MITRE ATT&CK

What is MITRE ATT&CK?

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a freely available knowledge base that describes the tactics and techniques cyber adversaries use in real attacks, organised into matrices for Enterprise, Mobile and ICS environments. MITRE started it in 2013 for the FMX (Fort Meade Experiment) research project, which studied how to detect attackers after they had broken into a Windows network. The model became public in 2015. Today ATT&CK is the common language that SOC analysts, red teams, vendors and auditors use to describe adversary behaviour.

ATT&CK helps organisations understand, detect and analyse attacks based on behaviour that has actually been observed in the wild, not on theory.

🧠 How is MITRE ATT&CK structured?

The core of ATT&CK is the trio also known as TTPs: tactics, techniques and procedures. Since version 7 (July 2020) a fourth level sits in between: the sub-technique.

1. Tactics - the attacker’s objective in a phase, such as getting in or escalating privileges. Each tactic has an ID such as TA0001.
2. Techniques - how that objective is achieved, for example OS Credential Dumping (T1003).
3. Sub-techniques - a more precise variant, such as LSASS Memory (T1003.001).
4. Procedures - concrete examples of how a specific group or piece of malware has used a technique, with references to public reporting.

Around the matrix sit objects that make ATT&CK usable: groups (such as APT29, Sandworm and Volt Typhoon), software (Malware and legitimate tools), campaigns, mitigations (M numbers) and detection strategies with analytics and data components. All data is published in machine-readable form (STIX 2.1, via TAXII or as Excel) and can be explored with the ATT&CK Navigator web tool.

🧭 Which tactics does the Enterprise matrix contain?

Since version 19 (April 2026) the Enterprise matrix has 15 tactics. In that release MITRE split the former Defense Evasion tactic into Stealth (staying unnoticed) and Defense Impairment (disabling security controls). The order roughly follows the course of an attack, but an adversary does not need to pass through every column.

The first two tactics came from the separate PRE-ATT&CK in version 8 (October 2020), when PRE-ATT&CK was retired and merged into Enterprise.

🗂 Which ATT&CK matrices exist?

MITRE maintains three domains, each with its own tactics and techniques. The figures below apply to version 20 of 13 October 2026; MITRE usually publishes two releases a year, in April and October.

For OT environments, MITRE ATT&CK for ICS is the key domain, with tactics such as Inhibit Response Function and Impair Process Control that only exist in industrial systems. Real OT attacks, however, often start in the office network, so in practice you use the Enterprise matrix alongside it. Version 20 also added techniques for attacks on AI applications, such as Direct and Indirect Prompt Injection.

🧰 What do you use MITRE ATT&CK for?

• Threat Intelligence - translating threat reports into techniques, so you can see which groups matter for your sector.
• Detection and SIEM rules - linking every use case to a technique ID, so coverage becomes measurable in the SOC or OT SOC.
• Threat Hunting - searching for behaviour, such as Living Off The Land techniques that leave no IOC behind.
• Red, blue and purple teaming - emulating a real group and measuring what the blue team tooling sees; complementary to a traditional pentest.
• Assessing vendors - EDR, XDR and SOAR products express their coverage in ATT&CK terms. Since 2018, MITRE ATT&CK Evaluations have publicly tested products against emulated groups, starting with APT3; the results deliberately contain no scores or rankings. Platforms such as Splunk, Microsoft Sentinel and MISP also tag detections and threat intelligence with ATT&CK IDs.
• Threat modelling and risk management - building scenarios from techniques that have been seen against your sector.

🛠️ How do you map your coverage step by step?

The US CISA published Best Practices for MITRE ATT&CK Mapping in June 2021; version 2 of January 2023 added ICS and common mapping mistakes. A practical five-step approach:

1. Select relevant groups - choose three to five threat groups that target your sector, for example APT groups focused on energy or water.
2. Record their techniques - export them as a layer in ATT&CK Navigator. Overlap between groups shows the techniques with the highest priority.
3. Map your detection - score each technique on whether you have the required log source, whether a rule exists and whether it has been tested.
4. Test with emulation - execute the techniques in a controlled way and check whether the SOC gets an alert.
5. Link controls - use the ATT&CK mitigations and MITRE D3FEND to close the gaps, and repeat the analysis after every half-yearly release.

A common mistake is confusing “coverage” with “detection”: one rule per technique says little, because a technique can be carried out in dozens of ways.

🔄 How does ATT&CK relate to other models?

Where ATT&CK describes individual techniques, Lockheed Martin’s Cyber Kill Chain divides an attack into seven consecutive phases. The Kill Chain is good for explaining how an attack unfolds; ATT&CK makes detection and testing concrete. MITRE D3FEND is the defensive counterpart, with techniques for hardening, detection and isolation.

Standards such as IEC 62443 and NIST CSF prescribe which controls you need; ATT&CK shows what they protect against. For organisations covered by NIS2 and the Dutch Cybersecurity Act, in force since 15 August 2026, ATT&CK provides an unambiguous language to substantiate risks and to describe incidents to the NCSC or a sector CSIRT.

❓ Frequently asked questions

Is MITRE ATT&CK free?

Yes, MITRE ATT&CK is free for any person or organisation to use, under MITRE’s terms of use. You may not, however, use the ATT&CK name in a product or company name or suggest that MITRE endorses your product.

How often is MITRE ATT&CK updated?

MITRE ATT&CK usually gets two releases a year, in April and October. Version 19 of April 2026 split Defense Evasion, and version 20 of October 2026 added, among other things, AI-related techniques. Update your mappings and detection rules at least every six months.

What is the difference between a tactic and a technique in ATT&CK?

A tactic in MITRE ATT&CK is the attacker’s objective, such as Credential Access. A technique is the way the attacker achieves that objective, such as OS Credential Dumping. One technique can belong to several tactics.

Does PRE-ATT&CK still exist?

No, PRE-ATT&CK was retired as a separate matrix in version 8 of October 2020. Its content was merged into the Enterprise matrix as the Reconnaissance and Resource Development tactics.

Can MITRE ATT&CK be used for OT security?

Yes, for OT security you use MITRE ATT&CK for ICS, a separate domain with techniques against PLCs, SCADA and safety systems. Combine it with the Enterprise matrix, because attackers usually enter through the IT network before they reach the process.

Is MITRE ATT&CK a standard you must comply with?

No, MITRE ATT&CK is not a standard and has no certification or compliance requirements. It is a knowledge base you use alongside standards such as IEC 62443 and ISO 27001 to test your controls against real adversary behaviour.

📌 In summary

MITRE ATT&CK is the globally used knowledge base of real adversary behaviour, with 15 Enterprise tactics and hundreds of techniques that help you focus detection, testing and controls. It provides a common language for security teams, auditors and management and, together with ATT&CK for ICS, forms the basis of a threat-informed approach in IT and OT environments.