MITRE ATT&CK · Atlas

MITRE ATT&CK (Adversarial Tactics, Techniques & Common Knowledge) is the de-facto common language for describing attacker behavior. It’s not a list of vulnerabilities — it’s a structured taxonomy of what attackers actually do once they’re inside a network, derived from incident reports, threat intel, and red-team observation.

The three-level structure

Tactic        — The adversary's goal at a stage
  └── Technique     — A method to achieve that goal
        └── Sub-technique — A specific variant

Example:

Tactic: Stealth (TA0005)
- Technique: Obfuscated Files or Information (T1027)
  - Sub-technique: Compile After Delivery (T1027.004) — walked through in Accidental LOLBin: Controlling Media Keys with csc.exe.

The T-number is the canonical identifier you’ll see everywhere in threat reporting: blog posts, vendor advisories, Sigma rules, MISP feeds, internal incident reports. Learning to read T-codes fluently is foundational.

The 15 Enterprise tactics (the kill chain in ATT&CK terms)

In rough chronological order of an attack:

Reconnaissance (TA0043)
Resource Development (TA0042)
Initial Access (TA0001)
Execution (TA0002)
Persistence (TA0003)
Privilege Escalation (TA0004)
Stealth (TA0005)
Defense Impairment (TA0112)
Credential Access (TA0006)
Discovery (TA0007)
Lateral Movement (TA0008)
Collection (TA0009)
Command and Control (TA0011)
Exfiltration (TA0010)
Impact (TA0040)

ATT&CK v19 (2026) reshaped the middle of the list: TA0005, long known as Defense Evasion, is now Stealth (hiding and blending in), and techniques that actively sabotage defenses, like disabling tools or firewalls, moved to the new Defense Impairment tactic. You’ll still see the old name across years of reports and tooling.

Real attacks rarely traverse these in clean order — they loop, branch, and sometimes skip stages. ATT&CK’s value isn’t predicting the path, it’s giving a vocabulary to describe any path.

How ATT&CK is used in practice

Detection engineering: Map each detection rule to the techniques it catches. Quantify your coverage gaps.
Threat intel: Describe APT campaigns by the techniques they use, enabling apples-to-apples comparison.
Purple teaming: Plan red-team exercises around specific techniques to test blue-team detection.
Sigma & detection-as-code: Most Sigma rules reference one or more ATT&CK techniques in their tags field.
Visualizing coverage: The ATT&CK Navigator turns the matrix into annotated layers (heat maps of detections, of a group’s techniques, of observed abuse). At Ekoparty 2026, Chema Alonso showed the same idea applied to AI misuse: Anthropic’s red team placed the techniques of accounts banned for abusing its models on the Enterprise matrix, and almost every tactic had entries.

Common matrices

Enterprise — Windows, macOS, Linux, cloud, network. The most-used matrix.
Mobile — Android, iOS.
ICS — Industrial Control Systems, SCADA, OT environments. Particularly relevant for Critical Infrastructure Protection.

The wider MITRE family

MITRE ATLAS applies the same tactic-and-technique format to attacks on AI and machine learning systems, including prompt injection.
MITRE D3FEND is the defensive mirror: a knowledge graph of countermeasures grouped under tactics such as Harden, Detect, Isolate, Deceive, Evict, and Restore.

Common misconceptions

“Full coverage means we’re safe.” A green cell in a coverage map means some detection exists for that technique, not that it catches every procedure an attacker might use. Depth per technique matters more than ticking boxes.
“The tactics are a sequence.” They’re closer to a menu than a timeline; attackers revisit tactics as they go.
“IDs and names are stable.” Mostly, but not forever: v19’s rename of TA0005 means mappings, tags, and dashboards need to track the ATT&CK version they were built on. Sigma’s tag appendix, for example, still writes TA0005 as attack.defense-evasion.