The MITRE ATT&CK Framework Explained

The MITRE ATT&CK framework is a publicly available, curated knowledge base of real-world adversary behavior, organized into the tactics, techniques, and procedures (TTPs) attackers use across the stages of an intrusion. Maintained by the MITRE Corporation, it gives defenders a common language for describing how attacks unfold and a structured way to measure and improve detection and response. For anyone working in threat intelligence, detection engineering, or security operations, fluency in ATT&CK is a core skill.

What ATT&CK Is and Why It Exists

ATT&CK — which stands for Adversarial Tactics, Techniques, and Common Knowledge — was created to catalog observed adversary behavior rather than theoretical possibilities. Its value comes from being behavior-focused: instead of listing specific malware or vulnerabilities, it describes what attackers actually do, which changes far more slowly than the tools they use.

This behavioral focus makes ATT&CK useful for:

• A shared vocabulary across teams, vendors, and reports.
• Assessing defensive coverage against known techniques.
• Guiding detection engineering and threat hunting.
• Structuring threat intelligence about specific adversary groups.

The Structure of ATT&CK

Tactics: The "Why"

Tactics represent an attacker's tactical goals — the reason for an action. They form the columns of the ATT&CK matrix and follow the rough progression of an intrusion, including categories such as:

• Reconnaissance and Resource Development
• Initial Access
• Execution, Persistence, and Privilege Escalation
• Defense Evasion and Credential Access
• Discovery and Lateral Movement
• Collection, Command and Control, Exfiltration, and Impact

Techniques: The "How"

Techniques describe how an adversary achieves a tactical goal — for example, achieving execution through a command interpreter, or persistence through a scheduled task. Many techniques have more granular sub-techniques. Each carries a unique identifier along with documentation of detection ideas, mitigations, and real-world usage.

Procedures: The Specific Implementation

Procedures are the concrete, observed ways a particular adversary or tool performs a technique. Together, tactics, techniques, and procedures form the TTPs that describe adversary behavior at increasing levels of detail.

The ATT&CK Matrices

ATT&CK is divided into technology domains so techniques stay relevant to the environment being defended:

• Enterprise — Windows, macOS, Linux, cloud, containers, and network infrastructure.
• Mobile — threats against mobile operating systems.
• ICS — industrial control systems and operational technology.

A companion catalog of adversary groups and software maps observed real-world actors and tools to the techniques they use, turning the matrix into a threat-intelligence resource. This behavioral profiling is especially useful against advanced persistent threats, whose tradecraft ATT&CK documents in detail.

The Pyramid of Pain and Why Behavior Matters

A concept closely associated with ATT&CK is the Pyramid of Pain, which ranks indicators by how much it hurts an adversary when you detect and block them. Simple indicators like file hashes are trivial for an attacker to change; TTPs sit at the top because changing core behavior is costly and slow.

Most painful to attacker ->  TTPs (behaviors)
                             Tools
                             Network / Host Artifacts
                             Domain Names
                             IP Addresses
Least painful to attacker -> Hash Values

Detecting at the level of techniques and behaviors — exactly what ATT&CK catalogs — forces adversaries to fundamentally retool, which is far harder than swapping an IP address or file hash.

How Defenders Use ATT&CK

1. Coverage mapping — charting which techniques your controls and detections can see, often visualized as a heat map with the ATT&CK Navigator tool, to expose blind spots.
2. Detection engineering — writing and validating analytics tied to specific techniques rather than brittle static signatures.
3. Threat-informed defense — prioritizing the techniques used by adversaries most relevant to your organization.
4. Purple teaming and adversary emulation — running red-team actions mapped to ATT&CK and confirming the blue team detects them.
5. Communicating clearly — referencing technique identifiers in reports so everyone understands exactly what was observed.

Behaviors seen across many intrusions — such as credential dumping or the abuse of legitimate tools described in fileless malware and living-off-the-land techniques — become concrete detection targets when framed as ATT&CK techniques.

Common Pitfalls

• Chasing full coverage — attempting to detect every technique equally instead of prioritizing by relevance and risk.
• Treating it as a checklist — mapping tools to techniques on paper without validating that detections actually fire.
• Ignoring data quality — analytics are only as good as the underlying logging and telemetry.

Key Takeaways

• The MITRE ATT&CK framework is a behavior-focused knowledge base of adversary tactics, techniques, and procedures (TTPs).
• Tactics are the "why," techniques the "how," and procedures the specific implementations, organized across Enterprise, Mobile, and ICS matrices.
• ATT&CK's behavioral focus aligns with the Pyramid of Pain: detecting TTPs hurts adversaries far more than blocking hashes or IP addresses.
• Defenders use it for coverage mapping, detection engineering, threat-informed defense, and purple teaming.
• Avoid treating ATT&CK as a checklist — validate detections and prioritize techniques by real-world relevance.