What is the MITRE ATT&CK® framework?

The MITRE ATT&CK framework is used by cybersecurity experts and technical security practitioners to map the tactics and techniques used by adversaries based on real-world observations. It contains hundreds of techniques (and sub-techniques) organized across 14 tactics, such as reconnaissance, initial access, execution, defensive evasion, and exfiltration.

Tactics are commonly observed activities or objectives threat actors leverage to exploit your business and provide the context needed when investigating the specific techniques used. Techniques are a combination of procedures and technologies used to achieve the tactic, like harvesting credentials to gain initial access, or disabling defenses to move within your organization with impunity. If tactics represent the “why” for a cyberattack, techniques represent the “how”.

The overall goal of the ATT&CK framework is to develop specific threat models and methodologies so that organizations are better equipped to detect and contain intrusions.