MITRE ATT&CK: Tactics, Matrix and Guide

The MITRE ATT&CK framework is a globally accessible, curated knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world cyberattack observations. Operated by The MITRE Corporation, it provides a structured taxonomy that security analysts, incident response teams, and research institutions use to model threat actor behavior, assess organizational security posture, and standardize threat intelligence across heterogenous IT environments.

Modern institutional networks, research computing platforms, and academic laboratories face persistent threats targeting proprietary research data, intellectual property, and critical instrumentation. In the broader scope of cybersecurity, ATT&CK offers an empirical, threat-informed foundation that replaces speculative defense strategies with documented adversary actions.

What It Is

MITRE ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge. Developed in 2013 during MITRE’s internal Fort Meade Experiment (FMX) research project, the framework was created to document and categorize advanced persistent threat (APT) actions observed against enterprise networks. Unlike conventional vulnerability catalogs that enumerate software bugs, ATT&CK documents operational behavior: how adversaries navigate networks, escalate privileges, evade detection, and exfiltrate data after gaining initial access.

The architecture of the ATT&CK framework is organized around four core structural elements:

• Tactics: The tactical objective of the adversary—the “why” behind an action (e.g., Initial Access, Credential Access, or Lateral Movement).
• Techniques: The technical method used to accomplish a tactical objective—the “how” (e.g., OS Credential Dumping or Phishing).
• Sub-techniques: More granular descriptions of specific technical mechanisms within a technique (e.g., dumping credentials via the Local Security Authority Subsystem Service, or LSASS memory scraping).
• Procedures: The specific in-the-wild implementation or execution observed in real cyber operations, frequently tied to designated threat groups or custom malware tooling.

Who Runs It and What It Covers

The MITRE Corporation—a non-profit organization operating Federally Funded Research and Development Centers (FFRDCs)—maintains, updates, and publishes the ATT&CK framework. Releases occur bi-annually, incorporating contributions from global security researchers, threat intelligence providers, incident response reports, and peer-reviewed technical analyses.

The framework is divided into three distinct operational technology matrices:

• ATT&CK for Enterprise: Covers traditional enterprise IT environments, including Windows, Linux, and macOS host endpoints, network infrastructure hardware, container environments (Docker, Kubernetes), and cloud ecosystems across IaaS, SaaS, Office suites, and identity providers (such as Entra ID / Azure AD and Okta).
• ATT&CK for Mobile: Addresses adversary behaviors targeting mobile device operating systems (Android and iOS), focusing on network-based interception, baseband manipulation, and application ecosystem exploits.
• ATT&CK for Industrial Control Systems (ICS): Categorizes actions taken against supervisory control and data acquisition (SCADA), programmable logic controllers (PLCs), and operational technology (OT) systems commonly found in utilities, advanced manufacturing, and specialized laboratory facilities.

The knowledge base also catalogs profiles for hundreds of known threat actor groups (such as APT28 or APT29) and mapped software tools, linking real-world intrusion campaigns directly to corresponding tactics and techniques documented within threat intelligence and advanced persistent threat analyses.

What Are the Tactics in MITRE ATT&CK?

Enterprise ATT&CK historically established 14 operational tactics spanning the attack lifecycle. In recent releases, MITRE updated this structure to reflect granular operational realities, separating defensive disruption into dedicated categories:

Tactic ID	Tactic Name	Adversary Goal
TA0043	Reconnaissance	Gather information and technical intelligence to plan future attack operations.
TA0042	Resource Development	Establish infrastructure, accounts, capabilities, and domains to support operations.
TA0001	Initial Access	Gain an entry point into the target organization’s internal network or cloud environment.
TA0002	Execution	Run malicious code or adversary-controlled commands on a local or remote system.
TA0003	Persistence	Maintain access across restarts, credential rotations, and interrupted connections.
TA0004	Privilege Escalation	Elevate permissions from standard user accounts to administrator, root, or SYSTEM rights.
TA0005	Stealth	Hide and conceal adversary activity to blend into normal baseline organizational behavior.
TA0112	Defense Impairment	Disable, modify, or break security tooling, audit logging, and detection pipelines.
TA0006	Credential Access	Obtain authentic usernames, passwords, tokens, API keys, and Kerberos tickets.
TA0007	Discovery	Map internal architecture, user privileges, system configurations, and connected network shares.
TA0008	Lateral Movement	Pivot through the internal network environment to reach high-value target assets.
TA0009	Collection	Locate and assemble target files, database records, and intellectual property prior to theft.
TA0011	Command and Control	Establish external communication channels with compromised systems to direct operations.
TA0010	Exfiltration	Transmit gathered research data, trade secrets, and organizational records to external systems.
TA0040	Impact	Disrupt, manipulate, ransom, or destroy systems, operational infrastructure, and data integrity.

How to Search or Use It

Adopting ATT&CK within academic computing, research facilities, or security operations centers involves systematic integration with existing detection infrastructure:

1. Navigate the Matrix: Access the official portal (attack.mitre.org) or launch the open-source ATT&CK Navigator web application to visualize the Enterprise Matrix.
2. Identify Relevant Threat Profiles: Search the “Groups” database for threat actors known to target research institutions, higher education, or specific technological sectors.
3. Inspect Techniques and Sub-techniques: Review the technical documentation for targeted techniques, noting documented data sources (e.g., process creation event logs, network connection records, and PowerShell script block logging).
4. Evaluate Organizational Detection Coverage: Cross-reference your institution’s log telemetry and security monitoring tools against the required data components to identify defensive visibility gaps.
5. Formulate Mitigations and Controls: Review the “Mitigations” section mapped to each technique to identify architecture hardening standards, such as Multi-Factor Authentication (MFA), network segmentation, or privilege restriction.
6. Map Adversary Emulation and Testing: Utilize open adversary emulation tools (such as Caldera or atomic tests) to run controlled technique simulations and validate detection alarms.
7. Ingest Machine-Readable Data: Download ATT&CK data via official STIX 2.1 / TAXII 2.1 JSON feeds or programmatic Python libraries (such as mitreattack-python) to automate security alert classification.

Strengths and Limits

Understanding where the framework excels and where auxiliary standards are required ensures realistic institutional deployment:

• Granular Operational Clarity: Unlike abstract compliance checklists, ATT&CK provides actionable technical detail regarding specific command-line arguments, API calls, and evasion tactics.
• Shared Vocabulary: Establishes a standardized, vendor-neutral taxonomy enabling threat intelligence teams, network administrators, and compliance auditors to communicate unambiguously.
• Open and Community-Driven: Free to use under transparent open terms, receiving rapid updates when emerging exploitation techniques are discovered.
• Post-Compromise Focus: ATT&CK historically concentrates primarily on post-compromise activity; while Reconnaissance and Resource Development exist, detailed pre-attack supply chain manipulation is shared with related catalogs.
• Not a Strict Compliance Checklist: ATT&CK is an adversarial behavioral model, not a compliance certification. It must be paired with structured security frameworks such as NIST SP 800-171 or CMMC compliance for research institutions to fulfill regulatory mandates.

Alternatives and Related Security Frameworks

ATT&CK operates alongside other prominent security models, each addressing distinct phases or layers of cyber defense:

Framework / Model	Primary Focus	Structural Model	Complementary Role with ATT&CK
Lockheed Martin Cyber Kill Chain	High-level intrusion lifecycle phases from weaponization to impact.	Strict linear sequential phases.	Provides high-level executive stages; ATT&CK provides detailed non-linear tactical behavior within each stage.
MITRE D3FEND	Countermeasure and defensive cybersecurity technique taxonomy.	Defensive capability knowledge graph.	Directly maps defensive actions (e.g., process termination, credential revocation) to corresponding ATT&CK techniques.
MITRE ATLAS	Adversarial threat landscape for artificial intelligence and machine learning.	AI-specific tactics and techniques matrix.	Applies ATT&CK methodology to machine learning model vulnerabilities, detailed in the MITRE ATLAS guide.
CAPEC	Application weakness exploit patterns and software attack mechanisms.	Hierarchical taxonomy of software attack mechanisms.	Documents software-level exploits that adversaries leverage to execute ATT&CK techniques.
Diamond Model of Intrusion Analysis	Relational analysis connecting Adversary, Capability, Infrastructure, and Victim.	Four-node analytical diamond.	Clusters multi-event campaigns; ATT&CK populates the specific Capability and Infrastructure facets.

Frequently Asked Questions

What is MITRE short for?

Historically, the name MITRE originated from early acronym concepts such as “MIT Research Establishment” or “Military Information Technical Research Engineering” when the company was founded in 1958 out of the Massachusetts Institute of Technology (MIT). Today, MITRE is not an official acronym; it is the proper corporate name of The MITRE Corporation, a not-for-profit entity operating federally funded research and development centers (FFRDCs).

What does MITRE ATT&CK stand for?

ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge. The name highlights its focus on categorizing adversary tactics (operational goals), techniques (practical methods), and shared collective knowledge gathered from open-source threat intelligence and verified cyber incident analyses.

What is the difference between MITRE ATT&CK and the Cyber Kill Chain?

The Lockheed Martin Cyber Kill Chain models cyberattacks as a strict, linear progression across seven stages (Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives). In contrast, MITRE ATT&CK is non-linear and much more granular, offering an exhaustive matrix of tactics and sub-techniques that can occur in any order, repeatedly, or concurrently during an intrusion.

How do CAPEC and MITRE ATT&CK work together in cybersecurity?

Common Attack Pattern Enumeration and Classification (CAPEC) focuses on software and hardware attack patterns—specifically how an attacker exploits weaknesses in application design and code. MITRE ATT&CK describes the tactical behaviors and post-exploitation actions taken by an adversary inside an enterprise network. CAPEC patterns frequently map directly to the initial access and execution techniques defined in ATT&CK.

What are the 5 C’s of cybersecurity?

The “5 C’s of cybersecurity” is an established organizational governance model representing Change, Compliance, Cost, Continuity, and Coverage. In research and institutional settings, Change addresses dynamic IT and scientific environments; Compliance ensures adherence to grant standards and federal mandates; Cost balances defensive investments; Continuity safeguards academic research data and computational uptime; and Coverage ensures comprehensive monitoring across all network segments and endpoint assets.

Sources

• MITRE Corporation. (2026). MITRE ATT&CK® Enterprise Matrix. attack.mitre.org (Accessed 2026-11-08).
• MITRE Corporation. (2026). MITRE ATT&CK® Frequently Asked Questions. attack.mitre.org/resources/faq/ (Accessed 2026-11-08).
• MITRE Corporation. (2026). Tactics – Enterprise. attack.mitre.org/tactics/enterprise/ (Accessed 2026-11-08).
• The MITRE Corporation. (2026). Terms of Use & Legal Guidelines. attack.mitre.org/resources/legal-and-branding/ (Accessed 2026-11-08).