MITRE ATT&CK for Beginners

MITRE ATT&CK is a free, curated knowledge base of how real adversaries behave, organized so defenders can talk about attacks the same way.

Tactics vs techniques

• Tactics are the attacker's goals - the "why" (e.g. Initial Access, Persistence, Credential Access, Exfiltration). There are 14 enterprise tactics.
• Techniques are the how - the specific behavior (e.g. T1059.001 PowerShell, T1003.001 LSASS Memory).
• Sub-techniques are more specific variants of a technique.

Why defenders love it

1. A shared vocabulary. "We saw T1021.002" is precise; "lateral movement over SMB" is a paragraph.
2. Coverage measurement. Map your detections to techniques and you can literally see your blind spots on the matrix.
3. Prioritization. Combine ATT&CK with threat intel (which techniques do your adversaries use?) to focus effort.

How to actually use it

• Map each detection you write to a technique ID.
• Use the ATT&CK Navigator to color your coverage.
• Close the biggest gaps first, especially on crown-jewel assets.

There's also MITRE ATLAS - an ATT&CK-style matrix for attacks against AI/ML systems - and D3FEND, a matrix of defensive countermeasures. Together they map the whole fight.