Incident Response and Management · Topic 1 of 6

MITRE ATT&CK Framework

Understand MITRE ATT&CK tactics, techniques and sub-techniques, how analysts map evidence to technique IDs, and how the matrix supports hunting.

  • 5 min
In a nutshell
  • ATT&CK is a knowledge base of real adversary behaviour, not a scoring system or a product.
  • Tactics are goals, techniques are methods, and sub-techniques are specific variants.
  • Technique IDs begin with T, and sub-techniques add a dot suffix.

What it is

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a public knowledge base of behaviours that real attackers have been seen using. It is built from observed incidents and reports, and it is organised so that defenders can describe attacks in a shared language.

At its core the framework describes what attackers do, and it is not a product or a scoring system. Analysts use it to label evidence, to find gaps in detection and to compare their coverage with the behaviour of known threat groups.

Evidencelog, alert or hunt resultTechniquematched to an IDTacticthe attacker goalCoveragedo we detect itActionimprove detection or response

How it works

Tactics, techniques and sub-techniques

The structure has three layers.

LayerMeaningExample
TacticThe attacker's goal at that moment, the "why"Initial Access
TechniqueThe way the goal is reached, the "how"Phishing (T1566)
Sub-techniqueA more specific variant of a techniquePassword Spraying (T1110.003)

Tactics have identifiers starting with TA, techniques with T followed by four digits, and sub-techniques add a dot and three digits. A technique can appear under more than one tactic when it serves more than one goal.

The Enterprise matrix

The Enterprise matrix lists tactics roughly in the order of an intrusion. Common ones include:

  • Reconnaissance and Resource Development: preparation before the attack.
  • Initial Access: the first foothold, for example through phishing or stolen valid accounts.
  • Execution: running attacker code.
  • Persistence: staying on the system after a restart or password change.
  • Privilege Escalation: gaining higher rights.
  • Defense Evasion: avoiding detection, such as disabling logging.
  • Credential Access: stealing passwords or tokens.
  • Discovery: learning about the environment.
  • Lateral Movement: moving between systems.
  • Collection: gathering the data of interest.
  • Command and Control: communicating with compromised systems.
  • Exfiltration: taking data out.
  • Impact: harming availability or integrity, for example by encrypting data.

The order is a guide and not a strict sequence. Attackers repeat and skip tactics.

ATT&CK has separate matrices for Enterprise IT, mobile devices and industrial control systems (ICS).

What else the knowledge base holds

  • Groups: profiles of named threat actors and the techniques they use.
  • Software: malware and tools, linked to techniques.
  • Mitigations: defensive measures mapped to techniques.
  • Data sources: the kinds of telemetry that can show a technique.
  • ATT&CK Navigator: a web tool that colours matrix cells so teams can show coverage or an attacker's profile.

Mapping evidence to techniques

Observed: a scheduled task was created on a server and runs a script at every startup
Tactic:   Persistence
Technique: Scheduled Task/Job (T1053)

Observed: many login failures, each from one source, each against a different account with the same password
Tactic:   Credential Access
Technique: Brute Force, Password Spraying (T1110.003)

The mapping turns scattered observations into a shared description. It also lets an analyst ask what usually comes next: after a Persistence finding, check for Credential Access and Lateral Movement.

How analysts use ATT&CK

  1. Detection coverage: list which techniques your tools can detect and where there are blind spots.
  2. Threat hunting: choose a technique used by a relevant group and search for it.
  3. Incident analysis: place each observed action on the matrix to understand the intrusion path.
  4. Reporting: use technique IDs so other teams and vendors understand the same thing.
  5. Intelligence: compare your threats with group profiles to decide priorities.
  6. Testing: plan exercises that check whether controls catch chosen techniques.
Exam tip

Remember the pair "tactic is why, technique is how". A question that asks about the goal is asking for a tactic, and one that asks about the method is asking for a technique.

What to remember for the exam

  • ATT&CK is a knowledge base of real adversary behaviour, not a scoring system or a product.
  • Tactics are goals, techniques are methods, and sub-techniques are specific variants.
  • Technique IDs begin with T, and sub-techniques add a dot suffix.
  • The matrix follows the likely flow of an intrusion, from reconnaissance to impact.
  • Defense Evasion, Persistence and Lateral Movement are tactic names the exam may use in scenarios.
  • It has separate matrices for Enterprise, mobile and ICS.
  • The Navigator visualises coverage and group profiles.
  • Mapping evidence to ATT&CK supports hunting, gap analysis and reporting.
  • It is based on observed behaviour, so it helps predict likely next steps.

Common mistakes

Treating ATT&CK as a checklist that must be fully covered. No team detects every technique, so prioritise those relevant to likely threats.

Mixing up tactic and technique. A tactic such as Persistence is the objective, while a technique such as Scheduled Task/Job is one way to reach it.

Assuming the columns are a strict order. Attackers move back and forth, and some skip steps.

Using it only after an incident. It is equally useful for planning detection and hunting.

Confusing it with the Cyber Kill Chain. The kill chain is a short linear model of stages, while ATT&CK is a detailed catalogue of behaviours.

Check yourself

  • In ATT&CK, what is the difference between a tactic and a technique?

    A tactic is the attacker's goal, and a technique is the method used to achieve it.

  • What does an ID such as T1110.003 represent?

    A sub-technique, here Password Spraying, which is a variant of the Brute Force technique.

  • Name one way an analyst uses ATT&CK in threat hunting.

    Choosing a technique that a relevant threat group uses and searching the logs and endpoint data for evidence of it.

Topic 1 of 6 in Incident Response and Management

Test yourself on Incident Response and Management

The full CompTIA CySA+ CS0-004 question bank has 654 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.