MITRE ATT&CK
Definition
A publicly available knowledge base of adversary tactics, techniques, and procedures derived from real-world intrusion observations. Maintained by the MITRE Corporation. Techniques are identified by IDs such as T1566 (Phishing) or T1003 (OS Credential Dumping). Used by defenders, threat intelligence teams, and investigators as a common taxonomy.
- Maintainer
- MITRE Corporation
- Content
- Adversary tactics, techniques and procedures from real intrusions
- ID format
- Technique IDs, e.g. T1566 (Phishing), T1003 (Credential Dumping)
- Used by
- Defenders, threat intel teams, investigators
- Access
- Publicly available knowledge base
Common questions
How do investigators actually use ATT&CK in a case?+
They map observed attacker behaviour to specific technique IDs, which lets them describe an intrusion in a standard vocabulary that other analysts and tools recognise, compare the case against known adversary groups' typical technique sets, and identify gaps in what was investigated.
Is MITRE ATT&CK the same as a vulnerability database?+
No. A vulnerability database like CVE catalogues specific software flaws, while ATT&CK catalogues behavioural patterns attackers use regardless of which vulnerability or tool enabled them, which is why it stays useful even as specific exploits are patched.
Related terms
- Indicator of Compromise (IoC)
- An observable artefact that suggests a system has been involved in a malicious event. Static analysis produces file-based IoCs: cryptographic hashes, embedded...
- Lateral Movement
- Attacker activity after initial compromise in which the threat actor traverses from one internal system to another, typically to escalate privileges, access...
- Tactics, Techniques, and Procedures (TTPs)
- A three-level description of adversary behaviour. Tactics are the high-level goals (initial access, persistence, exfiltration). Techniques are the specific methods (spear-phishing, pass-the-hash)....
- Advanced Persistent Threat (APT)
- A category of attacker, typically nation-state or state-sponsored, characterised by high technical capability, long dwell times, specific targets, and disciplined operational security....
- Credential Dumping
- Extraction of authentication credentials from operating system memory, the Windows SAM database, Active Directory, or credential stores. Tools such as Mimikatz target...
- Cyber Kill Chain
- A seven-phase linear model of an intrusion developed by Lockheed Martin in 2011. The phases are: Reconnaissance, Weaponisation, Delivery, Exploitation, Installation, Command...
- Diamond Model
- An analytic framework that structures a cyber intrusion event around four linked elements: adversary, capability, infrastructure, and victim. The model makes explicit...
- Dwell Time
- The period between an attacker gaining initial access and their detection. Reducing dwell time is a primary goal of threat hunting. The...
- Hunting Hypothesis
- A testable statement specifying what adversary behaviour might be present, which data source would show it, and what analytic would surface it....
- Insider Threat
- An incident originating from a person with legitimate access to an organisation's systems, whether through malicious intent (data theft, sabotage) or negligence...
- Living-Off-the-Land (LotL)
- An attack approach where the adversary uses tools and binaries already present on the target system, such as PowerShell, WMI, certutil, or...
- STIX
- Structured Threat Information eXpression. A standardised, machine-readable language for encoding and sharing threat intelligence objects such as indicators, threat actors, campaigns, and...
Explained in these topics
- Common Attack Techniques and Tactics, Techniques and Procedures
- Proactive Threat Hunting MethodologyA publicly maintained knowledge base of adversary tactics and techniques observed in real-world attacks. Widely used as a structuring framework for hunting hyp...
- The Cyber Attack LifecycleA publicly available, continuously updated knowledge base of adversary tactics, techniques, and procedures (TTPs) observed in real incidents. ATT&CK for Enterp...
- Threat Intelligence FundamentalsA publicly maintained knowledge base of adversary tactics and techniques observed in real-world attacks, organised into a matrix. Each technique has a unique I...
- The Threat Landscape and Threat ActorsA publicly maintained knowledge base of adversary tactics and techniques observed in real-world attacks, organised into a matrix covering enterprise, mobile, a...