What Is MITRE ATT&CK?
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally recognized knowledge base of adversary tactics and techniques based on real-world cyberattack observations. Developed and maintained by the MITRE Corporation, it provides a standardized way to understand, describe, and analyze how attackers compromise systems throughout the cyberattack lifecycle.
Why Is MITRE ATT&CK Important?
MITRE ATT&CK helps organizations understand attacker behavior and improve cyber defense by:
- Providing a Common Language: Standardizes how security teams describe and communicate adversary techniques.
- Reflecting Real-World Threats: Maps documented tactics and techniques used by actual threat actors.
- Improving Security Assessments: Helps organizations evaluate detection, prevention, and response capabilities against known attack methods.
What Are the Core Components of MITRE ATT&CK?
MITRE ATT&CK organizes adversary behavior into several key elements:
- Tactics: The attacker’s objective or goal during a stage of an attack, such as Initial Access, Persistence, or Exfiltration.
- Techniques: The methods attackers use to achieve a tactic, such as phishing or credential dumping.
- Sub-techniques: More specific variations of individual techniques that provide additional implementation detail.
- Groups and Software: Information about known threat groups, malware, and tools associated with documented attack techniques.
How Do Organizations Use MITRE ATT&CK?
Organizations use MITRE ATT&CK to strengthen their security programs by:
- Threat Hunting: Searching for indicators of known attacker techniques.
- Security Control Validation: Measuring how effectively security controls detect or prevent ATT&CK techniques.
- Adversary Emulation: Simulating real-world attacker behavior during red team exercises.
- Gap Analysis: Identifying areas where security controls or detection capabilities need improvement.
What Is the Difference Between a Tactic and a Technique?
A tactic represents an attacker’s objective or “why” behind an action.
A technique is the method or “how” the attacker achieves that objective.
For example, Initial Access is a tactic, while Phishing is one of the techniques used to achieve it.
In simple terms, tactics define the goal, while techniques describe the actions used to accomplish that goal.