MITRE ATT&CK

MITRE ATT&CK is a publicly maintained knowledge base that catalogs the tactics, techniques and procedures observed across thousands of real-world intrusions. Rather than describing specific malware or tools, ATT&CK organizes attacker behavior into tactics, which describe the attacker's goal at a given stage such as initial access, privilege escalation or exfiltration, and techniques, which describe the specific method used to achieve that goal, such as phishing, credential dumping or exploiting a public-facing application.

ATT&CK's value comes from being behavior-focused rather than indicator-focused. Indicators of compromise, such as a specific malicious IP address or file hash, go stale within days as attackers rotate infrastructure. Behaviors described in ATT&CK, such as using valid accounts to move laterally, persist for years because they reflect fundamental tradeoffs attackers face rather than a specific campaign's disposable tooling. This makes ATT&CK useful for building detections, structuring red team exercises, and communicating about attacker capability in a way that remains relevant over time.

Security teams use ATT&CK in several ways. Detection engineers map their existing alerts to ATT&CK techniques to see which parts of the attack lifecycle they have coverage for and which are blind spots. Threat intelligence teams describe a specific actor's typical behavior as a set of ATT&CK techniques, which lets defenders compare a new incident against known adversary playbooks. Red teams and penetration testers structure engagements around specific ATT&CK techniques to test whether an organization's defenses can detect and respond to realistic attacker behavior rather than synthetic test cases.

In an exposure management context, ATT&CK is most useful for translating a raw technical finding into attacker-relevant language. An exposed remote access panel, for example, maps directly to the External Remote Services technique under Initial Access, which helps a non-technical stakeholder understand not just that something is wrong, but specifically how an attacker would use it to get in. This translation is often what turns a finding from an item on a scanner report into something a business owner will actually prioritize fixing.

ATT&CK is maintained by MITRE, updated regularly as new attacker behaviors are documented, and covers separate matrices for enterprise IT, mobile, industrial control systems and cloud environments, reflecting the fact that attacker techniques differ meaningfully across those environments even when the underlying tactics stay the same.