ATT&CK Overview and History
The ATT&CK Overview and History domain tests whether you understand what ATT&CK is, where it came from, and how its core vocabulary fits together. ATT&CK is a curated knowledge base of adversary behavior observed in real intrusions. It organizes behavior into tactics (the adversary's goal), techniques (how the goal is achieved), and procedures (the specific implementation seen). It is not a vulnerability list, a compliance framework, or an attribution system. MITRE began the work in 2013 as internal research and released it publicly in 2015; it has since expanded into Enterprise, Mobile, and ICS matrices, with regular versioned updates.
Core rules
- Tactics answer 'why'; techniques answer 'how'; procedures answer 'what it looked like here.'
- Entries are evidence-based and linked to groups, software, campaigns, mitigations, and data sources.
- The matrices are domain-specific: a technique in Enterprise may not exist in Mobile or ICS.
- ATT&CK IDs are stable references, but content is revised; always cite the ID and the ATT&CK version.
Worked example
A report says an intrusion began with a spearphishing attachment, then used PowerShell, then created a scheduled task. The initial access maps to Phishing (T1566), execution to Command and Scripting Interpreter: PowerShell (T1059.001), and persistence to Scheduled Task/Job (T1053). The report's specific command line belongs in a procedure note, not in the technique name. The team should record evidence and confidence, then check whether each mapped behavior has detection coverage.
Traps
Do not force ATT&CK into a strict kill-chain sequence; tactics overlap and repeat. Do not map a tool name alone to a technique. Do not claim 'full coverage' because every tactic has a color. Do not treat an ATT&CK mapping as proof of actor identity.