What is MITRE ATT&CK used for?

Security teams use MITRE ATT&CK to map detection rules to known attacker techniques, identify coverage gaps, plan red-team exercises, and share threat intelligence in a common language. It is a reference framework, not a product.

Is MITRE ATT&CK free to use?

Yes. MITRE publishes ATT&CK publicly at attack.mitre.org at no cost. The content is available for download in structured formats such as STIX and JSON, which tools can ingest directly.

What is the difference between a tactic and a technique in ATT&CK?

A tactic is the adversary's goal, such as Persistence or Lateral Movement. A technique is the specific method used to achieve that goal, such as creating a scheduled task or exploiting a remote service. Sub-techniques add a further level of detail under each technique.

How do I measure ATT&CK coverage in my environment?

Tag each detection rule with the ATT&CK technique ID it addresses, then plot those IDs on the ATT&CK Navigator matrix. Gaps in the heat map show techniques with no detection rule. Some detection engineering platforms automate this mapping and visualization.

What is MITRE ATT&CK?

MITRE ATT&CK is a publicly available knowledge base of adversary tactics, techniques, and procedures (TTPs) observed in real-world attacks. Security teams use it to map detections, measure coverage gaps, and communicate about threats in a common language.

What it is

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a structured framework maintained by MITRE Corporation. It organizes observed attacker behavior into a matrix of tactics (the "why") and techniques (the "how"). Each technique entry includes a description, real-world procedure examples, data sources useful for detection, and references to threat actor groups known to use it.

The framework covers multiple platforms: Windows, macOS, Linux, cloud environments, mobile, and industrial control systems. Techniques are identified by IDs such as T1059 (Command and Scripting Interpreter), making them easy to reference across teams and tools.

Why it matters

ATT&CK gives security teams a shared vocabulary. Without it, one analyst might call something "lateral movement via pass-the-hash" while another logs it as "credential abuse." ATT&CK standardizes that as T1550.002.

Teams use ATT&CK to:

Measure detection coverage: which techniques have a detection rule, and which do not
Prioritize rule writing based on techniques used by threat actors targeting their industry
Communicate findings in threat intelligence reports and red-team assessments
Validate that security controls actually detect the techniques they claim to cover

Detection engineering work is often organized around ATT&CK technique IDs. Sigma rules, YARA rules, and SIEM queries are frequently tagged with ATT&CK IDs so teams can track coverage in a heat map.

How tools address it

Detection engineering platforms often use ATT&CK as a backbone. Tools may import or tag detection rules with technique IDs, then visualize coverage across the matrix. Some platforms continuously validate whether existing rules would fire against a given technique. Red-team and adversary emulation tools use ATT&CK to plan and document attack simulations. Threat hunting platforms let analysts search for evidence of specific techniques in log data.

What is MITRE ATT&CK?

What it is

Why it matters

How tools address it

Common confusions

Detection Engineering tools

Frequently asked questions