Stop 07 · Security Operations & MonitoringTopics · 9/10

MITRE ATT&CK Framework

In short

Everyone described attacks in their own words, so nobody could compare notes. MITRE ATT&CK is a shared dictionary of real attacker behaviour, from first foothold to final theft.

A widely used knowledge base cataloging real-world attacker tactics and techniques, organized by attack lifecycle stage — the standard shared vocabulary for describing and detecting attacker behavior.

The blob flips through a big labelled recipe-style index book of attack cards.

Think of it like this

A shared recipe index for attacks

Imagine every cook named the same dish differently. A shared recipe index fixes that: one name, clear steps, agreed sections. ATT&CK is that index for attacks, so defenders worldwide mean the same thing by the same technique.

Watch it happen

Tactics hold techniques

ATT&CK

Initial Access

Execution

Persistence

Exfiltration

Phishing

Scheduled Task

1/4ATT&CK is a free knowledge base of how real attackers behave, built from observed incidents.

The big ideas

What you need to know

Tactics then techniques

Tactics are the why, like persistence. Techniques are the how, like a scheduled task. Each has an ID.

A map for coverage

Mark which techniques your detections catch. The blank squares show exactly where you are blind.

Fuel for hunting

Pick a technique, read how it works, then hunt your logs for its traces. Instant hunt ideas.

One shared language

Reports, tools and teams all cite ATT&CK IDs, so everyone describes the same attack the same way.

Save yourself the pain

Common mistakes

Oops

Trying to detect all of ATT&CK at once.

Do this instead

It is huge. Start with techniques most relevant to your systems and the threats that target your sector.

Oops

Treating the matrix as a strict attack order.

Do this instead

Real attacks skip around and repeat tactics. The matrix is a reference, not a fixed sequence.

Your mission

Map your detections to ATT&CK

~35 min

Quick check

In ATT&CK, what is the difference between a tactic and a technique?

Go deeper

1Explore the MITRE ATT&CK matrix and identify techniques relevant to a recent real breach.
2Learn how detection rules are often mapped to specific ATT&CK techniques.
3Practice describing a hypothetical attack scenario using ATT&CK's terminology.