Understanding MITRE ATT&CK

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a free, public knowledge base of how real attackers behave once they target an organization. It is maintained by MITRE, a US non-profit, and built only from behaviour that has been observed in the wild and documented in public reports: incident write-ups, vendor research, government advisories.

Its main value is a shared vocabulary. Instead of writing "the attacker used a malicious Word document and then dumped passwords", an analyst writes T1566.001 and T1003.001. A CTI team in Paris, a SOC in Montreal and a detection vendor in Tokyo all understand exactly the same thing, and can compare threats, detections and gaps without ambiguity.

ATT&CK is organised as a hierarchy that goes from the attacker's goal down to the exact commands they typed. Keeping these four levels apart is the single most important skill when you use the framework.

Reading an ID

Every object in ATT&CK has a stable identifier whose prefix tells you its type:

On the website, the dot of a sub-technique becomes a slash in the URL: https://attack.mitre.org/techniques/T1566/001/.

The three matrices

The matrix is only the front door. Behind it, ATT&CK links techniques to the actors that use them, the software that implements them, and the ways to mitigate and detect them. All of it is published as STIX 2.1 data, so your tools can import it directly.

"Mapping" means translating a narrative (an incident timeline, a CTI report, a sandbox report) into ATT&CK IDs. The method below follows the approach recommended by CISA's Best Practices for MITRE ATT&CK Mapping.

Worked example

Here is an excerpt from a (fictional) incident report about a financially-motivated actor:

The victim received an email posing as a supplier, with an attachment
"Invoice_4471.docm". After the user opened it and clicked "Enable
Content", a VBA macro launched PowerShell with a base64-encoded command.
The script downloaded upd.dll from https://cdn-update[.]example/s2/ and
executed it with rundll32.exe. The DLL created the Run registry value
"OneDriveUpdate" to restart at each logon, then beaconed over HTTPS.
Two days later, the operator ran Mimikatz to dump LSASS memory, used the
stolen domain admin credentials to RDP into the file server, compressed
the finance share with 7-Zip and uploaded the archives to a cloud
storage service.

The ATT&CK Navigator is a free web app from MITRE (usable online or self-hosted) that displays the matrix and lets you colour, score and comment techniques. Each view is a layer, saved as a small JSON file that you can share, version in Git, or generate with a script.

The layer below highlights the techniques from the worked example (shortened to five entries):

{
  "name": "Incident 2026-041 - invoice phishing",
  "versions": {
    "attack": "20",
    "navigator": "5.3.2",
    "layer": "4.5"
  },
  "domain": "enterprise-attack",
  "description": "Techniques observed during incident 2026-041",
  "techniques": [
    { "techniqueID": "T1566.001", "tactic": "initial-access", "score": 1, "comment": "Invoice_4471.docm" },
    { "techniqueID": "T1059.001", "tactic": "execution", "score": 1, "comment": "Encoded PowerShell from macro" },
    { "techniqueID": "T1547.001", "tactic": "persistence", "score": 1, "comment": "Run value OneDriveUpdate" },
    { "techniqueID": "T1003.001", "tactic": "credential-access", "score": 1, "comment": "Mimikatz on WKS-042" },
    { "techniqueID": "T1021.001", "tactic": "lateral-movement", "score": 1, "comment": "RDP to FS-01" }
  ],
  "gradient": {
    "colors": ["#ffffff", "#20c997"],
    "minValue": 0,
    "maxValue": 1
  }
}

Adjust versions to the ATT&CK and Navigator releases you actually use. The tactic field is optional: without it, the technique is highlighted in every column where it appears.