MITRE ATT&CK Fundamentals study guide
MITRE ATT&CK Fundamentals · Work through your exam, one topic at a time.
MITRE ATT&CK Fundamentals is an entry-level credential for people who need to read, interpret, and apply the ATT&CK knowledge base in day-to-day security work. It suits SOC analysts, threat intelligence staff, detection engineers, incident responders, vulnerability managers, and security architects who must translate adversary behavior into defensible controls. The MITRE ATT&CK Fundamentals study guide has 8 sections and about 2,643 words.
01ATT&CK Overview and History
The ATT&CK Overview and History domain tests whether you understand what ATT&CK is, where it came from, and how its core vocabulary fits together. ATT&CK is a curated knowledge base of adversary behavior observed in real intrusions.
337 words, about 2 min02Adversary Tactics and the Enterprise Matrix
The Adversary Tactics and the Enterprise Matrix domain tests how well you read the Enterprise matrix and map behavior to the right column. The Enterprise matrix presents tactics as columns and techniques as rows.
323 words, about 2 min03Techniques, Sub-techniques, and Procedure Examples
The Techniques, Sub-techniques, and Procedure Examples domain tests precise mapping and knowledge of ATT&CK entry structure. Every technique has a T#### identifier.
317 words, about 2 min04Software, Groups, and Campaigns
The Software, Groups, and Campaigns domain tests whether you can distinguish three linked but different ATT&CK object types. ATT&CK uses Software (S####) for tools and malware, Groups (G####) for intrusion sets, and Campaigns (C####) for a set of intrusion activity with a common objective over a period.
344 words, about 2 min05Mitigations and Data Sources
The Mitigations and Data Sources domain tests defensive mapping: how ATT&CK connects techniques to controls and telemetry. Mitigations (M####) describe defensive measures that can prevent or reduce the impact of a technique.
326 words, about 2 min06ATT&CK for Mobile and ATT&CK for ICS
The ATT&CK for Mobile and ATT&CK for ICS domain tests whether you can choose the right matrix and avoid copying Enterprise mappings into specialized environments. ATT&CK for Mobile covers Android and iOS adversary behavior, including malicious apps, enterprise mobility management abuse, and mobile-specific persistence and collection.
356 words, about 2 min07Navigator, STIX/TAXII, and ATT&CK Data Model
The Navigator, STIX/TAXII, and ATT&CK Data Model domain tests the tooling and data plumbing behind ATT&CK. ATT&CK Navigator is a web application for viewing and annotating matrices.
334 words, about 2 min08Threat-Informed Defense and Mapping to ATT&CK
The Threat-Informed Defense and Mapping to ATT&CK domain tests whether you can turn intelligence into prioritized defensive work. Threat-informed defense uses ATT&CK to connect adversary behavior to defensive priorities.
306 words, about 2 min