Overview: Mitre ATT&CK Framework

Quick Definition

A MITRE ATT&CK Framework is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. Developed by MITRE Corporation, ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) provides a comprehensive matrix that categorizes how attackers operate across different phases of cyberattacks.

The framework organizes adversary behavior into tactics (the "why" of an attack technique) and techniques (the "how" of what adversaries do to achieve tactical goals). It covers various platforms including Enterprise, Mobile, and Industrial Control Systems (ICS), with each containing detailed information about specific attack methods, procedures, and mitigations.

Security professionals use ATT&CK for threat hunting, red team exercises, behavioral analytics development, and defensive gap assessments. The framework helps organizations understand their threat landscape by mapping observed adversary activities to known techniques, enabling more effective detection and response strategies. It also serves as a common language for cybersecurity teams to communicate about threats and defensive measures.

Regular updates incorporate new attack techniques and threat intelligence, making ATT&CK an evolving resource that reflects the current threat environment and helps organizations stay ahead of emerging attack methods.