MITRE ATT&CK: tactics and techniques

Why a common language

Before ATT&CK, one report would say "the attacker gained a foothold", another "initial compromise", another "entry". Comparing incidents and tools was hard. MITRE, a US non-profit, built ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) from real incident reports so everyone could use the same names and IDs.

Tactics, techniques, sub-techniques, procedures

• Tactic: the attacker's goal at a stage: the "why". Example: Persistence (keep access after a reboot).
• Technique: a way of reaching that goal: the "how". Example: T1053 Scheduled Task/Job.
• Sub-technique: a more specific way. Example: T1053.005 Scheduled Task (on Windows).
• Procedure: what a specific group or malware actually did, like "Group X created a task named WinUpdateHelper that runs a PowerShell script every hour".

The Enterprise tactics

ATT&CK has matrices for Enterprise (Windows, Linux, macOS, cloud, network), Mobile and ICS (industrial control systems). The Enterprise matrix has 14 tactics, roughly in attack order:

ATT&CK is updated about twice a year, and names, counts and IDs can change. Always check attack.mitre.org for the current version.

Techniques you will meet often

Each technique page lists real-world procedure examples, mitigations (ways to prevent it) and detection advice (which logs and behaviours to look for).

Mapping an incident

incident = [
    ("Email with fake GST notice attachment opened", "T1566.001"),
    ("Excel started PowerShell", "T1059.001"),
    ("Scheduled task WinUpdateHelper created", "T1053.005"),
    ("Security log cleared (Event 1102)", "T1070.001"),
]
for step, technique in incident:
    print(technique.ljust(10), step)

Groups and software

ATT&CK also has pages for known threat groups and malware families, listing which techniques they use. If intelligence says a group targets your sector, its page tells you which techniques to prioritise in detection.

Common mistakes

• Trying to "cover all of ATT&CK". There are hundreds of techniques; prioritise those used against organisations like yours.
• Mapping too loosely: "PowerShell was used" is not proof of every PowerShell sub-technique.
• Treating ATT&CK as a strict order. Real attacks jump around and repeat tactics.
• Forgetting that one technique can serve several tactics (Valid Accounts appears in four).