MITRE ATT&CK Framework

The MITRE ATT&CK Framework (Adversarial Tactics, Techniques, and Common Knowledge) is a globally maintained, open knowledge base of adversary tactics and techniques (TTPs), built from real-world observations of attacks. It is the de facto industry standard for describing, comparing, and defending against cyber adversary behaviour.

Overview

• Maintainer: MITRE Corporation (non-profit US Federally Funded R&D Center)
• First released: Public release May 2015 (development began 2013)
• Status: Continuously updated (multiple version releases per year)
• Licence: Open / freely available under a Creative Commons-style open licence
• Basis: Real-world observations documented in threat reports, not theoretical attacks
• URL: https://attack.mitre.org

ATT&CK provides a shared vocabulary for the entire cybersecurity discipline — from threat intelligence and incident response through to detection engineering, red teaming, and security control design.

Core Concept: TTPs

ATT&CK is organised around Tactics, Techniques, and Procedures:

The matrix visualisation plots tactics as columns and techniques as rows, producing the familiar ATT&CK matrix.

The Fourteen Enterprise Tactics

The ATT&CK for Enterprise matrix is organised into 14 tactics, representing the stages of an attack lifecycle:

1. Reconnaissance — gathering information to plan the operation
2. Resource Development — establishing infrastructure, accounts, and capabilities
3. Initial Access — entering the environment (phishing, exploitation, valid accounts)
4. Execution — running malicious code
5. Persistence — maintaining a foothold across reboots/credential changes
6. Privilege Escalation — gaining higher-level permissions
7. Defence Evasion — avoiding detection
8. Credential Access — stealing credentials
9. Discovery — reconnaissance of the internal environment
10. Lateral Movement — moving across the network
11. Collection — gathering data of interest
12. Command and Control — communicating with compromised systems
13. Exfiltration — stealing data out of the environment
14. Impact — manipulating, interrupting, or destroying systems/data

These map loosely to the earlier Lockheed Martin Cyber Kill Chain but are more granular and empirically based.

ATT&CK Domains / Matrices

Knowledge Base Objects

Beyond techniques, the knowledge base is structured around:

• Tactics / Techniques / Sub-techniques — the attack behaviour (the core)
• Groups (G####) — threat actors / APTs (e.g. G0022 APT29) and their documented tool-use
• Software (S####) — malware and tools (e.g. S0586 FinFisher), and which groups use them
• Campaigns (C####) — specific, time-bound intrusion operations (added to differentiate from persistent groups)
• Mitigations (M####) — defensive controls that can prevent or limit a technique (e.g. M1040 Behaviour Prevention on Endpoint)
• Data Sources (DS####) — the telemetry/log types needed to detect a technique (e.g. DS0029 Network Traffic, DS0002 Process Creation)
• Relationships — the mappings between groups, software, techniques, and mitigations

Usage in the Cyber Intelligence Lifecycle

ATT&CK is used across nearly every functional area of cybersecurity:

• Threat intelligence — characterising an adversary's TTPs and normalising reporting from different vendors into one vocabulary
• Detection engineering — designing detections and SIEM rules against specific techniques and data sources
• Adversary emulation — structuring red-team operations and breaches from known group playbooks (MITRE maintains public emulation plans, e.g. APT3 as a reference)
• Purple teaming — aligning red and blue teams on a shared technique-level target
• Gap analysis / maturity — identifying which techniques an organisation has no visibility or control over
• SOC / MSSP service design — scoping detection coverage and communicating service value in a standard metric
• Control validation — testing whether defensive controls actually prevent mapped techniques

Related MITRE Projects

• D3FEND — a knowledge base of countermeasures (the defensive counterpart to ATT&CK)
• ENGAGE — a framework for proactive adversary engagement and deception
• CAR (Cyber Analytics Repository) — analytics/detections expressed against ATT&CK techniques
• ATT&CK Navigator — the interactive tool for visualising and annotating matrix coverage (heatmaps, layer comparison)
• ATT&CK Workbench — tooling to build and maintain custom ATT&CK instances
• STIX/TAXII representation — ATT&CK is machine-readable so tooling and threat-intel platforms can consume it programmatically

Limitations

• Not a full kill chain — ATT&CK focuses on technique-level behaviour, not a complete methodology; it does not cover all post-exploitation or target-specific nuances
• Observation bias — the corpus reflects what has been publicly documented, not a complete picture of adversary behaviour
• A vocabulary, not a risk model — it describes how attacks happen, not organisational risk or likelihood
• Not a compliance framework — it complements, but does not replace, control frameworks such as NIST CSF, ISO 27001, or the ACSC Essential Eight

Australian Angle

MITRE ATT&CK is deeply embedded in the Australian cyber operating environment:

• ACSC publications routinely express adversary activity and incident descriptions in ATT&CK terms, and the Essential Eight and Information Security Manual (ISM) mitigations can be mapped to specific ATT&CK techniques for control-validation purposes
• Commercial threat-intel and MSSP detection services sold to Australian government and critical-infrastructure clients (including the assessments and detection-engineering work the CyberCX Assessments team delivers) use ATT&CK as the shared language for scoping coverage and reporting
• Under the Soci Act framework, ATT&CK-based gap analysis is a practical way to evidence cyber-resilience obligations for critical infrastructure operators <span class="fn">(Cyber Digest Sources — AU cyber landscape)</span>
• For OT-heavy sectors, the ATT&CK for ICS matrix is the relevant domain for mapping threats to Australian industrial control and SCADA environments

Related Pages

• Scattered Spider — a cybercrime group whose TTPs are routinely mapped and tracked via ATT&CK
• Blackcat Alphv — ransomware operation documented and compared using standardised ATT&CK technique IDs
• Ryuk — prolific ransomware variant; operator behaviour classified via ATT&CK techniques
• Uk Cyber Shield — national defensive capability where technique-level detection matters
• Nis2 Directive — regulatory framework that interacts with ATT&CK-based security control validation
• Cyber Kill Chain — higher-level intrusion lifecycle model; ATT&CK's predecessor and framing layer
• D3Fend — MITRE's defensive-countermeasure counterpart to ATT&CK
• Security Control Frameworks — the control/tactical catalogues mapped against ATT&CK for coverage & compliance analysis