MITRE ATT&CK Fundamentals flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

ATT&CK definition

A curated knowledge base of adversary tactics and techniques based on real-world observations, organized by tactic, technique, sub-technique, and procedure, with mappings to groups, software, campaigns, mitigations, and data sources.

ATT&CK first public release

ATT&CK was publicly released in May 2015 after research starting around 2013 at MITRE, initially focused on Enterprise post-compromise behavior on Windows.

Tactic versus technique

A tactic is the adversary's tactical goal (the why, e.g., Persistence); a technique is the means used to achieve it (the how, e.g., T1053 Scheduled Task/Job).

Enterprise tactic count

Enterprise ATT&CK has 14 tactics, from Reconnaissance and Resource Development through Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact.

Pre-compromise tactics

Reconnaissance and Resource Development are the two Enterprise tactics describing activity before compromise; all other tactics describe activity during or after intrusion.

Multi-tactic technique example

T1053 Scheduled Task/Job maps to Execution, Persistence, and Privilege Escalation because scheduled tasks can launch code, survive reboots, and run with higher privileges.

Sub-technique ID format

A sub-technique appends a three-digit suffix to its parent technique ID, for example T1059.001 PowerShell under T1059 Command and Scripting Interpreter.

Procedure definition

A procedure is the specific implementation of a technique by a particular group, software, or campaign, such as a named tool's command line or an API call sequence.

Sub-techniques introduced

Sub-techniques were introduced in ATT&CK v7 in October 2019 to disambiguate techniques that covered heterogeneous behaviors under one ID.

Technique page contents

A technique page lists its ID, tactics, platforms, permissions required, effective permissions, data sources, detection guidance, mitigations, and procedure examples from groups and software.

Group ID format

Groups use G#### identifiers, such as G0016 for APT29, and carry aliases from multiple vendors plus associated techniques, software, and campaigns.

Software ID format

Software uses S#### identifiers and covers both tools abused by adversaries, such as PsExec, and malware families, such as custom backdoors and ransomware.

Campaigns added

Campaigns (C####) were added in ATT&CK v10 in October 2020 to group time-bounded activity tied to a specific operation rather than a persistent group.

ATT&CK attribution stance

ATT&CK does not perform attribution; group names are labels for clusters of observed activity and may not map one-to-one to real-world organizations.

Mitigation ID format

Mitigations use M#### identifiers such as M1038 Execution Prevention, and each mitigation maps to the techniques it can prevent or reduce.

Data source and component

Data sources (DS####) are broad telemetry categories such as Process; data components are finer elements within them, such as Process Creation, used to detect techniques.

Detection mapping steps

Identify the technique, list its data sources and components, check whether the environment collects that telemetry, then build detection logic for the concrete log source.

Mitigation limitations

Mitigations describe classes of controls, not products; a listed mitigation may be only partially effective, and some techniques have no known mitigation.

Mobile ATT&CK tactics

Mobile ATT&CK covers Android and iOS with 12 tactics, omitting Reconnaissance and Resource Development and including Initial Access through Impact.

ICS-specific tactics

ICS ATT&CK adds Inhibit Response Function, Impair Process Control, and Collection, reflecting goals specific to industrial control environments such as disrupting safety systems.

ICS technique example

T0855 Unauthorized Command Message describes sending commands to control system devices without authorization, a technique specific to the ICS matrix.

Mobile technique example

T1417 Input Capture describes capturing user input on mobile devices, often via malicious accessibility services or overlay attacks rather than shell execution.

Navigator layer format

ATT&CK Navigator layers are JSON files listing techniques with fields such as techniqueID, score, color, comment, and enabled, plus layer metadata and domain.

Navigator use cases

Navigator supports coverage heatmaps, threat group overlays, detection gap analysis, and comparison of layers across teams or time periods.

STIX object for technique

In ATT&CK STIX 2.1 bundles, a technique is an attack-pattern object; its T#### ID lives in external_references with source_name mitre-attack.

STIX relationship types

ATT&CK STIX uses relationships such as uses (group to technique or software), mitigates (mitigation to technique), detects, and subtechnique-of linking sub-techniques to parents.

TAXII role

TAXII 2.1 is the transport protocol for STIX; ATT&CK content is available via TAXII servers and as STIX JSON bundles on GitHub.

x-mitre object types

ATT&CK uses custom STIX types such as x-mitre-tactic and x-mitre-data-source for concepts not native to STIX 2.1, alongside standard attack-pattern and course-of-action objects.

Threat-informed defense

A program that uses ATT&CK to prioritize detection and control investments against behaviors actually observed from relevant adversaries, rather than generic vulnerability lists.

Mapping confidence

Each behavior mapped to a technique should record its source and confidence, because reporting quality varies and over-mapping to broad parent techniques inflates coverage.

Coverage scoring granularity

Detection coverage should be scored per technique or sub-technique, not per tactic, because tactic-level scores hide gaps among the techniques within a tactic.

ATT&CK Evaluations

ATT&CK Evaluations are product tests against emulated adversary behavior using ATT&CK technique IDs; they are separate from the ATT&CK knowledge base itself.