Reading MITRE ATT&CK

Tactics, techniques and IDs — the shared language defenders use to describe attacks.

← Training·Level 2 of 9 · Brahmacharini — discipline and study·Foundation·about 8 minutes

1Why and how

MITRE ATT&CK is a public knowledge base of adversary behaviour observed in real attacks. Tactics are the attacker's goals, such as Initial Access, Persistence, Lateral Movement or Command and Control. Techniques are how they achieve them, each with an ID like T1566.

Sub-techniques add a suffix: T1566.002 is Spearphishing Link, under Phishing. Using IDs means two teams describing the same attack mean exactly the same thing.

2Use it for coverage

Map your detections to techniques, and the gaps become visible: the techniques nothing would catch. The ATT&CK coverage page on this site does this for the incident library.

Test what you learned

4 questions · pass mark 80% · every answer explains itself after you submit.

1.In ATT&CK, a 'tactic' is…
2.T1566.002 is a sub-technique of…
3.Why describe attacks by technique rather than tool name?
4.Mapping detections to ATT&CK mainly helps you…

Next level · ChandraghantaPhishing and look-alike domains

1Why and how

Sub-techniques add a suffix: T1566.002 is Spearphishing Link, under Phishing. Using IDs means two teams describing the same attack mean exactly the same thing.

Test what you learned

4 questions · pass mark 80% · every answer explains itself after you submit.

1.In ATT&CK, a 'tactic' is…
2.T1566.002 is a sub-technique of…
3.Why describe attacks by technique rather than tool name?
4.Mapping detections to ATT&CK mainly helps you…