Question 1

What is MITRE ATT&CK?

Accepted Answer

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. It provides a common language for describing cyber threats and helps organizations understand and defend against attacks.

Question 2

How is ATT&CK organized?

Accepted Answer

ATT&CK is organized into Tactics (the "why" - adversary goals like Initial Access, Persistence, Exfiltration) and Techniques (the "how" - specific methods to achieve goals). Sub-techniques provide more granular detail. Each technique includes detection methods, mitigations, and real-world examples.

Question 3

How can I use ATT&CK for threat intelligence?

Accepted Answer

Map observed threat actor behaviors to ATT&CK techniques to understand their capabilities. Use this to prioritize defenses against relevant threats, track adversary evolution over time, share threat information using common vocabulary, and identify gaps in your detection coverage.

Question 4

What are the main ATT&CK matrices?

Accepted Answer

Enterprise (Windows, macOS, Linux, Cloud, Network, Containers), Mobile (Android, iOS), and ICS (Industrial Control Systems). Enterprise is most commonly used. Each matrix covers tactics and techniques relevant to that environment.

Question 5

How do I map my defenses to ATT&CK?

Accepted Answer

List your security controls (EDR, SIEM rules, network monitoring). Map each control to techniques it can detect or prevent. Identify coverage gaps - techniques with no detection. Prioritize based on threat relevance to your organization. Use ATT&CK Navigator for visualization.

Question 6

What is the difference between tactics and techniques?

Accepted Answer

Tactics represent the adversary objective (e.g., Credential Access - stealing passwords). Techniques are specific methods to achieve that objective (e.g., T1003 OS Credential Dumping, T1110 Brute Force). One tactic may have many techniques; one technique may achieve multiple tactics.

MITRE ATT&CK Navigator

Need Help with Threat Intelligence?

Frequently Asked Questions

Explore More Tools

Password Strength Checker

Password Generator

CVE Vulnerability Search & Timeline

CWE Lookup Tool

SystemLens

Hash Generator

⚠️ Security Notice