MITRE ATT&CK Explained: How Defenders Use It to Detect Real Attacks

MITRE ATT&CK (Adversarial Tactics, Techniques and Common Knowledge) is a free, public knowledge base of how real attackers behave, built from observed intrusions. It has become the shared vocabulary of security operations: detection rules, threat reports, red team findings and security products all reference ATT&CK technique IDs.

In my own SOC work, ATT&CK is the backbone of detection engineering. This guide explains how it is structured and how to use it without drowning in its size.

Tactics, techniques and procedures

• Tactics are the attacker's goals: why they perform an action, such as gaining initial access or escalating privileges.
• Techniques (and sub-techniques) are how they achieve a tactic, for example phishing (T1566) or OS credential dumping (T1003).
• Procedures are the specific implementations used by particular threat groups or malware.

Together these are known as TTPs. ATT&CK also documents threat groups, software, data sources and mitigations, and links them to techniques.

The 14 enterprise tactics

1. Reconnaissance: gathering information to plan the attack.
2. Resource Development: acquiring infrastructure, accounts or tools.
3. Initial Access: getting a foothold, for example through phishing or exploiting a public-facing application.
4. Execution: running malicious code.
5. Persistence: keeping access across restarts and credential changes.
6. Privilege Escalation: gaining higher permissions.
7. Defense Evasion: avoiding detection.
8. Credential Access: stealing account names and passwords.
9. Discovery: learning about the environment.
10. Lateral Movement: moving between systems.
11. Collection: gathering data of interest.
12. Command and Control: communicating with compromised systems.
13. Exfiltration: stealing data.
14. Impact: disrupting, destroying or encrypting systems and data, as in ransomware.

ATT&CK also has separate matrices for mobile and industrial control systems (ICS).

Using ATT&CK for detection engineering

Map every SIEM rule to one or more technique IDs. This turns a pile of rules into a coverage map. When you write a new detection, start from a technique, check which data sources ATT&CK lists for detecting it, confirm you actually collect those logs, and then write and test the rule.

A practical tip: do not aim to "cover ATT&CK". Many techniques are hard to detect reliably, and a rule that fires constantly is worse than no rule. Aim for high-quality coverage of the techniques most relevant to your threats.

Coverage and gap analysis

The free ATT&CK Navigator lets you colour techniques by coverage. A simple, honest scheme works best: detected and tested, detected but untested, logs available but no rule, and no visibility. The last two categories become your detection engineering backlog.

Threat intelligence and hunting

Threat reports describe adversary behaviour in ATT&CK terms. If a group targeting your sector commonly uses a particular credential dumping technique, you can check your coverage for it immediately and run a threat hunt for signs of it in your logs.

Red and purple teaming

Red teams and penetration testers can report findings as ATT&CK techniques, which makes it easy for defenders to see exactly which behaviours went undetected. In a purple team exercise, attackers execute techniques one by one while defenders confirm whether each is detected, then fix gaps on the spot.

Common mistakes

• Treating the matrix as a checklist and colouring techniques green without testing.
• Counting rules instead of measuring detection quality.
• Ignoring data source gaps: no rule can detect what you do not log.

Want an ATT&CK-based review of your detection coverage? Get in touch.

References and further reading

1. MITRE ATT&CK
2. MITRE ATT&CK Enterprise Matrix
3. MITRE ATT&CK Navigator
4. Microsoft Sentinel overview