--- title: "MITRE ATT&CK" description: "Globally-accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) observed in real-world attacks, maintained by MITRE." pubDate: 2026-05-09 updatedDate: 2026-10-12 tags: - "framework" - "threat-intel" domain: "foundations" source: "https://zapf.dev/atlas/mitre-attack/" --- **MITRE ATT&CK** (Adversarial Tactics, Techniques & Common Knowledge) is the de-facto common language for describing attacker behavior. It's not a list of vulnerabilities — it's a structured taxonomy of **what attackers actually do** once they're inside a network, derived from incident reports, threat intel, and red-team observation. ## The three-level structure ``` Tactic — The adversary's goal at a stage └── Technique — A method to achieve that goal └── Sub-technique — A specific variant ``` Example: - **Tactic:** Stealth (TA0005) - **Technique:** Obfuscated Files or Information (T1027) - **Sub-technique:** Compile After Delivery (T1027.004) — walked through in [Accidental LOLBin: Controlling Media Keys with csc.exe](/blog/accidental-lolbin-media-keys/). The **T-number** is the canonical identifier you'll see everywhere in threat reporting: blog posts, vendor advisories, Sigma rules, MISP feeds, internal incident reports. Learning to read T-codes fluently is foundational. ## The 15 Enterprise tactics (the kill chain in ATT&CK terms) In rough chronological order of an attack: 1. **Reconnaissance** (TA0043) 2. **Resource Development** (TA0042) 3. **Initial Access** (TA0001) 4. **Execution** (TA0002) 5. **Persistence** (TA0003) 6. **Privilege Escalation** (TA0004) 7. **Stealth** (TA0005) 8. **Defense Impairment** (TA0112) 9. **Credential Access** (TA0006) 10. **Discovery** (TA0007) 11. **Lateral Movement** (TA0008) 12. **Collection** (TA0009) 13. **Command and Control** (TA0011) 14. **Exfiltration** (TA0010) 15. **Impact** (TA0040) ATT&CK v19 (2026) reshaped the middle of the list: TA0005, long known as **Defense Evasion**, is now **Stealth** (hiding and blending in), and techniques that actively sabotage defenses, like disabling tools or firewalls, moved to the new **Defense Impairment** tactic. You'll still see the old name across years of reports and tooling. Real attacks rarely traverse these in clean order — they loop, branch, and sometimes skip stages. ATT&CK's value isn't predicting *the* path, it's giving a vocabulary to describe *any* path. ## How ATT&CK is used in practice - **Detection engineering:** Map each detection rule to the techniques it catches. Quantify your coverage gaps. - **Threat intel:** Describe APT campaigns by the techniques they use, enabling apples-to-apples comparison. - **Purple teaming:** Plan red-team exercises around specific techniques to test blue-team detection. - **Sigma & detection-as-code:** Most [Sigma rules](/atlas/sigma-rules/) reference one or more ATT&CK techniques in their `tags` field. - **Visualizing coverage:** The **ATT&CK Navigator** turns the matrix into annotated layers (heat maps of detections, of a group's techniques, of observed abuse). At [Ekoparty 2026](/blog/ekoparty-2026-embrace-the-chaos/), Chema Alonso showed the same idea applied to AI misuse: Anthropic's red team placed the techniques of accounts banned for abusing its models on the Enterprise matrix, and almost every tactic had entries. ## Common matrices - **Enterprise** — Windows, macOS, Linux, cloud, network. The most-used matrix. - **Mobile** — Android, iOS. - **ICS** — Industrial Control Systems, SCADA, OT environments. Particularly relevant for Critical Infrastructure Protection. ## The wider MITRE family - **[MITRE ATLAS](https://atlas.mitre.org/)** applies the same tactic-and-technique format to attacks on AI and machine learning systems, including [prompt injection](/atlas/prompt-injection/). - **[MITRE D3FEND](https://d3fend.mitre.org/)** is the defensive mirror: a knowledge graph of countermeasures grouped under tactics such as Harden, Detect, Isolate, Deceive, Evict, and Restore. ## Common misconceptions - **"Full coverage means we're safe."** A green cell in a coverage map means *some* detection exists for that technique, not that it catches every procedure an attacker might use. Depth per technique matters more than ticking boxes. - **"The tactics are a sequence."** They're closer to a menu than a timeline; attackers revisit tactics as they go. - **"IDs and names are stable."** Mostly, but not forever: v19's rename of TA0005 means mappings, tags, and dashboards need to track the ATT&CK version they were built on. Sigma's tag appendix, for example, still writes TA0005 as `attack.defense-evasion`. ## Retrieval prompts **Q:** Distinguish tactic, technique, and sub-technique. **A:** **Tactic** = the *why* (the adversary's goal at a stage of the attack — e.g., Stealth). **Technique** = the *how* (a general method to achieve that goal — e.g., T1027 Obfuscated Files or Information). **Sub-technique** = a specific variant of a technique (e.g., T1027.004 Compile After Delivery). **Q:** Why does ATT&CK exist instead of just listing CVEs? **A:** CVEs are vulnerabilities (specific bugs). ATT&CK describes *behaviors* that attackers actually exhibit — many of which work without any CVE (legitimate tools used illegitimately, social engineering, credential abuse). It models post-exploitation in a way CVE databases never can. **Q:** Your detection rules are mapped to ATT&CK v15. Why should you re-check the mappings after a new ATT&CK release? **A:** Because ATT&CK changes. In v19 (2026), TA0005 was renamed from Defense Evasion to **Stealth** and a new **Defense Impairment** tactic (TA0112) took over techniques that sabotage defenses. Coverage maps and tags built on old names or IDs can silently drift. ## References - [MITRE ATT&CK home](https://attack.mitre.org/) - [ATT&CK Matrix for Enterprise](https://attack.mitre.org/matrices/enterprise/) - [ATT&CK Navigator (GitHub)](https://github.com/mitre-attack/attack-navigator) - [MITRE ATLAS — adversarial threats to AI systems](https://atlas.mitre.org/) - [MITRE D3FEND — defensive countermeasures](https://d3fend.mitre.org/) ## Enables - [Sigma Rules](https://zapf.dev/atlas/sigma-rules/) ## Discussed in - [Accidental LOLBin: Controlling Media Keys with csc.exe](https://zapf.dev/blog/accidental-lolbin-media-keys/) - [Ekoparty 2026: Embrace the Chaos](https://zapf.dev/blog/ekoparty-2026-embrace-the-chaos/)