MITRE ATT&CK

What is MITRE ATT&CK?

MITRE ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge. It is a globally accessible, open knowledge base maintained by MITRE Corporation and documented at https://attack.mitre.org/. It captures how adversaries behave in real intrusions, based on observed and documented activity.

ATT&CK is valuable because it standardises language between threat intelligence, detection engineering, incident response, and leadership reporting. Instead of vague statements like "advanced attack activity," teams can reference specific techniques and associated mitigations, improving technical precision and operational coordination.

The ATT&CK Matrix

The Enterprise ATT&CK matrix at https://attack.mitre.org/matrices/enterprise/ is organised by tactics and techniques. Tactics represent adversary goals, the why. Techniques represent implementation methods, the how. Sub-techniques provide finer granularity for detection and analysis.

There are 14 enterprise tactics spanning the attack lifecycle from Reconnaissance to Impact. For example, Initial Access is a tactic, Phishing (T1566) is a technique, and Spearphishing Attachment (T1566.001) is a sub-technique. This structure supports consistent mapping across detections, incidents, and assessments.

Tactics Explained

• Reconnaissance — Adversaries gather information about targets before engaging.
• Resource Development — Adversaries build or acquire infrastructure, tools, and accounts.
• Initial Access — Adversaries gain an initial foothold in the target environment.
• Execution — Adversaries run malicious code in victim systems.
• Persistence — Adversaries maintain access across restarts or credential changes.
• Privilege Escalation — Adversaries obtain higher permissions for broader control.
• Defense Evasion — Adversaries avoid detection and bypass security controls.
• Credential Access — Adversaries steal passwords, tokens, or authentication secrets.
• Discovery — Adversaries map hosts, users, and services inside the environment.
• Lateral Movement — Adversaries move from one system to another.
• Collection — Adversaries gather data relevant to their objective.
• Command and Control — Adversaries communicate with compromised systems remotely.
• Exfiltration — Adversaries transfer stolen data out of the environment.
• Impact — Adversaries disrupt, destroy, or manipulate operations and data.

How to Use ATT&CK

MITRE guidance at https://attack.mitre.org/resources/getting-started/ highlights four common use cases. Detection and Analytics maps rules and telemetry to specific techniques. Threat Intelligence uses ATT&CK to describe adversary behaviour consistently. Adversary Emulation simulates realistic attack paths for purple teaming and validation. Assessment measures defensive coverage and identifies control gaps.

Using ATT&CK effectively requires continuous refinement. As detections mature and adversary behaviour changes, mappings and test scenarios should be updated. Teams that treat ATT&CK as a living framework generally achieve stronger detection quality and more defensible reporting to stakeholders.

ATT&CK Navigator

ATT&CK Navigator at https://mitre-attack.github.io/attack-navigator/ is an interactive interface for visualising ATT&CK coverage. Teams use it to create heat maps, compare group technique usage, and track progress across control uplift programs.

Navigator layers are particularly useful for communicating with mixed audiences. Analysts can model detailed detection status, while leadership can view high-level capability gaps. This improves prioritisation by linking technical debt to adversary-relevant exposure.

ATT&CK and the ISM

ATT&CK can support Australian Information Security Manual (ISM) implementation by connecting adversary behaviours to specific control outcomes. For example, T1566 Phishing maps directly to controls on email filtering, user awareness, and malicious content handling.

Cross-framework mapping resources from the Center for Threat-Informed Defense are available at https://center-for-threat-informed-defense.github.io/mappings-explorer/, including links between ATT&CK and NIST SP 800-53 controls. These mappings help teams justify control investments with threat-informed evidence.