MITRE ATT&CK

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) catalogs how attackers actually behave once they target an organization. It is maintained by MITRE, a not-for-profit organization, and built from public threat reporting.

The Enterprise matrix is organized by tactics, the attacker's goals, such as Initial Access, Persistence, Privilege Escalation, Credential Access, Lateral Movement and Exfiltration. Under each tactic are techniques with identifiers, such as T1110 for Brute Force, many of them split into sub-techniques like T1110.003 for Password Spraying. Each technique page describes how it works, which groups use it, and how to detect and mitigate it. There are separate matrices for mobile and industrial control systems.

Example

An incident report notes that the attacker used phishing for initial access (T1566), created a scheduled task for persistence (T1053.005) and moved to other servers with Remote Desktop (T1021.001). Mapping the incident to ATT&CK lets the team check, technique by technique, which steps their detections caught and which they missed.

Why it matters for a SOC analyst

ATT&CK is the shared vocabulary of security teams: red teams use it to plan attacks, blue teams to measure detection coverage, and purple teams to test both together. Many alerts in Microsoft Defender XDR and Sentinel are already tagged with ATT&CK tactics and techniques, so learning to read those tags tells you at a glance where in an attack an alert sits.