MITRE ATT&CK
Three matrices, four components
🏢 Enterprise
Techniques targeting corporate environments across Windows, macOS, Linux, cloud services, and network infrastructure. The most widely used matrix.
📱 Mobile
Specialized framework documenting threats against Android and iOS mobile ecosystems.
⚙️ ICS
Dedicated matrix for industrial control systems and operational technology environments with unique safety and availability challenges.
The four levels
The why
The adversary’s strategic objectives. Categories representing the “why” behind each phase of an attack. Things like Initial Access, Persistence, Stealth, Impact.
The how
The specific method used to accomplish a tactic. Each technique has a unique ID (e.g., T1566 for Phishing). Granular enough to map to detection rules and to teach analysts what to look for.
The how, narrower
Granular variations of a parent technique with distinct characteristics. T1566 (Phishing) has sub-techniques T1566.001 (Attachment), T1566.002 (Link), T1566.003 (via Service), T1566.004 (Voice).
The exact thing
Documented examples of techniques as implemented by specific threat actors in observed attacks. The granular operational steps that distinguish one actor from another.
ATT&CK as community knowledge
The framework’s strength is community-driven evolution. Rather than relying on theoretical attack models, ATT&CK draws from documented incidents, Threat An actor (or capability) with intent and means to cause harm. A vulnerability is what they exploit. Classical risk models multiply threat, vulnerability, and impact; ASSURED's RATM folds the threat and vulnerability questions into likelihood, so risk stays impact times likelihood. -intel reporting, and direct contributions from security practitioners worldwide. The framework stays current and actionable as adversaries develop new techniques and repurpose existing ones.
Looking up a technique by ID
Every ATT&CK identifier resolves to a canonical page at attack.mitre.org. The URL pattern is predictable: https://attack.mitre.org/techniques/T1059/ for a top-level technique, https://attack.mitre.org/techniques/T1566/001/ for a sub-technique, and https://attack.mitre.org/tactics/TA0001/ for a tactic. When this site cites an ID, you can paste it into that URL pattern to reach the authoritative description, detection guidance, and known procedures.
The 15 tactics
Enterprise ATT&CK defines 15 tactics: the strategic objectives an adversary pursues during an intrusion. The thirteen below are the ones you can observe in your own telemetry; the callout after the grid covers the two pre-intrusion tactics. Adversaries rarely progress linearly through them, and they may revisit phases multiple times during a single campaign. Identifying which tactic you are observing is what tells you which countermeasures apply. One recent change worth knowing when you read older material: v19 (April 2026) split the long-standing Defense Evasion tactic into Stealth (hiding and blending in) and Defense Impairment (breaking the defenses themselves) — reports and detection rules written before then still say “Defense Evasion.”
Initial access
Techniques to gain entry. Exploiting external apps, phishing, leveraging trusted relationships.
Execution
Running adversary-controlled code. Command lines, PowerShell, malicious macros.
Persistence
Maintaining access across restarts, credentials, or interruptions. Scheduled tasks, startup items, backdoors.
Privilege escalation
Getting higher-level permissions. Vulnerability exploits, token manipulation, UAC bypass.
Stealth
Hiding and concealing actions to look like normal behavior. Obfuscation, masquerading, process injection, indicator removal.
Defense impairment
Breaking security mechanisms and tooling so defenders can’t see or trust what’s happening. Disabling tools, firewall changes, killing logging.
Credential access
Stealing account names and passwords. Keylogging, credential dumping, brute force.
Discovery
Learning about the environment. Network scanning, account enumeration, system info gathering.
Lateral movement
Moving through the environment. Remote services, internal spearphishing, pass-the-hash.
Collection
Gathering data of interest. Screen capture, local system data, browser data.
Command and control
Communicating with controlled systems. Encrypted channels, web services, custom protocols.
Exfiltration
Stealing data. Alternative protocols, scheduled transfers, physical removal.
Impact
Disrupting availability or integrity. Ransomware encryption, defacement, data destruction.
Two pre-intrusion tactics rarely observable from inside
ATT&CK also defines TA0043 Reconnaissance (attacker information-gathering before initial access) and TA0042 Resource Development (infrastructure and capability setup, domain registration, malware compilation, account creation). Both happen before the attacker touches your environment. They are useful context for attribution and threat-intel correlation, but you will rarely catch them in your own telemetry during triage, they show up in your logs as the consequences (the registered domain that resolves to a C2 IP, the spear-phish that lands in a mailbox), not the activity itself. Read them when you’re consuming a threat-intel report; don’t expect to detect them on shift.
Major techniques per tactic
Hundreds of techniques exist across the matrix. These are the ones an analyst should recognize on sight; each has a stable ID that travels well in handoffs.
Initial access
- T1566 Phishing
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1659 Content Injection
Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1204 User Execution
Persistence
- T1547 Boot or Logon Autostart Execution
- T1136 Create Account
- T1098 Account Manipulation
Privilege escalation
- T1548 Abuse Elevation Control Mechanism
- T1134 Access Token Manipulation
- T1068 Exploitation for Privilege Escalation
Stealth
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1055 Process Injection
Defense impairment
- T1685 Disable or Modify Tools
- T1686 Disable or Modify System Firewall
- T1556 Modify Authentication Process
Credential access
- T1003 OS Credential Dumping
- T1110 Brute Force
- T1056 Input Capture
Discovery
- T1018 Remote System Discovery
- T1087 Account Discovery
- T1082 System Information Discovery
Lateral movement
- T1021 Remote Services
- T1550 Use Alternate Authentication Material
- T1091 Replication Through Removable Media
Collection
- T1557 Adversary-in-the-Middle
- T1119 Automated Collection
- T1113 Screen Capture
Command & control
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
Exfiltration
- T1041 Exfiltration Over C2 Channel
- T1048 Exfiltration Over Alternative Protocol
- T1567 Exfiltration Over Web Service
Impact
- T1486 Data Encrypted for Impact
- T1485 Data Destruction
- T1491 Defacement
Sub-techniques add precision
T1059 ( Command and Scripting Interpreter Using legitimate command-line shells or scripting environments (PowerShell, cmd.exe) to execute commands, often to evade detection. ) is broad. T1059.001 ( PowerShell A command-line shell and scripting language built on the .NET framework, commonly used for system administration and potentially for malicious purposes. ), T1059.003 (Windows Command Shell), T1059.005 (Visual Basic) are narrower and far more useful when describing what was actually observed. Wherever sub-techniques exist, the methodology asks for the most specific identifier the evidence supports.
Procedures: how specific actors implement techniques
Procedures represent the specific implementations of techniques used by threat actors or Malware Software whose author intends harm: ransomware, trojans, worms, viruses, spyware, wipers, rootkits, RATs. The B.A.D. glossary catalogs the families in detail. families. While multiple adversaries may employ identical techniques, their procedural implementations often differ significantly based on sophistication, resources, and intent.
T1566.001, Spearphishing Attachment
Uses legitimate cloud storage services to host malware. Sends targeted emails with links to documents containing malicious macros. Macros establish persistence using WMI event subscriptions and execute PowerShell commands for C2 communication.
T1059.001, PowerShell
Deploys heavily obfuscated PowerShell scripts via phishing attachments. Multiple layers of encoding evade detection. Scripts create scheduled tasks for persistence and inject Carbanak malware directly into memory.
T1068, Exploitation for Privilege Escalation
Exploits Windows privilege-escalation vulnerabilities using custom exploit code. Combines multiple vulnerabilities in sequence and employs anti-forensic techniques to hide exploitation artifacts.
Why procedural variation matters
Two actors might both leverage PowerShell for Execution The attacker successfully runs malicious code on a system, typically using interpreters, scripts, payloads, or legitimate tools. (T1059.001) but with very different procedural choices.
One actor might deploy heavily obfuscated scripts with encrypted payloads, prioritizing stealth at the cost of speed. Another might use simpler one-liners that finish quickly but show plainly in logs.
Procedural patterns are what link an investigation to a known Threat Actor Individual or group that conducts malicious activities targeting information systems or networks. when multiple groups use the same technique. They are also what tell defenders which detection rule is going to fire and which is going to miss.
How an analyst uses ATT&CK during Uncover
📌 During Uncover
Map each observed behavior to its ATT&CK technique. The chain of techniques becomes the investigation’s narrative spine.
🤝 For handoff
Naming techniques lets the IR team start work from a shared model rather than re-reading the analyst’s notes.
🔧 For detection engineering
When a technique was observed but not detected automatically, that gap is the feature request for a new rule.
📈 For trend analysis
Tagging cases with techniques over time shows what the SOC sees most often, which feeds prioritization.
📊 For executive communication
ATT&CK gives technical teams a vocabulary executive leadership recognizes after one orientation. Bridges tactical and strategic conversations.
🎯 For gap analysis
Mapping defensive coverage against the matrix surfaces where detection is strong and where it is thin. Drives investment decisions.
Key Takeaway
ATT&CK is the vocabulary that makes Uncover findings portable. The chain of techniques is the artifact that survives the analyst and the alert; “T1566.001 → T1059.001 → T1071.001” travels better than free-form prose, and it travels into IR, detection engineering, threat trends, and executive briefings without translation.
Next up
Tool integration
The tools that make Uncover possible at scale: SIEM, EDR, XDR, ITDR, network analysis, deception, sandboxes, SOAR.
Read tool integration