MITRE ATT&CK

framework · cybersecurity · organizing-schema

Globally accessible knowledge base of adversary tactics, techniques, and procedures based on real-world observations.

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is the comprehensive knowledge base of adversary behavior maintained by MITRE Corporation, structuring observed real-world attacks into a taxonomy of tactics (the 'why' — adversary objectives like Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact) and techniques (the 'how' — specific methods like Phishing, Spearphishing Attachment, PowerShell execution, Pass the Hash, Kerberoasting). The framework was first released publicly in 2015 and has substantially evolved through annual updates. ATT&CK is divided into matrices for different domains: Enterprise (Windows, macOS, Linux, cloud platforms, containers, network); Mobile (iOS, Android); ICS (Industrial Control Systems). Each technique includes detection guidance, mitigation suggestions, real-world incident references, and links to threat actor groups using the technique. The framework is widely used in threat intelligence (mapping observed adversary activity), security operations (designing detection rules aligned to ATT&CK techniques), red teaming (simulating realistic attacker behavior), and threat modeling (anticipating likely attack paths). MITRE complements ATT&CK with related frameworks: D3FEND (defensive countermeasures), CAR (Cyber Analytics Repository), CALDERA (automated adversary emulation). Empirical foundation in observed real-world attacks distinguishes ATT&CK from theory-based frameworks like Cyber Kill Chain. Substantial commercial adoption — virtually all enterprise security tools now claim ATT&CK alignment, with varying fidelity.

Originators

MITRE Corporation; substantial federal funding and public-interest mission high

Year / Decade

2013 (initial internal development); 2015 (public release); ongoing annual updates high

Primary sources

MITRE Corporation (ongoing). ATT&CK Knowledge Base at attack.mitre.org, Strom, B.E. et al. (2018). 'MITRE ATT&CK: Design and Philosophy', ongoing MITRE blog posts and research publications high

Band notes

Knowledge base structure rather than a prescriptive control framework; widely used as reference and threat-modeling input.

Core components

Tactics (adversary objectives): Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, Reconnaissance, Resource Development
Techniques and Sub-techniques (specific methods)
Three matrices: Enterprise, Mobile, ICS
Detection guidance and mitigations per technique
Threat actor group mappings
Software (malware, tools) inventory
Empirical foundation in observed real-world attacks
Complementary frameworks: D3FEND, CAR, CALDERA
ATT&CK Navigator visualization tool

Primary use case

Threat intelligence and adversary behavior analysis; security operations (SOC playbook development, detection rule alignment); red team and purple team exercises; threat modeling and risk assessment; foundation for substantial commercial security tooling (SIEM, EDR, XDR vendors all claim ATT&CK alignment); reference framework in security operations education; integration with cyber threat intelligence platforms; basis for many security-program maturity assessments; influence on security investment prioritization.

Common criticisms

Knowledge base is descriptive of observed attacks but doesn't prioritize techniques by likelihood, impact, or remediation cost — organizations need additional analysis to translate ATT&CK coverage into security program priorities
commercial vendors marketing 'ATT&CK coverage' often overstate what their products actually detect or prevent
the framework grows continuously as new techniques are observed, creating maintenance burden for organizations and tools claiming alignment
mapping organizational security capabilities to ATT&CK techniques is genuinely difficult — different teams produce different mappings
ATT&CK doesn't address security governance, risk management, or compliance dimensions that other frameworks cover
some critics argue ATT&CK's empirical-observation foundation creates lag — emerging attack patterns may not be reflected until observed in major incidents
cross-walks with control frameworks (NIST 800-53, CIS Controls) require substantial effort and produce imperfect mappings
tendency for security tooling vendors to bias detection rules toward easily-detected techniques rather than highest-impact threats
integration with non-Windows environments has improved but remains uneven across techniques.

Lineage

Siblings: Cyber Kill Chain, Diamond Model of Intrusion Analysis