MITRE ATT&CK: adversary knowledge as a common language

MITRE ATT&CK is a freely usable knowledge base of real-world adversary tactics and techniques, derived from publicly observed incidents. Public since 2015 and maintained by the US non-profit MITRE, the framework ships new versions twice a year (April/October) – currently Enterprise v19, released 28 April 2026. It describes what attackers actually do, not what is theoretically possible.

Tactics describe the why: the goal of an attack phase, such as Initial Access or Privilege Escalation. Techniques and sub-techniques describe the how – for example Phishing with the sub-technique Spearphishing Attachment. Procedures finally document how specific groups or malware actually implemented a technique in observed incidents.

Enterprise is the most comprehensive matrix, covering not only Windows, macOS and Linux but also cloud, network infrastructure and containers; since v19 it comprises 15 tactics, as Defense Evasion was split into Stealth and Defense Impairment. Mobile addresses Android and iOS. ICS describes attacks on industrial control systems including the affected assets – and gained its first sub-techniques with v19.

ATT&CK links techniques to real actors: Groups documents adversary groups such as APT29 along with their preferred TTPs, Software captures the malware and tools they use, and Campaigns bundles time-bounded waves of attacks. For threat intelligence this is gold: if you know which groups target your industry, you can prioritise their techniques – instead of trying to defend against everything at once.

With v18 (October 2025), MITRE fundamentally rebuilt the detection side: instead of free-text hints, each technique now comes with structured Detection Strategies and platform-specific Analytics – concrete, actionable detection logic per operating system or cloud environment. v19 expands this massively: Enterprise now counts 697 Detection Strategies with more than 1,700 Analytics, and Mobile receives its first Detection Strategies.

Mitigations describe preventive measures that make individual techniques harder or impossible – from hardening and network segmentation to application control. Data sources and data components answer the question that comes first: which telemetry – process events, network traffic, cloud audit logs – do you need to collect to be able to see a technique at all? Without the right data source, every detection rule remains theory.

The ATT&CK Navigator visualises as coverage layers which techniques your SIEM rules, EDR detections and Sigma rules cover – and where the gaps are. In a gap assessment you match this coverage against the TTPs of the groups relevant to you and prioritise your detection engineering roadmap from it. Via STIX/TAXII feeds and the ATT&CK Workbench, the framework integrates directly into your own tooling.

Adversary emulation builds attack simulations along the documented TTPs of real groups – so the red team tests exactly the behaviour that actually hits your industry. In purple teaming, attackers and defenders verify together, technique by technique, whether telemetry, detection and response actually work. Regulatory threat-led testing such as DORA TLPT or TIBER-EU presupposes exactly this ATT&CK-based approach.

ATT&CK is descriptive: it catalogues observed TTPs, but it is neither a catalogue of controls nor a compliance checklist. Coverage heatmaps can create a false sense of security – 200 weak rules do not beat 20 well-tested ones; quality matters more than the number of covered techniques. Complementary resources include MITRE D3FEND (defensive countermeasures), MITRE ATLAS (attacks on AI systems), CAR, Sigma, Atomic Red Team and Caldera – plus the MITRE ATT&CK Evaluations for vendor comparisons.