MITRE ATT&CK Framework for Detection and Response
Map attacker TTPs to MITRE ATT&CK techniques and use the framework to prioritize detection engineering and gap analysis for your security controls.
What Is MITRE ATT&CK?
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally accessible knowledge base of real-world adversary tactics and techniques based on observed threat intelligence. Maintained by the non-profit MITRE Corporation, it is organized as a matrix of tactics (the attacker's goals) along the top and techniques (the methods used to achieve those goals) as rows. ATT&CK is not a checklist or compliance framework — it is a descriptive model of how real attackers actually behave, derived from incident reports, threat intelligence, and red team exercises. It has become the lingua franca of the security industry for describing attacker behavior.
ATT&CK Matrix Structure: Tactics and Techniques
The ATT&CK Enterprise Matrix contains 14 tactics representing the attacker's high-level objectives: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact. Each tactic contains multiple techniques (specific methods), and many techniques have sub-techniques for more granular descriptions. For example, the Persistence tactic contains the technique T1053 (Scheduled Task/Job) with sub-techniques for Windows Task Scheduler, cron, and cloud schedulers.
# Example ATT&CK technique notation:
# T1059 - Command and Scripting Interpreter (technique)
# T1059.001 - PowerShell (sub-technique)
# T1059.003 - Windows Command Shell (sub-technique)
# T1059.006 - Python (sub-technique)
# Tactics are numbered TA0001 through TA0043
# Techniques are numbered T1001-T9999
# Sub-techniques: T1059.001All lessons in this course
- APT Lifecycle: Initial Access to Persistence
- Lateral Movement: Pass-the-Hash and Pass-the-Ticket
- Kerberoasting and Golden Ticket Attacks
- MITRE ATT&CK Framework for Detection and Response