MITRE ATT&CK Explained

MITRE ATT&CK is the comprehensive catalog of adversary tactics, techniques, and procedures used by every serious threat detection and threat hunting team in the world.

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally accessible knowledge base of adversary behavior based on real-world attack observations. It documents the specific techniques threat actors use at each stage of an attack — from initial access through exfiltration — organized into a matrix that security teams use to structure their detection, hunting, and defense programs.

The framework was developed by MITRE Corporation and is maintained as a public resource. It has become the de facto standard for describing attacker behavior in the security industry — used by EDR vendors for detection engineering, by threat intelligence teams for reporting adversary activity, and by security professionals for threat hunting and red team planning.

ATT&CK structure: tactics and techniques

ATT&CK is organized into 14 tactical categories (the "why" of what an attacker is doing) with specific techniques under each (the "how"):

• Reconnaissance: Information gathering before the attack
• Resource Development: Acquiring infrastructure and tools
• Initial Access: How attackers get into the environment (T1566: Phishing, T1190: Exploit Public-Facing Application)
• Execution: Running malicious code (T1059: Command and Scripting Interpreter, T1053: Scheduled Task)
• Persistence: Maintaining access (T1547: Boot/Logon Autostart, T1543: Create or Modify System Process)
• Privilege Escalation: Gaining higher permissions
• Defense Evasion: Avoiding detection (T1562: Impair Defenses, T1070: Indicator Removal)
• Credential Access: Stealing credentials (T1003: OS Credential Dumping, T1110: Brute Force)
• Discovery: Learning about the environment
• Lateral Movement: Moving through the network (T1021: Remote Services, T1534: Internal Spearphishing)
• Collection: Gathering target data
• Command and Control: Communicating with compromised systems
• Exfiltration: Stealing data
• Impact: Disrupting or destroying systems (T1486: Data Encrypted for Impact — ransomware)

How SignalPoint uses ATT&CK

Every threat hunting engagement SignalPoint conducts is structured against the ATT&CK framework. Our analysts develop hunt hypotheses based on techniques being actively used by adversary groups targeting our clients' industries. Detection rules in our EDR platform are mapped to ATT&CK techniques, so every alert includes the specific adversary behavior it represents. Post-incident reports include ATT&CK technique mappings for every observed attacker action.