MITRE ATT&CK Fundamentals cheat sheet

ATT&CK is a curated knowledge base of adversary behavior observed in the real world, organized as tactics (the why), techniques (the how), and procedures (specific implementations).

The framework was created at MITRE in 2013 out of a research effort to characterize post-compromise adversary behavior; it was publicly released in May 2015.

ATT&CK is not a checklist, not a vulnerability database, and not an attribution tool: it describes behavior, not actors' identities or specific malware signatures.

The three technology domains are Enterprise (Windows, macOS, Linux, Cloud, Network, Containers), Mobile (Android, iOS), and ICS (industrial control systems).

Tactic ordering follows the adversary lifecycle roughly from Reconnaissance and Resource Development through Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact.

Enterprise ATT&CK uses the tactic name 'Defense Evasion'; ICS uses 'Evasion' and adds ICS-specific tactics such as Inhibit Response Function, Impair Process Control, and Collection.

ATT&CK IDs are stable identifiers: techniques use T#### (e.g., T1059), sub-techniques use T####.### (e.g., T1059.001), software uses S####, groups G####, campaigns C####, and mitigations M####.

ATT&CK content is versioned and released in numbered versions (e.g., v14, v15); each release notes new techniques, deprecations, and STIX bundle updates.

ATT&CK differs from the Cyber Kill Chain in granularity: Kill Chain has 7 linear phases, while ATT&CK offers 14 Enterprise tactics and hundreds of techniques with procedure examples.

A tactic is the adversary's tactical goal - the reason for performing an action; a technique is the means used to achieve that goal.

Enterprise tactics (14): Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact.

Reconnaissance and Resource Development are the only tactics describing pre-compromise activity; all others describe activity during or after compromise.

The Enterprise matrix is a grid: columns are tactics in lifecycle order, cells contain techniques, and sub-techniques are nested under their parent technique.

Techniques can map to multiple tactics; for example, T1053 Scheduled Task/Job appears under Execution, Persistence, and Privilege Escalation.

Enterprise platforms are Windows, macOS, Linux, Cloud (IaaS, SaaS, Office 365, Azure AD, Google Workspace), Network, and Containers; platform tags on a technique indicate where it applies.

Defense Evasion is the largest tactic by technique count because adversaries use many distinct methods to avoid detection.

The tactic list is intentionally not a strict sequence: adversaries may skip tactics or repeat them (e.g., multiple Persistence mechanisms).

A technique is a general class of adversary action (e.g., T1059 Command and Scripting Interpreter); a sub-technique is a more specific variant (e.g., T1059.001 PowerShell).

A procedure is a specific implementation of a technique by a specific group, software, or campaign; procedure examples are cited in the technique page's 'Procedure Examples' section.

Sub-technique IDs are formed by appending a three-digit suffix to the parent ID: T1059 -> T1059.001, T1059.003, T1059.005.

Not every technique has sub-techniques; when it does, the parent page lists them and the parent should generally be treated as a summary, not a separately detected behavior.

Technique pages include: description, ID, tactics, platforms, permissions required, effective permissions, data sources, detections, mitigations, and procedure examples.

Detection guidance on technique pages describes what to monitor (data sources) rather than ready-made detection rules; detection content is community- or vendor-supplied.

Techniques describe 'how' at a level of abstraction that survives tool changes; procedures describe the concrete commands, tools, or APIs observed.

Sub-techniques were introduced in ATT&CK v7 (October 2019) to reduce ambiguity in techniques that covered heterogeneous behaviors.

Mapping a detection or a threat report to ATT&CK should use the most specific applicable technique or sub-technique, but only when the observed behavior clearly matches the definition.

Groups (G####) are tracked intrusion sets, often named with vendor-specific aliases (e.g., APT29, Cozy Bear, NOBELIUM, Midnight Blizzard); ATT&CK uses one primary name with aliases.

Software (S####) covers both tools (legitimate utilities abused by adversaries, e.g., PsExec, Mimikatz) and malware (e.g., custom backdoors, ransomware families).

Campaigns (C####) group activity tied to a specific time-bounded operation; campaigns were added in ATT&CK v10 (October 2020).

A group page lists associated techniques, software used, campaigns, and sometimes targeted sectors or regions; the technique associations are inferred from reporting.

Group-to-technique mappings are not exhaustive: absence of a technique on a group page does not mean the group never used it.

Software pages list the techniques the software implements and the groups or campaigns observed using it.

ATT&CK does not perform attribution; group names are ATT&CK's labels for clusters of activity and may or may not correspond one-to-one with real-world organizations.

Campaign attribution is the weakest link in the data model; campaigns often have sparse technique coverage relative to groups.

When mapping a new intrusion, prefer associating it with a group only when reporting supports the link; otherwise use the techniques and software directly.

Mitigations (M####) are security controls or countermeasures mapped to the techniques they can prevent or reduce; they describe classes of controls, not specific products.

Mitigation entries include a description, the techniques they address, and sometimes implementation notes; a single mitigation (e.g., M1038 Execution Prevention) maps to many techniques.

Mitigations are not guarantees: a technique may have mitigations listed yet still be partially effective, and some techniques have no known mitigation.

Data Sources (DS####) describe the categories of telemetry that can detect techniques (e.g., DS0017 Command, DS0009 Process Creation, DS0022 File Modification).

Data Components are the finer-grained elements within a data source (e.g., 'Process Creation' under 'Process'); ATT&CK v10+ restructured data sources into data sources + data components.

Detection mapping process: identify technique -> list data sources/components -> determine whether your environment collects that telemetry -> build detection logic.

Technique pages list data sources under 'Detection' or 'Data Sources'; if you cannot collect the listed data source, the detection coverage for that technique is a gap.

ATT&CK does not prescribe specific log sources; mapping a data component to a concrete log (e.g., Sysmon Event ID 1 for Process Creation) is an implementation decision.

Mobile ATT&CK covers Android and iOS; its tactics are Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact (no Reconnaissance or Resource Development).

Mobile techniques include platform-specific entries such as T1409 (Stored Application Data), T1417 (Input Capture), T1430 (Location Tracking), and T1623 (Command and Scripting Interpreter).

Mobile techniques often describe abuse of app permissions, accessibility services, and device administration APIs rather than OS shell execution.

ICS ATT&CK covers industrial control systems and adds ICS-specific tactics: Inhibit Response Function, Impair Process Control, and Collection.

ICS techniques include T0800 (Activate Firmware Update Mode), T0816 (Device Restart/Shutdown), T0836 (Modify Parameter), T0855 (Unauthorized Command Message), and T0831 (Manipulation of Control).

ICS matrix is often split into enterprise IT and OT layers; techniques may be tagged for the control system level (e.g., field devices, PLCs, HMIs, engineering workstations).

Mobile and ICS matrices share the same ID scheme and data model but have distinct tactic lists; do not assume an Enterprise tactic exists in ICS or Mobile.

ICS mitigations often map to safety instrumented systems, network segmentation, and change management rather than endpoint EDR controls.

ATT&CK Navigator is a web tool for visualizing and annotating matrices; layers are saved as JSON files with techniques, scores, colors, and comments.

Navigator layers can be uploaded, shared, and compared; common uses include coverage heatmaps, threat group overlays, and detection gap analysis.

Navigator supports multiple domains (Enterprise, Mobile, ICS) and layer versions; layer JSON includes 'techniques' with 'techniqueID', 'score', 'color', 'comment', and 'enabled'.

ATT&CK is distributed as STIX 2.1 bundles; objects include attack-pattern (technique), intrusion-set (group), malware, tool, campaign, course-of-action (mitigation), x-mitre-tactic, x-mitre-data-source, and relationship objects.

Relationships in STIX link objects: 'uses' (group uses technique/software), 'mitigates' (mitigation mitigates technique), 'detects' (data component detects technique), 'subtechnique-of' (sub-technique to parent).

TAXII 2.1 is the transport protocol for STIX; ATT&CK content is available via TAXII servers (e.g., MITRE's public TAXII endpoint) and via GitHub STIX JSON files.

STIX IDs for ATT&CK objects are UUIDs; the human-readable ATT&CK ID (T1059) lives in external_references with source_name 'mitre-attack'.

The ATT&CK data model uses x-mitre-* custom object types for ATT&CK-specific concepts (tactics, data sources, data components, matrices) that are not native STIX 2.1 types.

When consuming ATT&CK programmatically, resolve external_references to map T####/S####/G#### IDs, and follow relationship objects rather than assuming embedded lists.

Threat-informed defense uses ATT&CK to prioritize defenses against behaviors that are actually observed, rather than against a generic vulnerability list.

Mapping workflow: collect threat intelligence -> extract behaviors -> map each behavior to the most specific technique/sub-technique -> record the source and confidence.

Coverage assessment compares your detection/control coverage per technique against a threat profile (e.g., a group's techniques) to identify priority gaps.

Prioritization heuristics include technique frequency across relevant groups, technique overlap with your sector, and whether the technique is a prerequisite for later tactics.

Detection coverage should be scored per technique, not per tactic; tactic-level coverage hides gaps within a tactic.

Mapping pitfalls: over-mapping to a broad parent technique, mapping tools instead of behaviors, and mapping a behavior to a technique whose definition does not match.

ATT&CK evaluations (evaluations of security products against emulated adversary behavior) are separate from the ATT&CK knowledge base but use ATT&CK technique IDs.

A threat-informed program should track ATT&CK version updates and re-evaluate mappings when techniques are deprecated, split, or added.

Common outputs include Navigator coverage layers, gap registers, and detection engineering backlogs keyed to technique IDs.