MITRE ATT&CK Framework
Navigate the ATT&CK matrix, map observed TTPs to techniques, and use Navigator for gap analysis.
MITRE ATT&CK Framework is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What is MITRE ATT&CK?
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a knowledge base of real-world adversary behavior. It provides a common language for describing attacks, organizing detection, and measuring security coverage.
ATT&CK Structure
ATT&CK organizes adversary behavior into: Tactics (the WHY — attacker goals), Techniques (the HOW), and Sub-techniques (specific implementation variants).
# 14 Enterprise Tactics:
# TA0001: Initial Access
# TA0002: Execution
# TA0003: Persistence
# TA0004: Privilege Escalation
# TA0005: Defense Evasion
# TA0006: Credential Access
# TA0007: Discovery
# TA0008: Lateral Movement
# TA0009: Collection
# TA0010: Exfiltration
# TA0011: Command and Control
# TA0040: Impact
# TA0042: Resource Development
# TA0043: ReconnaissanceTechnique Example: T1059
T1059 (Command and Scripting Interpreter) is a broad technique. Sub-techniques specify the interpreter: T1059.001 (PowerShell), T1059.003 (Windows Command Shell), T1059.007 (JavaScript).
# Example technique entry:
# ID: T1059.001
# Name: PowerShell
# Tactic: Execution
# Description: Adversaries abuse PowerShell
# Detection: Event ID 4103/4104
# Mitigation: Script Block Logging, AMSI
# URL format:
# https://attack.mitre.org/techniques/T1059/001/ATT&CK Navigator
ATT&CK Navigator is a web-based tool for visualizing the ATT&CK matrix. Color-code techniques by: detection coverage (green), gaps (red), and threat actor overlap (orange). Essential for gap analysis.
# Access Navigator:
# https://mitre-attack.github.io/attack-navigator/
# Use cases:
# 1. Map your detections → find blind spots
# 2. Map threat actor TTPs → assess exposure
# 3. Plan red team scope → cover realistic paths
# 4. Compare detection before/after controlsMapping Threat Actors
ATT&CK includes profiles for 100+ named threat groups (APT28, Lazarus, FIN7) listing the techniques each group uses. Overlap with your industry's top threat actors reveals your highest-priority detection gaps.
# Example: APT29 (Cozy Bear) techniques include:
# T1566.001: Spear phishing attachment
# T1059.001: PowerShell
# T1003.001: LSASS Memory dump
# T1071.001: Web protocols (C2)
# T1078: Valid accounts
# These → your priority detection targetsUsing ATT&CK for Detection Engineering
For each technique, ATT&CK provides detection guidance: which data sources to collect, what to look for, and recommended tools. Use this to systematically build detection rule libraries.
ATT&CK for Red Teams
Red teams use ATT&CK to ensure realistic attack simulation: plan engagements covering specific tactics, use techniques matching known threat actors targeting your industry, and report findings mapped to technique IDs.
ATT&CK for Blue Teams
Blue teams use ATT&CK to: prioritize detection rule development, assess detection coverage using Navigator, map SIEM alerts to technique IDs, and measure improvement over time.
ATT&CK Beyond Enterprise
ATT&CK has matrices for different domains: Enterprise (Windows/Linux/macOS/cloud), Mobile (iOS/Android), and ICS (Industrial Control Systems). Select the matrix matching your environment.
D3FEND: The Defensive Counterpart
MITRE D3FEND is the defensive counterpart to ATT&CK — it maps defensive techniques (isolate, detect, harden) to the ATT&CK offensive techniques they counter. Use both together for comprehensive security architecture.
Integrating ATT&CK into Workflows
Make ATT&CK part of standard workflow: tag SIEM alerts with technique IDs, require red team reports to include ATT&CK mapping, use technique IDs in vulnerability tickets, and track coverage metrics monthly.
Quick Check
What does ATT&CK Navigator help security teams visualize?
Summary: MITRE ATT&CK
ATT&CK is the common language of modern security operations. Map your detections to it, find gaps, prioritize by the threat actors targeting your sector, and use Navigator to communicate coverage to leadership. Every SOC alert should be tagged with a technique ID — it transforms individual alerts into a strategic picture of adversary behavior in your environment.
Frequently asked questions
Is the “MITRE ATT&CK Framework” lesson free?
Yes — the full text of “MITRE ATT&CK Framework” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “MITRE ATT&CK Framework”?
Navigate the ATT&CK matrix, map observed TTPs to techniques, and use Navigator for gap analysis. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “MITRE ATT&CK Framework” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.