MITRE ATT&CK

A vocabulary for behavior

MITRE ATT&CK is a knowledge base that organizes adversary behaviors using tactics, techniques, and more specific sub-techniques where appropriate. Tactics describe an objective in the activity being modeled; techniques describe ways an actor can work toward that objective. The framework helps analysts communicate about behavior across tools and investigations.

ATT&CK is not a checklist that proves an organization is secure once every box is colored. A technique can appear through different procedures, platforms, permissions, and evidence sources. A detection covering one implementation should not automatically be credited with detecting all implementations of that technique.

Map what the evidence shows

In a fictional endpoint case, an office document starts a scripting interpreter. The analyst may map the observed interpreter use to the relevant execution technique after checking the evidence. If the records do not show a scheduled task, the analyst should not add a persistence technique merely because persistence is common in similar incidents.

A behavior can support more than one analytical question, and some techniques can relate to multiple objectives. Preserve the concrete observation beside the mapping: process, identity, action, resource, and time. Technique identifiers make communication easier, but they do not replace the factual description.

The framework's procedure examples provide context from reported activity. They should not be used to attribute an incident to a particular actor based on one shared behavior. Many actors and legitimate administrators use the same tools and interfaces.

Use mappings to improve defenses

A detection team can start with a relevant behavior, identify required telemetry, test a rule, and document the conditions covered. Detection engineering then connects the mapping to a usable investigation. A graph of technique coverage is most honest when it distinguishes tested detections, available evidence, planned work, and known gaps.

Threat hunters can use the framework to form hypotheses about behavior that existing alerts may miss. The hypothesis still needs a reason relevant to the environment and evidence that can test it. Searching every technique indiscriminately is not an efficient hunting strategy.

Keep versions and scope in mind

ATT&CK evolves. Names, descriptions, relationships, and platform coverage can change. Preserve the technique identifier and relevant reference when producing a durable report, and revisit mappings when the knowledge base or environment changes.

For practice, take a fictional sequence containing a suspicious sign-in, a new account, and a remote administrative connection. Describe each event in plain language before selecting mappings. Mark where evidence establishes an action and where intent remains uncertain.

Then explain one detection opportunity and one telemetry gap. This is more useful than producing a long list of technique names with no evidence behind them. Threat intelligence, Threat hunting, and Incident reporting and handover use the vocabulary for different purposes.

Related concepts

• Lateral movement
• Persistence