MITRE ATT&CK.

A shared language for how attackers behave

MITRE ATT&CK reframes threat intelligence around behaviour rather than indicators. Instead of cataloguing the IP addresses or file hashes seen in a single campaign, which change constantly, it catalogues the things adversaries actually do once inside an environment: how they gain initial access, escalate privileges, move laterally, evade defences, and exfiltrate data. Each of those behaviours is captured as a technique with a stable identifier, and techniques are grouped under tactics that describe the attacker goal at each step. The result is a structured, evidence-based map of the adversary playbook, drawn from observed real-world intrusions rather than from theory.

The framework is organised as a matrix. The columns are the tactics, the why behind a step, and the cells beneath each column are the techniques and sub-techniques, the how. Separate matrices cover Enterprise environments, mobile, and industrial control systems, because adversary behaviour differs across those terrains. Because the technique IDs are stable and public, they become a common reference that a threat intelligence analyst, a SOC engineer writing detections, and a red teamer planning an exercise can all point to without ambiguity. That shared vocabulary is the quiet superpower of ATT&CK: it lets teams that never speak to each other describe the same attack the same way.

Tactics, techniques and procedures

The TTP model sits at the heart of ATT&CK and it pays to keep the three levels distinct. Tactics are the adversary objectives, the broad goals such as gaining a foothold or maintaining persistence. Techniques are the general methods used to achieve a tactic, and many techniques break down further into sub-techniques that describe a more specific variant. Procedures are the concrete, in-the-wild implementations a particular group used to carry out a technique. Climbing that ladder from procedure to technique to tactic is what turns a pile of incident artefacts into a pattern you can defend against.

The reason practitioners value this structure is that defences built at the technique level survive longer than defences built on indicators. An attacker can swap a malicious domain or recompile a payload in minutes, defeating signature-based blocking, but changing the underlying technique demands more effort and often more skill. Detections anchored to techniques therefore age more slowly and catch variants the first signature never saw.

How teams put ATT&CK to work

Threat-informed defence is the practice ATT&CK enables, and it shows up across the security function. SOC teams tag detection rules with technique IDs so they can see, at a glance, which adversary behaviours they can spot and which they are blind to. That gap analysis, often visualised as a heat map over the matrix, drives where the next detection effort goes. Red teams and purple teams use the matrix to design and score exercises, walking through techniques deliberately to test whether the blue team notices.

Threat intelligence teams describe adversary groups in ATT&CK terms so reports are comparable rather than bespoke prose. And training programmes lean on it because it gives analysts a single, well-documented model of attacker behaviour to learn rather than a thousand disconnected war stories.

ATT&CK is openly published, free to use, and updated continuously as new adversary behaviour is observed, which is why it has become the de facto reference rather than one vendor framework among many. It pairs naturally with control catalogues and management systems: where ISO/IEC 27001, the NIST Cybersecurity Framework, or the CIS Controls tell you what protective and detective capabilities to build, ATT&CK tells you which adversary behaviours those capabilities need to address, and it is increasingly used to prioritise and validate that work.