Question 1

What is MITRE ATT&CK?

Accepted Answer

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. It provides a common language for describing cyber threats and helps organizations understand and defend against attacks. Read our ATT&CK Navigator overview.

Question 2

How is ATT&CK organized?

Accepted Answer

ATT&CK is organized into Tactics (the "why" - adversary goals like Initial Access, Persistence, Exfiltration) and Techniques (the "how" - specific methods to achieve goals). Sub-techniques provide more granular detail. Each technique includes detection methods, mitigations, and real-world examples. Learn about ATT&CK sub-techniques.

Question 3

How can I use ATT&CK for threat intelligence?

Accepted Answer

Map observed threat actor behaviors to ATT&CK techniques to understand their capabilities. Use this to prioritize defenses against relevant threats, track adversary evolution over time, share threat information using common vocabulary, and identify gaps in your detection coverage. Read how to use ATT&CK for threat hunting.

Question 4

What are the main ATT&CK matrices?

Accepted Answer

Enterprise (Windows, macOS, Linux, Cloud, Network, Containers), Mobile (Android, iOS), and ICS (Industrial Control Systems). Enterprise is most commonly used. Each matrix covers tactics and techniques relevant to that environment.

Question 5

How do I map my defenses to ATT&CK?

Accepted Answer

List your security controls (EDR, SIEM rules, network monitoring). Map each control to techniques it can detect or prevent. Identify coverage gaps - techniques with no detection. Prioritize based on threat relevance to your organization. Use ATT&CK Navigator for visualization. Learn how to use ATT&CK for red teaming.

Question 6

What is the difference between tactics and techniques?

Accepted Answer

Tactics represent the adversary objective (e.g., Credential Access - stealing passwords). Techniques are specific methods to achieve that objective (e.g., T1003 OS Credential Dumping, T1110 Brute Force). One tactic may have many techniques; one technique may achieve multiple tactics. See ATT&CK tactics vs techniques explained.

MITRE ATT&CK Navigator

MITRE ATT&CK Navigator - Free Threat Intelligence Tool

Example: Technique Lookup

What You Can Do:

ATT&CK Tactics Covered:

Need Help with Threat Intelligence?

Frequently Asked Questions

Explore More Tools

Password Strength Checker

Password Generator

CVE Vulnerability Search & Timeline

CWE Lookup Tool

CVSS Calculator

SystemLens

⚠️ Security Notice