Cybersecurity Terms

MITRE ATT&CK Framework

The MITRE ATT&CK framework is a publicly accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) based on documented real-world cyberattacks. Maintained by MITRE, a not-for-profit research organization, ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) provides a structured language for describing how attackers behave at each stage of a compromise, from initial access through impact.

What is the MITRE ATT&CK framework?

The MITRE ATT&CK framework is a globally accessible knowledge base that catalogs the specific behaviors adversaries use when attacking real systems. MITRE, a federally funded research and development organization that provides technical guidance to the US government, began developing ATT&CK in 2013 based on internal research into Windows enterprise attacks and released it publicly in 2015. Security teams, detection engineers, red teamers, and tool vendors across the industry have adopted it as the standard vocabulary for describing attacker behavior.

The name breaks down directly: Adversarial Tactics, Techniques, and Common Knowledge. Tactics represent the adversary's goals at each stage of an attack (the "why"). Techniques are the specific methods used to achieve those goals (the "how"). Common Knowledge is the underlying premise: the framework is built from documented observations of how real attackers actually operate, not theoretical attack models.

ATT&CK is organized into multiple matrices. The Enterprise matrix covers attacks against traditional IT networks, endpoints, cloud environments, and containers. The Mobile matrix covers threats targeting mobile devices. The ICS matrix covers attacks against operational technology and critical infrastructure. For most startups, the Enterprise matrix is the most relevant reference.

The structure of ATT&CK

Tactics

Tactics are the highest-level categories in the framework. Each tactic represents an adversary's objective at a particular stage of an attack. The current ATT&CK Enterprise matrix contains 14 tactics:

Reconnaissance (gathering information before the attack)
Resource Development (acquiring infrastructure, accounts, or tools)
Initial Access (getting into the target environment)
Execution (running malicious code)
Persistence (maintaining access over time)
Privilege Escalation (gaining higher-level permissions)
Defense Evasion (avoiding detection)
Credential Access (stealing usernames, passwords, and tokens)
Discovery (learning about the environment after initial access)
Lateral Movement (moving through the network to other systems)
Collection (gathering data of interest)
Command and Control (communicating with compromised systems)
Exfiltration (moving data out of the environment)
Impact (disrupting, destroying, or ransoming systems and data)

Techniques and sub-techniques

Under each tactic, ATT&CK documents specific techniques: the methods an adversary might use to accomplish that tactic's goal. Phishing (T1566) appears under Initial Access; OS Credential Dumping (T1003) appears under Credential Access. Many techniques have sub-techniques that describe more specific variations. The current Enterprise matrix contains over 200 techniques and more than 400 sub-techniques.

Each technique entry includes a description, examples drawn from real incidents and threat intelligence reports, detection recommendations (what data sources and log fields indicate this technique in use), and mitigation recommendations (controls that reduce the risk of this technique succeeding).

Procedures

Procedures are the concrete, real-world implementations of techniques. The ATT&CK database links specific threat actor groups and malware families to the techniques they use, based on published threat intelligence. This makes it possible to look up a known threat actor (e.g., APT29, also known as Cozy Bear) and see exactly which techniques they have been observed using in documented attacks, which in turn informs detection and defense priorities.

How security teams use ATT&CK

Security teams use ATT&CK in a few distinct ways:

Detection engineering: Security teams map their detection coverage to ATT&CK techniques to identify gaps. If a tactic or technique is not covered by any detection rule, it represents a blind spot an attacker could exploit without being seen.

Threat hunting: Threat hunters use ATT&CK as a structured guide for proactive investigation. Knowing which techniques a likely threat actor uses allows hunters to look for specific evidence in logs and telemetry, rather than searching without direction.

Red team and adversary simulation: Penetration testers and red teams use ATT&CK to structure realistic attack scenarios that simulate actual adversary behavior rather than opportunistic exploitation.

Tool evaluation: Organizations use ATT&CK coverage maps to evaluate security vendors, checking which techniques a proposed tool detects versus which it misses.

Why the MITRE ATT&CK framework matters for startups

It provides a common language for security discussions. Without a shared taxonomy, different tools and teams describe the same attacker behavior in incompatible ways. ATT&CK gives security practitioners a precise vocabulary: "they used spearphishing with a malicious attachment (T1566.001) to establish initial access, then leveraged valid accounts (T1078) to move laterally." That precision matters when teams are triaging an incident or evaluating detection coverage.
It makes detection coverage measurable. Before ATT&CK, assessing whether a security program had adequate detection coverage was largely qualitative. ATT&CK makes it possible to map detection rules to specific technique IDs and identify gaps. A startup running a SIEM can measure what percentage of ATT&CK techniques their detection rules cover and prioritize investments accordingly.
It grounds prioritization in real attacker behavior. Rather than defending against every possible attack, ATT&CK lets teams focus on the techniques most commonly used by threat actors relevant to their industry, size, and technology stack. Defending against what attackers actually do is more efficient than defending against what they theoretically could do.
It improves incident response quality. During an active incident, ATT&CK helps investigators move systematically through the likely attack chain. If an attacker achieved initial access via phishing, the framework suggests the likely next steps (execution, persistence, credential access) and where to look for evidence.

How Fencer helps with MITRE ATT&CK

Fencer's security monitoring capability is built around ATT&CK-aligned detection rules, mapping observed events to specific tactics and techniques so findings carry meaningful context rather than raw log data. The threat hunting interface lets security engineers query logs with ATT&CK techniques in mind. For startups that want to understand their detection coverage against the ATT&CK framework, Fencer's built-in detection logic provides structured coverage across the tactics most relevant to cloud-native, developer-operated environments.

Frequently asked questions

Is MITRE ATT&CK the same as CVE?

No. CVE (Common Vulnerabilities and Exposures) is a catalog of specific software vulnerabilities, each with a unique identifier and severity score. It documents what can be exploited. MITRE ATT&CK documents how attackers behave during an attack, including the techniques they use to exploit systems, move laterally, steal credentials, and accomplish their goals. The two systems are complementary: a CVE might describe a specific vulnerability that enables ATT&CK technique T1203 (Exploitation for Client Execution). Security teams use both: CVEs to prioritize patch management, and ATT&CK to map detection and response capabilities.

How do I know which ATT&CK techniques to prioritize?

Two approaches work well here. First, look at which threat actor groups target organizations like yours (similar industry, size, technology stack) and focus on the techniques those groups use most frequently. MITRE publishes group profiles in the ATT&CK database with technique mappings based on real incident reporting. Second, use CISA's guidance and advisories, which regularly reference specific ATT&CK techniques used in campaigns targeting particular sectors. For cloud-native startups, prioritizing techniques in the Initial Access, Credential Access, and Cloud Service categories is usually a reasonable starting point, since these align with the most common attack patterns against SaaS-heavy, cloud-hosted environments.

Does our SIEM already cover MITRE ATT&CK techniques?

Possibly, but coverage gaps are common and often unexamined. Most SIEM vendors map their detection rules to ATT&CK technique IDs, but the coverage is rarely complete, and it is easy to assume coverage exists where it does not. The right approach is to review your SIEM's detection rules against the ATT&CK matrix for the tactics and techniques most relevant to your environment, identify gaps, and prioritize filling them based on threat actor relevance and potential impact. Running a threat hunting exercise or engaging a red team to test actual detection coverage is more reliable than taking a vendor's ATT&CK coverage map at face value.

Related terms

Take Fencer for a spin

See what security handled from code to cloud looks like.
Start a free trial in minutes, or book a demo for a guided tour.

Product Tour Book a Demo