MITRE ATT&CK

Author: Roger C.B. Johnsen

Introduction

MITRE ATT&CK is a knowledge base of adversary tactics, techniques and procedures based on observed real-world behaviour.

For threat hunters, the value of ATT&CK is not that it tells us what happened. It does not. The value is that it gives us a common language for describing adversary behaviour in a precise and repeatable way.

That distinction is important. A vague statement such as this may be technically true, but it is not very useful:

The attacker used PowerShell.

PowerShell is only an artefact. It does not explain intent, context or outcome. The same observation may be part of execution, discovery, defense evasion, credential access, collection or normal administration. A better statement therefore connects the observation to context:

The observed activity may relate to Execution, Discovery, Defense Evasion or Collection depending on context. The specific technique, command-line pattern, parent process and surrounding telemetry decide how it should be interpreted.

This is where ATT&CK becomes useful. It helps hunters, SOC analysts, detection engineers, incident responders and threat intelligence teams describe behaviour with a shared vocabulary. It does not prove attribution, replace analysis or explain the environment by itself. It gives structure to the language we use while we investigate.

That makes it useful for creating hunting hypotheses, describing adversary behaviour, mapping detections, identifying coverage gaps, structuring reports, connecting threat intelligence to local telemetry and communicating findings across teams.

ATT&CK is not the hunt. ATT&CK is the language we can use to describe what the hunt is testing.

– Roger Johnsen

What MITRE ATT&CK Is

MITRE ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge.

At a high level, ATT&CK describes adversary behaviour through tactics, techniques, sub-techniques and procedures. These terms are sometimes used loosely in security conversations, but the distinction matters when the goal is clear hunting, detection engineering or reporting.

A tactic describes the adversary’s goal. A technique describes the method. A procedure describes how that method was actually carried out.

For example:

This is why ATT&CK is useful during threat hunting. It helps the hunter move from broad intent to concrete behaviour.

ATT&CK Matrices

MITRE ATT&CK is not a single matrix for every possible environment. It is organised into different matrices for different technology areas and operational contexts.

The main ATT&CK matrices are:

Most SOC and enterprise threat hunting work uses the Enterprise matrix. That is the matrix this article focuses on.

This matters because ATT&CK mapping should match the environment being investigated. A technique that makes sense in an enterprise endpoint investigation may not be the right vocabulary for a mobile or ICS scenario. The model is useful when it helps describe the observed behaviour in the right technical context.

Enterprise Tactics

The Enterprise ATT&CK matrix currently contains the following tactics:

The tactics are useful because they describe adversary intent. At the same time, hunters should be careful. The matrix can look like a timeline, but it should not be treated as a strict sequence. Real intrusions are iterative. Techniques may repeat. Some techniques may support several tactical goals. Some attacks may skip entire parts of the matrix.

The tactic should help the analyst reason about why behaviour may be occurring. It should not force the evidence into a neat row.

Tactics

Tactics are the adversary’s tactical goals. They describe why an adversary performs an action.

Examples include:

• Initial Access
• Execution
• Persistence
• Credential Access
• Discovery
• Lateral Movement
• Exfiltration
• Impact

For example, if an attacker dumps credentials, the tactic is usually Credential Access. If the attacker uses those credentials to access another system, the tactic may become Lateral Movement. If the attacker uses those credentials to maintain long-term access, the behaviour may also relate to Persistence.

This is important because the same artefact can support different goals depending on context.

A password hash is not a tactic. A PowerShell command is not a tactic. A scheduled task is not a tactic. The tactic is the adversary’s reason for using it.

Techniques

Techniques describe how an adversary achieves a tactical goal.

Examples include:

• Phishing
• Command and Scripting Interpreter
• OS Credential Dumping
• Remote Services
• Scheduled Task/Job
• Account Discovery
• Exfiltration Over Web Service

Techniques are useful because they turn broad adversary goals into observable behaviours. For hunting, this matters because we cannot usually search directly for a tactic. We search for behaviour.

A hunter does not search for “Discovery” in the abstract. The hunter searches for account enumeration, network share discovery, domain trust discovery, cloud service enumeration or other observable activity that may indicate Discovery. A hunter does not search for “Credential Access” in the abstract. The hunter searches for access to credential stores, suspicious LSASS access, unusual use of credential dumping tools, token theft indicators or suspicious authentication patterns.

One observation may map to multiple techniques, and one technique may support multiple tactics. That is normal. The analyst should not force the activity into a single label just to make the mapping look clean.

For example, PowerShell may relate to Execution, Discovery, Defense Evasion, Credential Access or Collection depending on what the command actually does and what happens around it.

Tactics explain the reason. Techniques give the hunter something to look for.

– Roger Johnsen

Sub-Techniques

Sub-techniques provide more specific ways a technique may be performed.

For example, the broad technique OS Credential Dumping contains more specific sub-techniques. Those sub-techniques help describe whether the behaviour involved LSASS memory, the Security Account Manager, cached domain credentials or other credential sources.

This level of detail is useful because detection logic often depends on the specific implementation. A generic mapping to Credential Access may be too broad. A mapping to OS Credential Dumping is better. A mapping to a specific sub-technique, supported by evidence, is often more useful for detection engineering and reporting.

But the mapping should still be honest. If the evidence only supports the broader technique, do not pretend it supports a precise sub-technique.

Procedures

Procedures are the specific ways adversaries implement techniques. This is where threat hunting often becomes practical.

For example:

Procedures matter because they are closer to what appears in logs. A tactic may be useful for communication. A technique may be useful for classification. A procedure is often where the hunting logic starts.

For example, a threat report may say that an actor uses PowerShell for execution and discovery. That is useful, but broad. A hunter needs to translate that into procedure-level questions:

• Which parent processes launch PowerShell?
• Which command-line arguments are used?
• Is the activity encoded?
• Which user ran it?
• Which host ran it?
• What happened before and after?
• Did it touch the network?
• Did it enumerate users, groups, shares or systems?

This is how ATT&CK becomes useful for hunting.

TTPs

TTP stands for Tactics, Techniques and Procedures. The term is widely used, but it is also often used too loosely.

A useful way to think about it is:

For example:

This distinction prevents sloppy reporting.

Weak statement:

The attacker used MITRE Discovery.

Better statement:

The observed PowerShell activity appears consistent with account and group discovery. The command-line content, timing and parent process should be reviewed before mapping it to a specific ATT&CK technique.

ATT&CK should make reporting clearer, not more vague.

Using ATT&CK During Threat Hunting

ATT&CK can help threat hunters structure hypotheses and investigations. A practical hunting flow is:

For example:

This flow is important because ATT&CK mapping alone is not hunting. A technique gives direction, but the hunter still has to define the observable behaviour, identify the data source and validate the result. A technique becomes useful when it can be translated into observable behaviour, relevant data sources and repeatable detection or hunting logic.

ATT&CK Is Not a Checklist

One of the most common mistakes is treating ATT&CK as a checklist. A more specific version of the same mistake is treating MITRE ATT&CK as a detection bingo card.

The thinking goes something like this:

One technique.
One rule.
One checkbox.
One green square in Navigator.

That is not how detection works.

ATT&CK is not a checklist for detection rules. It does not say that every technique can be covered by one rule, or that a mapped rule gives meaningful coverage. Some techniques require several detections across different data sources. Some require enrichment, baselining or correlation. Some are better handled through preventive controls, hardening or response playbooks. Some cannot be hunted properly unless the organisation has the right telemetry in the first place.

A team may create a spreadsheet of techniques, mark some as covered and assume the environment is well defended. That can be misleading, because coverage depends on much more than whether a detection is mapped to a technique.

Useful questions include:

• What behaviour does the detection actually look for?
• Which data source supports it?
• Which systems produce that data?
• How complete is the telemetry?
• How noisy is the logic?
• Can the detection be bypassed easily?
• Has it been tested?
• What does the analyst need to validate it?

A single detection mapped to a technique does not mean the technique is covered. Likewise, a technique without a detection does not always mean the organisation is blind. There may be compensating controls, preventive measures or other visibility.

ATT&CK can make an environment look well-covered while critical behaviours remain undetected. That is the danger of treating it as a coverage spreadsheet instead of a behavioural knowledge base.

ATT&CK helps structure the conversation. It does not replace engineering judgement.

ATT&CK coverage is not a colouring exercise. A green box in Navigator does not mean the organisation can actually detect the behaviour.

– Roger Johnsen

Detection Coverage and Data Sources

ATT&CK is useful for discussing detection coverage because techniques can be connected to data sources and data components. That connection matters because a detection idea is only useful if the organisation has telemetry that can support it.

For example:

The practical question is not:

Do we have ATT&CK coverage?

The better question is:

Which adversary behaviours can we observe, with which data, on which systems, and with what level of confidence?

This is where ATT&CK becomes useful for both hunting and detection engineering.

Using ATT&CK Navigator

ATT&CK Navigator is a web-based tool for working visually with ATT&CK matrices. It lets analysts create layers, colour techniques, add comments, assign scores and build views that represent observations, coverage, priorities or gaps.

In practice, Navigator is often used as a visual workspace for ATT&CK. A team may use it during a hunt to mark techniques that are relevant to the hypothesis. Detection engineers may use it to show where detection logic exists. Threat intelligence teams may use it to compare local coverage against techniques described in reporting.

That makes Navigator useful, but also easy to misuse.

It can be used to:

• map observed techniques during an investigation
• visualise detection coverage
• compare local coverage against threat intelligence
• prioritise hunting areas
• show gaps to stakeholders
• document what has been tested

A coloured technique does not automatically mean that the organisation has strong coverage. When using Navigator, it helps to distinguish between:

Those are different things. Mixing them into one colour can make the map look useful while hiding the real issue.

Practical Example: Manufacturing Company

Consider a simplified intrusion against a manufacturing company.

This table is not meant to imply that the attack happens in a perfect sequence. The value is that the team can describe behaviour consistently and ask what evidence supports each mapping.

For example:

ATT&CK helps name the behaviour. The hunter still needs to prove what happened.

Combining ATT&CK With the Kill Chain Models

ATT&CK works well with the Lockheed Martin Kill Chain and the Unified Kill Chain. The Kill Chain models help describe progression. ATT&CK helps describe behaviour.

For example, a hunter may use the Unified Kill Chain to decide that the activity appears to be in the Through phase. ATT&CK can then describe the specific behaviour as Discovery, Credential Access or Lateral Movement. The Diamond Model can connect the behaviour to the victim, infrastructure and possible adversary context.

Together, the frameworks support better investigation notes and clearer handover. They should not become competing taxonomies.

What Usually Goes Wrong

Several mistakes are common when teams use ATT&CK.

ATT&CK should improve precision. If it makes the report more vague, it is being used badly.

Working Position for This Book

For this book, MITRE ATT&CK is best treated as a behavioural vocabulary for threat hunting.

It helps describe what the adversary may be doing, but it does not replace investigation.

The practical workflow is:

Observation → Behaviour → ATT&CK mapping → Data source → Hunting question → Validation

The hunter should start with evidence, map carefully, and avoid pretending that the framework proves more than it does.

ATT&CK becomes powerful when it is combined with telemetry, environment knowledge, threat intelligence and structured reasoning.

Use ATT&CK to describe behaviour clearly. Do not use it to decorate weak analysis.

– Roger Johnsen

Resources

• MITRE ATT&CK
• MITRE ATT&CK Enterprise Tactics
• ATT&CK Navigator
• MITRE Center for Threat-Informed Defense
• MITRE ATT&CK Data & Tools
• Threat Hunting with the MITRE ATT&CK Framework

Revision