MITRE ATT&CK Fundamentals key terms

A grid organizing adversary behavior by tactic columns and technique rows, built separately for Enterprise, Mobile, and ICS environments so defenders can see how techniques relate to goals.

The adversary's tactical goal, such as persistence or credential access, that answers why a technique is used and forms the column headers of a matrix.

A general category of adversary behavior describing how a goal is achieved, identified by a T-number such as T1059, and shared across platforms unless split into sub-techniques.

A narrower, more specific description of how a parent technique is carried out, carrying its own ID such as T1059.001, so detection logic can target concrete behavior.

A concrete real-world instance of a technique, often tied to a named group or malware, showing the specific commands, tools, or actions observed in reporting.

The stable alphanumeric identifier assigned to a technique or sub-technique, used to reference behavior consistently across tools, reports, and detection rules.

An ATT&CK object describing a tool or malware family used by adversaries, with an S-number, listing the techniques it implements and the groups known to use it.

A software object in ATT&CK representing malicious code families such as backdoors or ransomware, distinguished from legitimate or dual-use tools adversaries may also employ.

A software object describing legitimate or dual-use utilities, such as remote access or credential dumping programs, that adversaries abuse to accomplish techniques.

An ATT&CK object representing a tracked threat actor cluster, identified by a G-number and alias, with attributed techniques, software, and campaigns.

A named set of malicious activity conducted over a period against specific targets, with a C-number, linking groups, techniques, and software observed together.

A STIX concept for a grouped set of adversarial behaviors and resources with common properties, used in ATT&CK data to cluster activity attributed to a probable single organization.

A defensive measure or security control, identified by an M-number, that prevents or makes harder the exploitation of one or more techniques, often mapped to platform-specific guidance.

A category of information, such as process creation or network traffic, that sensors collect and defenders analyze to detect techniques, forming the top level of the data model.

A specific piece of observable information within a data source, such as command-line arguments, that is paired with techniques to indicate what to collect for detection.

The analytic guidance attached to a technique describing how data sources and components can reveal the behavior, without prescribing vendor-specific rules or thresholds.

A separate matrix covering adversary behavior against mobile devices, with tactics and techniques tailored to Android and iOS platforms and their permission and app models.

A matrix describing adversary behavior against industrial control systems, including tactics for impairing process control and safety, mapped to control system assets and protocols.

The operating system or environment, such as Windows, Linux, macOS, or a control system, that determines which techniques and sub-techniques are applicable to an asset.

A web tool for creating layered, color-coded views of the matrix, used to score coverage, compare threat actor techniques, and export annotations as JSON layers.

A JSON file in Navigator format storing technique scores, colors, comments, and filters, which can be shared, merged, or rendered over a chosen matrix version.

Structured Threat Information Expression, a standardized JSON data model in which ATT&CK objects such as techniques, groups, and relationships are published and exchanged.

A transport protocol for exchanging cyber threat intelligence over HTTPS, commonly used to distribute ATT&CK STIX collections to subscribers and tooling.

A typed JSON entity in the ATT&CK dataset, such as attack-pattern, intrusion-set, or malware, connected to others through explicit relationship objects.

A STIX object connecting two ATT&CK entities, for example linking a group to a technique it uses or a mitigation to the technique it addresses.

The structured schema of objects, relationships, and versioning metadata that defines how ATT&CK content is stored and queried programmatically.

A defensive approach that prioritizes controls and detection engineering against behaviors of relevant adversaries rather than against tools or indicators alone.

The practice of associating existing detections, controls, or test cases with ATT&CK techniques to reveal gaps and justify investment in defensive priorities.

Planning and executing controlled adversary behavior, selected from ATT&CK techniques tied to relevant groups, to validate whether defenses detect and stop real tradecraft.

The numbered release scheme, such as v14 or v15, that tracks additions, deprecations, and revisions of techniques and objects so mappings can be reproduced and compared.

A technique ATT&CK marks as no longer maintained, often merged into another entry, which should be replaced in mappings to keep analyses current.

A technique withdrawn because it was replaced or found invalid, retained for historical reference but not recommended for new mappings or detection work.

The tactic describing techniques adversaries use to avoid detection or defeat security controls, such as obfuscation, masquerading, or disabling logging.

The tactic covering techniques that run adversary-controlled code on a victim system, including command interpreters, scheduled tasks, and user execution.

The tactic describing how adversaries communicate with compromised systems, using channels such as web protocols, DNS, or remote access tools.

The tactic covering techniques for stealing data from a victim network, often over command and control channels or alternate transfer paths.

A publicly documented, vendor-neutral exercise emulating a chosen threat group's behavior to compare how security products detect the same procedures.

The discipline of designing, testing, and maintaining detection logic tied to specific adversary behaviors and the telemetry needed to observe them.

The shared vocabulary of tactics, techniques, and IDs that lets analysts, hunters, and vendors describe adversary behavior consistently across teams and reports.