Browse MITRE ATT&CK Enterprise tactics, techniques, and sub-techniques in a matrix or list view. Search by ID, name, or description for threat hunting.
MITRE ATT&CK is a curated, publicly available knowledge base of adversary behaviour observed in real intrusions. It is not a vulnerability list and not a control framework — it catalogues what attackers actually do once they are operating, organised so that detection engineers, threat hunters, and red teams can talk about the same behaviours in the same words. This browser puts the Enterprise matrix in front of you with search, an authentic matrix layout, a list view, and a detail panel for every technique.
It currently serves an Enterprise ATT&CK snapshot of 14 tactics, 215 parent techniques, and 468 sub-techniques — 683 techniques in total — loaded from our own database rather than fetched from MITRE on every page view, so browsing stays fast. Every technique links out to its canonical page on attack.mitre.org.
The structure is a three-level hierarchy, and getting it right is the difference between using ATT&CK and merely quoting it.
Tactics are the adversary’s objectives — the why. Each answers a goal: get in, run code, survive a reboot, avoid detection, steal credentials, move sideways, get data out, cause harm. Tactics carry TA identifiers and form the columns of the matrix, ordered roughly in the sequence an intrusion unfolds. That ordering is a convenience, not a rule — real intrusions loop, skip, and revisit tactics constantly.
Techniques are how an objective is achieved — the how. They carry T identifiers such as T1078 (Valid Accounts) and appear as cells within a tactic’s column. One technique can belong to several tactics: Valid Accounts serves Initial Access, Persistence, Privilege Escalation, and Defense Evasion simultaneously, which is why the same cell appears in multiple columns.
Sub-techniques are more specific variants of a parent, numbered with a decimal suffix — T1078.001 Default Accounts, T1078.002 Domain Accounts, T1078.003 Local Accounts, T1078.004 Cloud Accounts. They exist because “Valid Accounts” is too coarse for detection engineering: the telemetry that catches a compromised cloud account is nothing like the telemetry that catches a local one. In this browser, sub-technique counts appear on the parent cell, and the full list is in the detail panel.
Around that core, ATT&CK maintains mitigations (defensive measures that reduce a technique’s effectiveness), data sources and data components (the telemetry that makes detection possible), groups (tracked threat actors), software (malware and tools), and campaigns (attributed sets of activity).
ATT&CK is versioned and MITRE revises it regularly, including renaming and restructuring tactics. Treat any matrix snapshot — this one included — as a point-in-time view, and check attack.mitre.org for the current release before publishing coverage claims or mapping to an audited framework.
T1059 finds the command interpreter technique; searching powershell finds every technique whose description mentions it, which is usually the more revealing query.The footer keeps a running count of tactics, total techniques, and how many survive your current filter — useful for gauging how broad a search actually is.
Detection coverage mapping. Take the alerts your SIEM or EDR currently produces and map each to the techniques it detects. Colour the matrix by coverage and the gaps become visible in a way a list of alert names never manages. The usual finding is heavy clustering in Execution and Initial Access with almost nothing under Discovery, Collection, or Exfiltration — which is precisely where a quiet intrusion spends most of its time.
Threat hunting hypotheses. A hunt needs a testable statement, and a technique makes a good one. “If an adversary were using T1055 Process Injection here, what would that look like in our process-creation telemetry, and can I query for it?” is a hunt. “Look for anything unusual” is not.
Purple teaming. Red team picks a technique, emulates it, blue team checks whether it was detected, and the result is recorded against a specific ID. Over time you accumulate an evidence-backed coverage map rather than a vendor’s claim.
Incident write-ups. Describing an intrusion in ATT&CK IDs makes it comparable to other incidents and to published threat intelligence. “Initial access via T1566.001 spearphishing attachment, execution via T1059.001 PowerShell, persistence via T1053.005 scheduled task” is unambiguous in a way prose is not.
Prioritising work. Because groups and software are mapped to techniques, you can start from the actors that plausibly target your sector and work back to the techniques worth detecting first — a far better prioritisation input than treating all 683 techniques as equally likely.
Two failure modes recur. The first is treating coverage as a percentage to maximise. Full coverage of the matrix is neither achievable nor meaningful: techniques vary enormously in how often they appear in real intrusions, in how much damage they enable, and in how detectable they are at all. A defence that reliably catches the twenty techniques your threat model says matter is worth more than shallow signatures across two hundred.
The second is confusing ATT&CK with a control framework. It describes attacker behaviour; it does not tell you what to build. NIST CSF, CIS Controls, and ISO 27001 tell you what to build. They are complementary — ATT&CK is the best available answer to “would we notice?”, not to “are we compliant?”
A tactic is the adversary’s goal — persistence, credential access, exfiltration — and carries a TA identifier. A technique is a specific method of achieving that goal, carries a T identifier, and can serve more than one tactic at once.
A narrower variant of a parent technique, identified with a decimal suffix such as T1078.004. Sub-techniques exist because detection requires specificity: the evidence for a compromised cloud account differs completely from the evidence for a compromised local one, even though both are Valid Accounts.
This browser serves a snapshot containing 14 Enterprise tactics. MITRE revises the framework on a regular release cadence and has restructured tactics in recent versions, so confirm the current count and naming on attack.mitre.org before citing a number in a report.
No. It loads a stored snapshot from our database, which keeps browsing fast and works regardless of MITRE’s availability. Every technique links to its canonical MITRE page for the authoritative current content.
Three separate domains. Enterprise covers Windows, macOS, Linux, cloud, containers, and network infrastructure. Mobile covers iOS and Android. ICS covers industrial control systems. This browser presents the Enterprise matrix.
Only indirectly. ATT&CK describes attacker behaviour, not controls, so it does not map cleanly to a compliance checklist. It is most valuable as evidence of detection capability alongside a control framework such as NIST CSF or CIS Controls.
Pick one tactic where you suspect you are weak — Discovery and Collection are common blind spots — and work through its techniques asking one question each: would our current telemetry show this? A short list of confirmed gaps beats a full-matrix survey nobody finishes.
The threat modeling wizard works the same problem from the design side with STRIDE and DREAD, the Nmap command builder covers the reconnaissance techniques you would emulate, and the risk matrix calculator helps turn identified gaps into a prioritised register.
The MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. Maintained by the MITRE Corporation, it catalogs how threat actors operate—from initial access through data exfiltration—providing a common language for describing cyber threats, evaluating defenses, and prioritizing security investments.
ATT&CK has become the de facto standard for threat intelligence, security operations, and red/purple teaming. Over 80% of enterprise security teams use it to map detection coverage, assess security gaps, and communicate about threats. The framework covers Enterprise (Windows, macOS, Linux, cloud, containers, network), Mobile (Android, iOS), and ICS (Industrial Control Systems) platforms.
The framework organizes adversary behavior into a hierarchical taxonomy:
| Level | Description | Example |
|---|---|---|
| Tactic | The adversary's goal (the "why") | TA0001: Initial Access |
| Technique | How the goal is achieved | T1566: Phishing |
| Sub-technique | Specific variation of a technique | T1566.001: Spearphishing Attachment |
| Procedure | Real-world implementation by a threat group | APT29 used spearphishing with COVID-19 lures |
Enterprise ATT&CK Tactics (kill chain order):
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is globally-accessible knowledge base of adversary behaviors. Organized by 14 tactics (objectives) and 200+ techniques (methods). Covers: Enterprise (Windows, Linux, macOS, Cloud), Mobile, ICS (industrial). Used for: threat intelligence, detection engineering, red teaming, security assessments. Based on real-world observations. Free, community-driven. Updated quarterly. Essential reference for cybersecurity professionals.
Tactics are adversary objectives (why), techniques are methods (how). 14 tactics: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact. Each tactic has multiple techniques. Example: Persistence (tactic) → Create Account (technique) → Domain Account (sub-technique). Use tactics for strategic planning, techniques for detection rules, sub-techniques for specific indicators.
ATT&CK-based hunting workflow: 1) Select threat actor/campaign (APT29, Ryuk ransomware). 2) Review associated techniques from ATT&CK. 3) Develop hypotheses (if technique used, what logs/artifacts?). 4) Create detection queries (SIEM, EDR). 5) Hunt across environment. 6) Document findings. 7) Update detections. Example: T1003 OS Credential Dumping → search for LSASS access, registry hives, suspicious PowerShell. Map detections to techniques for coverage visibility.
ATT&CK Navigator is web-based tool for visualizing ATT&CK coverage. Features: color-code techniques (detected, not detected), layer overlays (compare defenses), export matrices, annotate techniques. Use cases: gap analysis (what techniques not detected?), tool evaluation (which techniques does EDR detect?), threat modeling (which APT techniques apply?), detection prioritization. JSON export for sharing. Version: supports all ATT&CK matrices (Enterprise, Mobile, ICS). Official tool from MITRE.
Detection mapping identifies which techniques your controls detect. Process: 1) Inventory security tools (EDR, SIEM, IDS, AV). 2) Review detection rules/signatures. 3) Map each detection to ATT&CK technique. 4) Score confidence (high/medium/low detection). 5) Visualize in Navigator (color-code). 6) Identify gaps. 7) Prioritize new detections. Example: Sysmon Event 10 (process access) → maps to T1003.001 (LSASS Memory). Frameworks: Detection as Code (Sigma), ATT&CK Navigator layers.
Sub-techniques are specific implementations of broader techniques. Added in 2020 to increase granularity. Example: T1003 OS Credential Dumping has sub-techniques: T1003.001 LSASS Memory, T1003.002 Security Account Manager, T1003.003 NTDS, etc. Helps: precise detection engineering, reduce false positives, better threat reporting. Format: T####.### (technique.sub-technique). Not all techniques have sub-techniques. Use for: detailed mapping, specific IOC creation, incident attribution.
Red team ATT&CK integration: 1) Select target techniques based on scenario (APT emulation, ransomware). 2) Plan attack chain (Initial Access → Persistence → Lateral Movement → Impact). 3) Use ATT&CK for tool selection (which tools implement technique?). 4) Document techniques used during engagement. 5) Map results to ATT&CK for report (show gaps). 6) Test blue team detections per technique. Tools: Atomic Red Team (automated tests), Caldera (C2), Red Canary Atomic tests.
Data sources identify logs/telemetry needed to detect techniques. Examples: Process Monitoring (Sysmon, EDR), Network Traffic (NetFlow, PCAP), Windows Event Logs (Security, System), File Monitoring (FIM), Cloud Audit Logs (CloudTrail, Azure Monitor). Each technique lists required data sources. Use for: logging strategy, tool requirements, detection feasibility. ATT&CK v10+ includes data components (specific log events). Example: T1003 needs Process Access (Sysmon Event 10), Windows Event 4656.