Mapping the Adversary Playbook: A Guide to MITRE ATT&CK

If you've ever wondered how attackers actually think — and more importantly, how to stop them — MITRE ATT&CK gives you a real answer. It's a structured knowledge base that documents exactly how threat actors operate, from their first move to their final goal.

Understanding MITRE ATT&CK and Why It Matters

What MITRE ATT&CK Is and How It Was Developed

MITRE ATT&CK — which stands for Adversarial Tactics, Techniques, and Common Knowledge — is a globally accessible knowledge base that documents how real-world attackers actually behave once they've found their way into a target environment. Think of it as a detailed playbook of attacker moves, built not from theory but from documented, real-world intrusions.

The project started inside MITRE Corporation back in 2013. Researchers were running an internal project called FMX, designed to improve detection of adversaries operating within enterprise networks. During that work, they needed a structured way to catalog the behaviors they were observing. What began as an internal documentation effort eventually grew into something far more significant. By 2015, MITRE made ATT&CK publicly available, and the security community grabbed onto it almost immediately.

The framework has since expanded well beyond its original Windows enterprise focus. Today it covers:

• Enterprise ATT&CK — covering Windows, macOS, Linux, cloud platforms, containers, and network infrastructure
• Mobile ATT&CK — focused on iOS and Android threats
• ICS ATT&CK — built specifically for industrial control systems and operational technology environments

Each version is continuously updated as new threat intelligence comes in from researchers, security vendors, government agencies, and the broader community. MITRE maintains it as a living document, not a static snapshot. When a new threat group surfaces or a novel technique gets documented, the framework gets updated to reflect it. That commitment to staying current is a big part of why it's trusted so widely.

Figure 1. MITRE ATT&CK is a living, evidence-based knowledge base of adversary tactics and techniques.

How the Framework Differs from Other Security Models

There are quite a few frameworks and models floating around the security world — the Cyber Kill Chain, the Diamond Model, NIST CSF, ISO 27001, and others. ATT&CK sits in a different lane from most of them, and understanding that difference helps explain why teams reach for it in specific situations.

Here's a quick comparison to put things in perspective:

The Kill Chain, developed by Lockheed Martin, maps out the general stages of an attack from reconnaissance to actions on objectives. It's useful for understanding the big picture, but it doesn't tell you much about the specific methods attackers use at each stage. ATT&CK goes much deeper. It doesn't just say "attackers establish persistence" — it tells you exactly how they do it, whether that's through scheduled tasks, registry run keys, boot or logon autostart execution, or dozens of other documented techniques.

Another key difference is that ATT&CK is grounded in observed behavior. Every technique in the framework is backed by real-world evidence. There are references to actual threat actor groups, malware families, and documented campaigns tied to each entry. That means when you're working with ATT&CK, you're not reasoning from abstract concepts — you're working from documented attacker tradecraft.

NIST CSF and ISO 27001 are excellent frameworks for building and auditing a security program at an organizational level. They help answer questions like "Do we have a patch management process?" or "Are we meeting compliance requirements?" ATT&CK answers a completely different question: "Are we able to detect and stop the specific techniques attackers are actually using against organizations like ours?"

Some of the specific use cases security teams actively apply ATT&CK to include:

The combination of real-world grounding, structured organization, and direct applicability to daily security work is what makes ATT&CK genuinely useful rather than just another framework gathering dust in a policy document. It meets security teams where they actually work.

Breaking Down the Core Components of the Framework

Tactics: Understanding the Adversary's Goals

Tactics are the "why" behind every move an attacker makes. Think of them as the high-level objectives an adversary is trying to accomplish at any given stage of an attack. MITRE ATT&CK currently organizes 14 distinct tactics across the Enterprise matrix, and each one represents a different phase or goal in the attack lifecycle.

Here's a quick look at the 14 Enterprise tactics:

What makes tactics genuinely useful is that they shift your thinking away from tools and malware signatures toward attacker intent. Rather than asking "what did this attacker use?", you start asking "what were they trying to accomplish?" That change in perspective makes it a lot easier to spot patterns across different attacks, even when the specific tools or malware families change from one campaign to the next.

Techniques: How Attackers Achieve Each Goal

If tactics are the "why," techniques are the "how." Each technique describes a specific method an adversary uses to accomplish a tactical goal. This is where ATT&CK starts getting really actionable because you're now looking at concrete attacker behaviors that you can detect, hunt for, and defend against.

To put it plainly — a tactic might be "Credential Access," but the technique is something like OS Credential Dumping (T1003). That tells you exactly what the attacker is doing: pulling credentials out of memory, files, or the registry to grab usernames and passwords.

ATT&CK currently documents hundreds of techniques across all platforms. Each technique entry in the knowledge base includes:

• A clear description of the behavior
• Which platforms are affected (Windows, macOS, Linux, cloud, etc.)
• Detection guidance — what to look for in logs, EDR telemetry, or network traffic
• Mitigation recommendations — controls that reduce the risk or impact
• References to real-world usage by known threat groups
• Data sources that help you identify where the evidence lives

One of the most practical ways to use techniques is during threat detection engineering. When you're building detection rules, you can anchor them to specific techniques. That means instead of writing a rule that only catches one specific piece of malware, you write a rule that catches the behavior — which holds up even when attackers rotate their tooling.

Here's a small example of how techniques map to tactics:

Techniques don't exist in isolation. A single attack chain will cut across multiple tactics and chain together multiple techniques. Understanding those connections is what helps security teams build layered, overlapping defenses rather than point solutions that only cover one slice of the attack.

Sub-Techniques: Drilling Deeper into Attack Methods

Sub-techniques were added to the ATT&CK framework to solve a real problem: some techniques are broad enough that they cover wildly different attack behaviors under one roof. By introducing sub-techniques, MITRE gave security teams a more precise way to describe, detect, and respond to specific attacker behaviors.

Take OS Credential Dumping (T1003) as a good example. Under that single technique, you'll find several sub-techniques:

• T1003.001 — LSASS Memory: Dumping credentials from the Local Security Authority Subsystem Service process
• T1003.002 — Security Account Manager: Accessing the SAM database on Windows
• T1003.003 — NTDS: Pulling credentials from the Active Directory database
• T1003.004 — LSA Secrets: Extracting credentials from the registry
• T1003.006 — DCSync: Simulating a domain controller to request credential replication

Each of these sub-techniques requires a slightly different detection approach and has different mitigation strategies. LSASS memory dumping might be caught by monitoring for suspicious processes accessing lsass.exe, while DCSync attacks show up as unusual replication requests in domain controller event logs. Treating them as the same thing would leave serious gaps in your coverage.

Sub-techniques follow a naming convention of T[technique].[three-digit number], which makes it easy to reference specific behaviors in runbooks, threat intelligence reports, and detection rule metadata.

From a practical standpoint, sub-techniques give you:

• More precise detection logic — your rules can target exact behaviors rather than broad categories
• Better gap analysis — you can identify which specific variants of a technique you're covered against
• Cleaner threat intel mapping — when a report says an adversary used LSASS dumping specifically, you can map that to T1003.001 rather than the parent technique alone
• Sharper communication — incident responders, threat hunters, and executives can have more specific conversations about what happened

Here's how the three layers stack up using a real example:

MITRE continuously updates procedure entries as new threat intelligence is published and vetted. Each procedure includes citations to public reporting — threat intelligence publications, security blog posts, government advisories — so you can trace everything back to a source. That transparency is a big reason why ATT&CK has earned so much trust across the security industry. The knowledge base isn't built on assumptions; it's built on documented, real-world adversary behavior.

Navigating the ATT&CK Matrix with Confidence

How to Read and Interpret the Matrix

The ATT&CK Matrix is essentially a giant cheat sheet for understanding how attackers operate. At first glance, it can look overwhelming — a massive grid packed with techniques and sub-techniques. But once you understand the logic behind it, reading it becomes second nature.

Figure 2. Tactics form the columns, techniques fill the rows, and sub-techniques drill down into specific behaviors.

Here's how it breaks down:

• Tactics (columns): These run across the top of the matrix and represent the why behind an attacker's actions — their goals at each stage of an intrusion. Tactics include things like Initial Access, Execution, Persistence, Privilege Escalation, and Exfiltration, among others.
• Techniques (rows under each tactic): These answer how an attacker achieves a tactic. For example, under Initial Access, you'll find techniques like Phishing or Exploit Public-Facing Application.
• Sub-techniques: Many techniques have sub-techniques that drill down into even more specific behaviors. Phishing, for instance, breaks down into Spearphishing via Link, Spearphishing Attachment, and Spearphishing via Service.

When reading the matrix, think of it as a journey map. Attackers rarely use just one technique — they chain multiple techniques across multiple tactics to reach their objective. A ransomware actor might start with a phishing email (Initial Access), use PowerShell to run code (Execution), create a scheduled task for persistence, move laterally across the network, and finally encrypt files (Impact). The matrix lets you trace that entire path.

One practical tip: don't try to absorb the entire matrix at once. Start with the tactics most relevant to your environment and threat profile, then work outward from there.

Differences Between Enterprise, Mobile, and ICS Matrices

MITRE ATT&CK isn't a one-size-fits-all framework. It's split into distinct matrices, each designed for a different technology domain. Understanding which one applies to your environment — or whether you need to work across multiple — is key to getting real value from the framework.

Here's a quick breakdown of each:

Using the ATT&CK Navigator to Visualize Coverage

The ATT&CK Navigator is a free, open-source web application that makes the matrix interactive and genuinely useful for day-to-day security work. Instead of staring at a static grid, you can color-code it, annotate it, and layer multiple datasets on top of each other to reveal exactly where your detection and prevention capabilities stand.

Getting Started with Navigator. You can access the Navigator directly through the MITRE ATT&CK website or run it locally if your organization has data sensitivity concerns. When you open it, you'll see the full matrix for your chosen domain. From there, you can:

Mapping Threat Actor Behaviour to Your Environment

Identifying Relevant Threat Groups for Your Industry

Not every threat actor is coming after your organization. Ransomware crews targeting healthcare organizations operate very differently from nation-state groups focused on defense contractors or financial sector attackers chasing wire fraud. The first step in making ATT&CK genuinely useful is narrowing down which adversaries actually care about what you have.

Figure 3. Identifying the adversaries relevant to your industry is the first step toward useful ATT&CK mapping.

MITRE ATT&CK maintains detailed profiles on dozens of named threat groups — from APT28 and Lazarus Group to FIN7 and Scattered Spider. Each profile lists the techniques those groups have been observed using in real-world intrusions, the tools they rely on, and sometimes even the industries or geographies they tend to target.

How to find the groups most relevant to you:

• Check industry-specific threat intelligence reports. Organizations like CrowdStrike, Mandiant, and Recorded Future regularly publish annual threat reports broken down by sector. These are gold for identifying who's actively targeting your space.
• Review CISA advisories. The Cybersecurity and Infrastructure Security Agency publishes alerts tied to specific threat actors, often including mapped ATT&CK techniques.
• Look at public incident disclosures. When a peer organization in your industry discloses a breach, pay attention. The attackers who hit them are likely aware of you too.
• Engage your ISAC. Information Sharing and Analysis Centers (ISACs) exist for most major industries — finance, healthcare, energy, transportation — and share threat intelligence specifically relevant to that sector.

Once you have a shortlist of threat groups that target organizations like yours, you can start mapping their known behavior directly onto your environment instead of trying to defend against every possible technique in the entire ATT&CK matrix.

Prioritizing Threats Based on Likelihood and Impact

Security teams are always dealing with more potential threats than they have bandwidth to address. Trying to defend against everything simultaneously is a recipe for burnout and mediocre coverage across the board. A smarter approach is systematic prioritization — and ATT&CK gives you a solid foundation for doing that.

Prioritization comes down to two dimensions:

• Likelihood: How probable is it that a given technique or threat actor actually targets your organization?
• Impact: If a technique was successfully executed, how damaging would the outcome be?

A practical way to visualize this is a simple risk matrix:

Building Threat Profiles Using ATT&CK Intelligence

A threat profile is essentially a structured picture of how a specific adversary would likely attack your organization, built from known intelligence and mapped against your environment. Think of it as a simulation blueprint — before you run a red team exercise or tabletop scenario, you want a solid threat profile to base it on.

What a good threat profile includes:

• Threat actor overview: Who they are, their likely motivation (financial, espionage, hacktivism, disruption), and their known targets
• ATT&CK technique mapping: The specific techniques they've been observed using, organized by tactic (Initial Access → Execution → Persistence → Privilege Escalation → etc.)
• Tooling: What malware, frameworks, or living-off-the-land binaries they commonly deploy (e.g., Cobalt Strike, Mimikatz, certutil)
• Infrastructure patterns: How they set up C2 infrastructure, what hosting providers they've used, and what domains or IP ranges have been associated with them
• Detection opportunities: Which of their techniques are detectable with your current tools, and where your blind spots are
• Mitigations: What controls — technical and process-based — would stop or slow down their most effective techniques

Profiles like this turn abstract threat intelligence into something actionable. Security engineers know exactly what controls to tune. Detection engineers know what queries to build. Incident responders know what artifacts to hunt for. And security leaders can see at a glance where investment needs to go.

Strengthening Defenses Using ATT&CK Insights

Identifying Detection Gaps Across Your Security Stack

One of the most practical things you can do with MITRE ATT&CK is hold it up against your existing security tools and ask a brutally honest question: what are we actually missing?

Figure 4. ATT&CK gives security teams a structured way to identify and prioritize detection gaps.

Most security teams discover pretty quickly that their coverage isn't as solid as they thought. You might have great visibility into endpoint activity but almost no detection logic around lateral movement. Or your SIEM is loaded with rules, but half of them were written years ago without any reference to real-world adversary behavior.

ATT&CK gives you a structured way to work through this systematically.

Running a Coverage Assessment. Start by mapping your current detection capabilities to ATT&CK techniques. For each technique, ask:

• Do we have a data source that would even capture this activity?
• Do we have an alert or rule designed to detect it?
• Has that rule ever been validated or tested?
• If it fired, would anyone know what to do with it?

Many teams use tools like ATT&CK Navigator to create a heatmap that color-codes their coverage. Green means you have solid detection, yellow means partial, red means nothing. When you lay that out visually, the gaps stop being abstract and become painfully obvious.

Prioritizing What Gaps to Close First

Not every gap is equally dangerous. Once you know what you're missing, you need to decide where to focus. Two things help with this:

• Threat actor relevance — Cross-reference your gaps with the TTPs used by threat actors targeting your industry. If a group known to target financial institutions heavily relies on Spearphishing Attachment (T1566.001) and you have zero detection for it, that's your starting point.
• Technique prevalence — Some techniques show up across dozens of adversary groups. Techniques like Process Injection (T1055), Credential Dumping (T1003), and PowerShell (T1059.001) are practically universal. Closing gaps here gives you the broadest defensive bang for your effort.

Measuring and Improving Security Posture Over Time

Using ATT&CK to Benchmark Your Current Defenses

Before you can improve anything, you need an honest picture of where you stand today. ATT&CK gives you a shared language to do exactly that — a common reference point that lets you compare your current detection and prevention capabilities against the actual techniques adversaries use in the wild.

Figure 5. A coverage heatmap becomes a roadmap for prioritization and continuous improvement.

Start by mapping your existing security controls to ATT&CK techniques. This means going through your SIEM rules, EDR detections, firewall policies, and any other defensive tooling you have, and asking: "Which specific techniques does this actually catch?" Be brutally honest. A lot of teams discover that their tooling covers a surprisingly narrow slice of the matrix, often clustering around a handful of well-known techniques while leaving significant gaps elsewhere.

A useful way to visualize this is through ATT&CK Navigator, the open-source web tool that lets you color-code the matrix based on your coverage levels. A simple three-tier scoring approach works well for most teams:

Once you have this laid out visually, patterns become obvious. You might notice that your cloud environment is significantly underrepresented, or that your coverage for lateral movement techniques drops sharply compared to initial access. That visual heat map becomes a roadmap for prioritization.

Benchmarking is also most valuable when you anchor it to relevance. Cross-reference your coverage map with the threat groups most likely to target your industry. If the top three threat actors in your sector heavily rely on credential dumping and living-off-the-land techniques, and your coverage in those areas is weak, that tells you exactly where to focus resources first.

Feeding Threat Intelligence Back Into the Loop

A continuous assessment cycle works best when it's informed by fresh threat intelligence. When a new threat actor report drops, or your threat intel team identifies a group targeting your sector, map their techniques to the ATT&CK matrix immediately and check your coverage. This creates a direct pipeline from "we just learned attackers are doing X" to "here's our current ability to detect X" to "here's what we're doing about any gap."

Many security teams formalize this into a repeating cycle that looks something like this:

The key is consistency. Organizations that bake ATT&CK into their operating rhythm — rather than treating it as a project — develop a compounding advantage over time. Each cycle builds on the last, detections improve, gaps shrink, and the team's collective knowledge of how adversaries actually operate gets sharper. That compounding effect is what separates organizations that genuinely reduce risk from those that simply check compliance boxes.

The best part? You don't have to overhaul everything overnight. Start small — pick a few relevant techniques, see how they map to your current controls, and build from there. The more your team engages with ATT&CK, the sharper your security posture gets. Treat it as a living part of your defense strategy, not a one-time exercise, and you'll be in a much stronger position to detect threats earlier, respond faster, and stay a step ahead of the adversaries targeting your organization.