MITRE ATT&CK Framework
Learn how to use the MITRE ATT&CK framework to understand, analyze and defend against adversary techniques.
What is MITRE ATT&CK?
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a framework describing the tactics and techniques adversaries use in cyberattacks. It serves as a foundation for developing specific threat models and methodologies.
Why use ATT&CK?
- A common language to describe adversary behavior
- A basis for evaluating defenses
- Better detection and response
- Developing threat hunting strategies
The ATT&CK matrices
Three main matrices cover different attack environments
Enterprise
Techniques for enterprise environments (Windows, macOS, Linux, Cloud)
Mobile
Techniques specific to mobile platforms (iOS, Android)
ICS
Techniques for industrial control systems
ATT&CK tactics
Tactics represent the adversary's tactical goals
Reconnaissance
Gathering information about the target
Resource development
Developing attack resources
Initial access
Getting an initial foothold in the network
Execution
Running malicious code
Persistence
Maintaining access
Privilege Escalation
Gaining higher privileges
Defense Evasion
Evading defenses
Tools and resources
Official tools for working with ATT&CK
ATT&CK use cases
Practical applications of the framework in cybersecurity
Threat Hunting
- • Building hunting hypotheses
- • Writing detection queries
- • Behavioral analysis
- • Prioritizing effort
Defense evaluation
- • Mapping detection coverage
- • Identifying gaps
- • Security testing
- • Continuous improvement
Threat Intelligence
- • Campaign analysis
- • Group attribution
- • Threat profiles
- • Information sharing
Training and awareness
- • Simulation exercises
- • Team training
- • Scenario development
- • Process improvement
Ready to go deeper with ATT&CK?
Explore our other CTI resources to round out your learning
Ready to put it into practice?
CyberXTEL is our free platform to train hands-on: certifications, CTFs and a dedicated cyber awareness space.