Intelligence

What is MITRE ATT&CK?

A shared vocabulary of adversary tactics and techniques, so two reports describing the same behaviour use the same name for it.

MITRE ATT&CK is a public knowledge base of adversary tactics and techniques based on real-world observations. Tactics are the goals, such as initial access or persistence. Techniques are the ways to reach them, each with an ID such as T1059 for command and scripting interpreters.

Its main value is a shared vocabulary. Reports, detections and red team exercises that use ATT&CK IDs can be compared directly, and teams can map which techniques they can detect and where the gaps are.

Where you learn it

See MITRE ATT&CK in a real investigation

Our missions put you in front of real logs, domains and forums, with these terms underlined where they appear.

Start learning free