MITRE ATT&CK

Why does it matter?

ATT&CK gives defenders, threat-intelligence analysts and red teams one vocabulary for what an adversary does after gaining access. A detection rule, a penetration test finding and a threat report can each cite the same tactic and technique, so coverage can be counted and compared across tools, teams and vendors. The knowledge base is built from publicly reported intrusions, which keeps it tied to observed behavior, and MITRE states plainly that it does not enumerate every possible technique or variation.

Key benefits include:

• A shared vocabulary

Tactics give the why, techniques and sub-techniques give the how, and procedures record what a named group or tool actually did, as set out in MITRE's FAQ.

• Measurable detection coverage

Since v18 (October 28, 2025), each technique links to Detection Strategies that contain platform-specific Analytics, replacing the older data-source detection text.

• Threat-informed priorities

Groups, software and campaigns list the techniques observed in the wild, so gaps can be weighted by what named actors actually use.

• Defensive guidance per technique

Mitigations name the classes of control that prevent a technique, such as account use policies, and Detection Strategies name what to collect and analyze.

• Machine-readable data

The full dataset is published as STIX 2.0 and 2.1, through a TAXII 2.1 server and as Excel files, so detection tooling can ingest each release.

How does it work?

The knowledge base is organized as matrices, one per domain (Enterprise, Mobile and ICS). Each matrix is a grid of tactics (columns) and techniques (cells), and techniques carry sub-techniques. The Enterprise matrix in v20 has 15 tactics: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration and Impact. Tactics are not an ordered sequence; MITRE notes that they may not all occur in one intrusion.

Around the matrices sit the objects that connect behavior to evidence and defense. Groups are activity clusters tracked under a common name, software is code or tooling used to carry out a technique, and campaigns are groupings of intrusion activity over a specific period with common targets and objectives. On the defensive side, mitigations, Detection Strategies, Analytics and Data Components describe how to prevent, detect and log each technique. In ICS, Assets name the equipment involved, such as a human-machine interface or a data historian. Enterprise v20 lists 44 mitigations, 703 Detection Strategies, 1,770 Analytics and 106 Data Components.

MITRE releases a new major version twice a year, in April and October, and issues minor versions for corrections between them. Version history lists v20.0 (current from October 13, 2026), v19.2 (April 28 to October 12, 2026) and v18.1 (October 28, 2025 to April 27, 2026). The April 2026 release (v19) split the Defense Evasion tactic into Stealth and Defense Impairment, which matters to anyone whose detection rules, reports or coverage maps still cite Defense Evasion. The October 2026 release (v20) added AI-focused techniques in Enterprise, including Direct Prompt Injection and Indirect Prompt Injection.

Key Elements

• Matrices and domains

Enterprise, Mobile and ICS matrices, each with its own platforms, tactics and techniques.

• Tactics

The adversary's goal in a technique, each with an ID such as TA0001 Initial Access, TA0006 Credential Access or TA0040 Impact.

• Techniques and sub-techniques

How the goal is achieved; sub-techniques describe the behavior at a lower level, such as dumping credentials from LSA Secrets.

• Procedures

The specific implementation or in-the-wild use of a technique, listed as Procedure Examples on each technique page.

• Groups, software and campaigns

Tracked adversary clusters, the tools they use and the intrusion campaigns that link them to techniques.

• Mitigations, Detection Strategies and Analytics

Classes of preventive control, high-level detection approaches and the platform-specific analytics that implement them, with Data Components as the telemetry they need.

What does it cover?

ATT&CK describes adversary behavior against Enterprise IT systems (Windows, macOS, Linux, network devices, containers, ESXi), cloud and identity platforms (IaaS, SaaS, Office Suite, Identity Provider), mobile devices (Android and iOS) and industrial control systems. It applies to any organization that wants to model threats against those technologies, from a security operations center to a product security team. It is not a control catalog: it does not prescribe what an organization must implement, set pass or fail criteria or lead to a certificate, and MITRE's terms of use say it does not enumerate every behavior.

What are its objectives?

MITRE built ATT&CK to document adversary behavior so that offense and defense could measure progress against a common model.

Document tactics, techniques and procedures drawn from public threat reporting, as the FAQ describes the sources.

Give detection engineers a measurable question: how well are we doing at detecting documented adversary behavior, the metric the original FMX research project used.

Give red and blue teams a common model for adversary emulation and analytic testing.

Publish the data in open formats (STIX, TAXII, Excel) with tools such as the ATT&CK Navigator and Workbench.

Keep the model current through a twice-yearly release and community contributions.

Framework in Context

MITRE describes ATT&CK as complementary to other models. The Lockheed Martin Cyber Kill Chain uses ordered phases at a higher level, while ATT&CK tactics are unordered and more granular; the Diamond Model helps cluster intrusions and can consume ATT&CK-mapped techniques. MITRE D3FEND, a separate MITRE knowledge graph of countermeasures, links defensive techniques to offensive ones. MITRE's Center for Threat-Informed Defense publishes mappings of NIST SP 800-53 controls to ATT&CK techniques (January 13, 2022), which lets control frameworks be read against real adversary behavior.

Common Framework Mappings

Organizations map ATT&CK to control frameworks and exchange standards so detections and controls can be traced to adversary behavior and shared in common formats.

Mapped frameworks include:

CIS Controls v8.1

ISO 27001:2022

Lockheed Martin Cyber Kill Chain

MITRE D3FEND

NIST CSF 2.0

NIST 800-53 Rev.5

OASIS STIX/TAXII

PCI DSS 4.0.1