MITRE ATT&CK Framework for Detection and Response

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally accessible knowledge base of real-world adversary tactics and techniques based on observed threat intelligence. Maintained by the non-profit MITRE Corporation, it is organized as a matrix of tactics (the attacker's goals) along the top and techniques (the methods used to achieve those goals) as rows. ATT&CK is not a checklist or compliance framework — it is a descriptive model of how real attackers actually behave, derived from incident reports, threat intelligence, and red team exercises. It has become the lingua franca of the security industry for describing attacker behavior.

The ATT&CK Enterprise Matrix contains 14 tactics representing the attacker's high-level objectives: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact. Each tactic contains multiple techniques (specific methods), and many techniques have sub-techniques for more granular descriptions. For example, the Persistence tactic contains the technique T1053 (Scheduled Task/Job) with sub-techniques for Windows Task Scheduler, cron, and cloud schedulers.

ATT&CK includes a Groups database cataloguing known threat actor groups (e.g., APT28, APT41, Lazarus Group, Sandworm) with the specific techniques each group has been observed using. This allows defenders to ask: 'We operate in an industry targeted by APT41 — which of their known techniques are we not yet detecting?' ATT&CK also catalogs Software (specific malware tools like Cobalt Strike, Mimikatz, Empire) linked to the techniques they implement. This helps analysts quickly understand the capabilities of malware identified in an incident by looking it up in the ATT&CK software database.

The ATT&CK Navigator is a web-based tool that displays the ATT&CK matrix and allows teams to color-code techniques based on detection coverage, threat actor usage, or test results. Common use cases: red team coverage — marking which techniques were successfully tested in a red team exercise; detection coverage — marking which techniques have SIEM rules or EDR detections deployed; threat actor overlay — importing a threat actor profile to highlight all techniques associated with a specific APT group and immediately see which ones you lack detection for. Navigator produces a gap analysis showing where your defenses have blind spots.

ATT&CK drives structured threat hunting by providing concrete hypotheses: instead of hunting for 'suspicious activity', hunters ask 'Are there signs of T1003.001 (OS Credential Dumping: LSASS Memory) in our environment?' Each ATT&CK technique includes detection guidance listing specific data sources (process events, Windows event logs, network traffic, registry modifications) and indicators to look for. This converts vague hunting intuition into specific data queries that can be written in Splunk, KQL (Microsoft Sentinel), or Elastic. Hunting teams document their results, closing gaps by creating detection rules for techniques discovered with no existing coverage.

During and after an incident, mapping attacker actions to ATT&CK techniques provides several benefits: communication clarity — instead of describing attacker actions in ad-hoc terms, analysts use standardized technique IDs that any security professional understands; timeline reconstruction — ATT&CK tactic ordering mirrors the kill chain, helping organize evidence chronologically; threat intelligence sharing — ATT&CK-tagged IoCs and TTPs can be shared via STIX/TAXII formats in machine-readable form with other organizations and ISACs; and detection improvement — each mapped technique that lacked prior detection becomes a candidate for new SIEM rule or EDR coverage.

Adversary emulation plans use ATT&CK to design red team exercises that replicate the specific TTPs of a known threat group. MITRE provides free adversary emulation plans for groups like APT3, APT29, and FIN6, detailing step-by-step procedures matching their real-world behavior. Tools like CALDERA (MITRE's automated adversary emulation platform), Atomic Red Team (portable, single-technique test scripts), and Cobalt Strike (commercial red team C2) enable executing ATT&CK techniques in a controlled environment. Results directly show which techniques evade existing detection.

Detection engineering uses ATT&CK to systematically build detection rules. For each technique, ATT&CK lists: data sources required to detect it (Windows event logs, Sysmon events, network logs, EDR telemetry), detection indicators (specific process names, command-line patterns, registry paths), and potential false positives. A detection rule should map to a specific ATT&CK technique ID so that coverage can be tracked. Vendors like Splunk (ES Content Update), Elastic (SIEM detection rules), and Sigma (platform-agnostic rule format) all publish ATT&CK-mapped detection rules that can be deployed and customized.

MITRE has expanded ATT&CK beyond enterprise IT to cover additional environments: ATT&CK for ICS (Industrial Control Systems) — covering SCADA, PLCs, and OT environments targeted by threats like Industroyer and TRITON; ATT&CK for Mobile — covering Android and iOS attack techniques including malicious app techniques, SMS phishing, and mobile device exploitation. Each matrix is tailored to its environment's unique architecture and threats. Security+ candidates should be aware these matrices exist and understand that ATT&CK is a growing, maintained framework updated quarterly with new techniques discovered in the wild.

The MITRE ATT&CK matrix and Lockheed Martin Cyber Kill Chain serve related but different purposes. The Kill Chain has 7 high-level phases (Reconnaissance through Actions on Objectives) and is good for high-level narrative descriptions of an attack campaign. ATT&CK has 14 tactics with hundreds of specific techniques and sub-techniques — it is far more granular and actionable for defenders writing detection rules. In practice, many organizations use both: the Kill Chain for executive communication and campaign-level descriptions, and ATT&CK for technical detection engineering and gap analysis. Security+ expects you to understand both frameworks.

During active incident response, ATT&CK accelerates investigation by suggesting what to look for next. If you've confirmed T1059.001 (PowerShell execution), ATT&CK tells you common follow-on techniques: T1105 (Ingress Tool Transfer — downloading additional tools), T1003 (Credential Dumping — next step after execution), T1071 (Application Layer Protocol C2 — PowerShell connecting to attacker infrastructure). This chains into a hypothesis-driven investigation: confirmed technique A suggests technique B; look for B and if found, it confirms the attack pattern and suggests technique C. This makes investigations faster and more systematic than unconstrained data exploration.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: MITRE ATT&CK organizes adversary behavior into 14 tactics and hundreds of techniques/sub-techniques based on real-world observations, serving as the industry standard for describing attacker TTPs, ATT&CK Navigator enables visual gap analysis by overlaying threat actor profiles against your detection coverage to prioritize what to build, and ATT&CK drives detection engineering, threat hunting, and incident response by providing specific data sources, indicators, and technique chaining suggestions. Next up we review the SY0-701 exam domains and their weightings to prepare for certification.