MITRE ATT&CK.

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a curated, regularly updated knowledge base that describes how attackers operate against enterprises, mobile devices, and industrial control systems. It organises behaviour into tactics (the attacker's goals) and techniques and sub-techniques (the methods used), and links them to threat groups, software, and mitigations.

MITRE began ATT&CK as an internal research project in 2013 and released it publicly in 2015; in 2020 it refactored many techniques into more granular sub-techniques. The Enterprise matrix spans 14 tactics — Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact — mapped to hundreds of techniques with stable IDs (for example, T1566 Phishing or T1059 Command and Scripting Interpreter). Although not a compliance framework, ATT&CK is the de facto reference for threat-informed defence: SOC detection engineering, red and purple teaming, threat-intelligence sharing, and gap assessments against NIST CSF. Tools such as the ATT&CK Navigator heat-map coverage, while CTID research and ATT&CK Evaluations benchmark EDR products against emulated adversaries.

flowchart LR
  A[Adversary behaviour<br/>in the wild] --> B[Tactic: the goal<br/>e.g. Initial Access]
  B --> C[Technique: the method<br/>T1566 Phishing]
  C --> D[Sub-technique<br/>T1566.001 Attachment]
  D --> E[Map to groups,<br/>software, mitigations]
  E --> F[Detection engineering<br/>& coverage gap analysis]