parallel. An attacker may achieve persistence before privilege escalation, or exfiltrate continuously rather than in one final step. A detection strategy that assumes attackers march in step will miss them. The related error is mixing up the two layers: Defense Evasion is a tactic, abusing a signed binary to evade detection is a technique that serves it, and citing one when you mean the other muddies reports and mappings.

A technique is inherently malicious. Most techniques describe behaviour that is also used legitimately every day. Command and Scripting Interpreter covers ordinary administration. Remote Services covers normal remote work. Mapping a detection to a technique is where tuning starts, and a rule that fires on the technique without context will drown you in false positives.

A Group is a named organisation. ATT&CK Groups are clusters of activity assembled from public reporting, and different vendors track overlapping clusters under different names. Technique overlap is weak evidence of identity, because commodity techniques are shared across many actors. Use Group pages to prioritise behaviours to hunt, and leave firm attribution to the people who weigh the full body of evidence.

One more thing the matrix cannot do: it is descriptive, built from observed behaviour, so it captures what has been seen rather than everything possible, and it lags the newest tradecraft. A gap in the matrix carries no guarantee that a behaviour cannot happen.

How ATT&CK evolved

ATT&CK began inside MITRE as a way to document post-compromise adversary behaviour on Windows enterprise networks, growing out of research into how intrusions unfolded once an attacker was past the perimeter. It was made public and expanded in several directions. The Enterprise matrix grew beyond Windows to cover macOS, Linux, cloud platforms, containers, and network devices, and it gained the two pre-compromise tactics, Reconnaissance and Resource Development.

The introduction of sub-techniques was a significant structural change. Earlier versions had a flatter list of techniques, some broad and some narrow, which made the catalogue uneven. Sub-techniques reorganised the content so that a broad technique carries a set of specific variants beneath it, which made the model more consistent and detections easier to scope.

The framework is versioned and revised on a regular cadence as new behaviours are observed and the community contributes. Techniques are added, split, merged, deprecated, or renamed, and a mapping made two versions ago may reference an ID that has moved. This is why the stable IDs matter: a report citing TA0006 or a Txxxx identifier stays unambiguous across revisions, where a name written out in prose can quietly fall out of date. Record the version your detections and mappings were built against, and treat ATT&CK as a current reference to check rather than a fixed poster to memorise once.

Frequently asked questions

What is the difference between a tactic and a technique? A tactic is the adversary's goal for a step, the why, such as Persistence or Exfiltration. A technique is a general method for achieving that goal, the how, such as Registry Run Keys for persistence. A sub-technique is a narrower variant. Tactics are the columns of the matrix, techniques fill them, and one technique can serve more than one tactic.

What are the 14 MITRE ATT&CK tactics in order? Reconnaissance (TA0043), Resource Development (TA0042), Initial Access (TA0001), Execution (TA0002), Persistence (TA0003), Privilege Escalation (TA0004), Defense Evasion (TA0005), Credential Access (TA0006), Discovery (TA0007), Lateral Movement (TA0008), Collection (TA0009), Command and Control (TA0011), Exfiltration (TA0010), and Impact (TA0040).

Why are the tactic IDs out of order? Reconnaissance and Resource Development were added to the Enterprise matrix after the original tactics, so they carry high IDs despite appearing first in the left-to-right order. Citing the ID rather than relying on visual position avoids the confusion.

Do attackers always follow the tactics in order? No. The order is a rough narrative, and real intrusions loop through the middle tactics repeatedly across many hosts. Treat the sequence as a map of possible moves rather than a fixed timeline.

How many techniques are there? The Enterprise matrix holds hundreds of techniques and sub-techniques spread across the 14 tactics, and the count changes as MITRE revises the framework. The tactics stay at 14 while the techniques beneath them grow and shift.

Is ATT&CK free to use? Yes. The knowledge base, the matrices, ATT&CK Navigator, and the underlying STIX data are all published by MITRE at no cost, and they are widely embedded in open-source and commercial security tooling.

What is ATT&CK Navigator? Navigator is a free web tool from MITRE for annotating the matrix. You can colour techniques by coverage, overlay the techniques used by a specific group, and export the result. It is the standard way to turn a scattered set of detections into a visible heat map.

Should I aim to cover every technique in the matrix? No. Full coverage is neither achievable nor the goal. Prioritise the techniques used by the groups that target your sector and the ones most exploitable in your environment, and use the matrix to rank effort.

How do Groups and Software help detection? Each Group and Software entry links to the techniques it has been observed using. When intelligence names a relevant actor or malware family, pull its technique list and treat it as a prioritised detection backlog.

Should I cite the tactic name or the ID? Cite the ID for precision and use the name for readability. The stable TA00xx identifiers survive MITRE's renames, so pairing the two gives you clarity and durability.

How is ATT&CK different from the Cyber Kill Chain? The Kill Chain describes an intrusion as a short linear sequence of seven phases and is good for high level storytelling. ATT&CK is a granular, non-linear matrix with many techniques per phase, built for coverage mapping, detection engineering, and threat intelligence. They work at different altitudes and are often used together.

Are there matrices other than Enterprise? Yes. MITRE maintains separate matrices for mobile platforms and for industrial control systems, each with tactics tuned to that environment. Enterprise and its 14 tactics are the most widely referenced, and the same structure carries across all of them.

How often does ATT&CK change? MITRE releases updated versions on a regular cadence, adding techniques, refining sub-techniques, and occasionally deprecating or renaming entries. Record the version your detections and mappings were built against so you can reconcile them when the catalogue moves.

Used well, ATT&CK converts vague anxiety about attackers into a concrete, shared map of what they do, what you can see, and where the holes are. It gives a red team, a blue team, and a threat intel function one vocabulary, one graph of relationships, and one heat map to argue over. Learn the 14 tactics in order and the framework becomes the common map your intel and defense both read from.