What is MITRE ATT&CK?
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a knowledge base of attacker behavior, built mainly from public threat intelligence and incident reports. It is maintained by MITRE, a US not-for-profit organization, which started it in 2013 as part of a research project on endpoint detection. Any person or organization can use it free of charge.
It has three domains: Enterprise (corporate networks and cloud), Mobile (Android and iOS) and ICS (industrial control systems). The Enterprise matrix covers Windows, macOS, Linux, cloud (IaaS, SaaS, Office Suite and identity providers), network devices, containers and ESXi. It is updated twice a year, and the current version is 19, released in April 2026.
What is the difference between tactics, techniques, sub-techniques and procedures?
| Concept | Answers | Example |
|---|---|---|
| Tactic | The why: the attacker's goal at that moment | Credential Access (TA0006): obtaining credentials |
| Technique | The how, in general terms | OS Credential Dumping (T1003): dumping credentials from the operating system |
| Sub-technique | The how, specifically | LSASS Memory (T1003.001): reading the memory of the Windows LSASS process |
| Procedure | How a specific actor did it | A group runs a tool such as Mimikatz with administrator privileges to extract credentials from LSASS |
Around that structure, ATT&CK documents groups, software and campaigns along with the techniques they use, mitigations and, since version 18 (October 2025), detection strategies and analytics for each technique. In version 19, Enterprise has 15 tactics, 222 techniques and 475 sub-techniques.
What are the 15 MITRE ATT&CK Enterprise tactics?
Since version 19, the former Defense Evasion tactic has been split in two: Stealth, which groups what attackers do to hide and look like normal activity (it keeps the identifier TA0005), and Defense Impairment, which groups what breaks or disables defenses (TA0112). Many guides still refer to 14 tactics because they predate that change.
| ID | Tactic | Attacker's goal | Example technique |
|---|---|---|---|
| TA0043 | Reconnaissance | Gather information to plan the attack | T1595 Active Scanning |
| TA0042 | Resource Development | Obtain infrastructure, accounts and tools | T1583 Acquire Infrastructure |
| TA0001 | Initial Access | Get into the network | T1566 Phishing, T1190 Exploit Public-Facing Application |
| TA0002 | Execution | Run code | T1059.001 PowerShell, T1204.004 Malicious Copy and Paste |
| TA0003 | Persistence | Keep access after a reboot or a password change | T1547.001 Registry Run Keys / Startup Folder |
| TA0004 | Privilege Escalation | Gain higher permissions | T1068 Exploitation for Privilege Escalation |
| TA0005 | Stealth | Hide and look like normal activity | T1027 Obfuscated Files or Information, T1036 Masquerading |
| TA0112 | Defense Impairment | Break or disable security controls | T1685 Disable or Modify Tools |
| TA0006 | Credential Access | Steal usernames, passwords and sessions | T1003.001 LSASS Memory, T1555.003 Credentials from Web Browsers |
| TA0007 | Discovery | Learn the environment from the inside | T1087 Account Discovery |
| TA0008 | Lateral Movement | Move to other systems | T1021.001 Remote Desktop Protocol |
| TA0009 | Collection | Gather the data of interest | T1560 Archive Collected Data |
| TA0011 | Command and Control | Communicate with compromised systems | T1071 Application Layer Protocol |
| TA0010 | Exfiltration | Get the data out | T1567 Exfiltration Over Web Service |
| TA0040 | Impact | Encrypt, destroy or disrupt | T1486 Data Encrypted for Impact, T1490 Inhibit System Recovery |
Tactics are not ordered phases. MITRE makes clear that they do not follow a set sequence and that an intrusion may not go through all of them. This is the main difference from Lockheed Martin's Cyber Kill Chain, which describes ordered phases at a higher level.
How is MITRE ATT&CK used in detection?
- Tag each rule with its technique or sub-technique. Formats such as Sigma already include ATT&CK tags, and most EDR and SIEM tools show the technique on every alert.
- Use each technique's detection strategies to work out what telemetry you need. For T1003.001, for example, you need to log which processes open lsass.exe with memory read permissions.
- Detect behaviors as well as tools. For T1490, what matters is the commands that delete volume shadow copies or disable Windows recovery (vssadmin, wbadmin, bcdedit), whichever ransomware runs them.
- Group alerts by tactic to see how an attack is progressing. Credential access followed by lateral movement from the same machine carries more weight than two isolated alerts.
How is MITRE ATT&CK used in threat hunting?
- Choose relevant techniques: those used by the groups that target your sector, according to your threat intelligence, or those your rules don't cover.
- Formulate a hypothesis. For example: "If someone uses credentials stolen by an infostealer (T1078, Valid Accounts), we will see valid sign-ins from new internet service providers followed by mass access to email."
- Search current telemetry and historical data.
- Document the result and, if you find a useful pattern, turn it into a detection rule so you don't have to hunt for it manually again.
How do you assess detection coverage with ATT&CK?
ATT&CK Navigator, MITRE's free tool, lets you color the matrix in layers: which techniques have telemetry, which have a rule and which have been tested. A practical scale:
| Level | What it means |
|---|---|
| No visibility | You don't log the data needed to see it |
| Telemetry | You have the data, but no rule uses it |
| Detection | There is a rule, but nobody has checked that it fires |
| Tested detection | The technique has been emulated, for example in a purple team exercise, and the alert reached the right people |
MITRE offers three tips to avoid fooling yourself with the matrix. Don't chase 100% coverage, because not every technique affects you equally. Don't mark a technique green because you detect a single way of executing it. And don't limit yourself to the matrix, which only covers behaviors that have already been observed.
What changed in version 19 and what do you need to review?
Besides the Defense Evasion split, several techniques changed identifiers. Impair Defenses (T1562) and its sub-techniques T1562.001 and T1562.006 were merged into the new Disable or Modify Tools technique (T1685), and the remaining T1562 sub-techniques were reissued with new identifiers under Defense Impairment. If your rules, reports or coverage dashboards use tags from version 18 or earlier, review the mapping. Some tools, such as Elastic Security, now only allow rules to be mapped to version 19.
How Ciberia helps
Ciberia Threat Hunting starts from hypotheses based on MITRE ATT&CK, runs retrospective searches focused on persistence and lateral movement, and turns every finding into a new detection rule. Hunting campaigns are prioritized with Ciberia Intel intelligence on threat actors, campaigns and malware families.
