Since 2015, MITRE ATT&CK has documented publicly observed tactics, techniques and procedures (TTPs) of real-world adversaries. We show how to use the framework for detection engineering, threat intelligence and red teaming – and where its limits lie.
MITRE ATT&CK is the world's most widely used knowledge base of real-world adversary tactics, techniques and procedures (TTPs) – compiled from publicly observed incidents, freely available since 2015 and maintained by MITRE. The framework is released twice a year; the current version is Enterprise v19 of 28 April 2026, which splits the Defense Evasion tactic into Stealth and Defense Impairment. ATT&CK provides the common language between SOC, threat intelligence, red team and management: instead of debating abstract risk, everyone talks about the same concrete techniques. This page explains the framework's structure, objects and tooling – and is honest about where its usefulness ends.
MITRE ATT&CK is a freely usable knowledge base of real-world adversary tactics and techniques, derived from publicly observed incidents. Public since 2015 and maintained by the US non-profit MITRE, the framework ships new versions twice a year (April/October) – currently Enterprise v19, released 28 April 2026. It describes what attackers actually do, not what is theoretically possible.
Tactics describe the why: the goal of an attack phase, such as Initial Access or Privilege Escalation. Techniques and sub-techniques describe the how – for example Phishing with the sub-technique Spearphishing Attachment. Procedures finally document how specific groups or malware actually implemented a technique in observed incidents.
Enterprise is the most comprehensive matrix, covering not only Windows, macOS and Linux but also cloud, network infrastructure and containers; since v19 it comprises 15 tactics, as Defense Evasion was split into Stealth and Defense Impairment. Mobile addresses Android and iOS. ICS describes attacks on industrial control systems including the affected assets – and gained its first sub-techniques with v19.
ATT&CK links techniques to real actors: Groups documents adversary groups such as APT29 along with their preferred TTPs, Software captures the malware and tools they use, and Campaigns bundles time-bounded waves of attacks. For threat intelligence this is gold: if you know which groups target your industry, you can prioritise their techniques – instead of trying to defend against everything at once.
With v18 (October 2025), MITRE fundamentally rebuilt the detection side: instead of free-text hints, each technique now comes with structured Detection Strategies and platform-specific Analytics – concrete, actionable detection logic per operating system or cloud environment. v19 expands this massively: Enterprise now counts 697 Detection Strategies with more than 1,700 Analytics, and Mobile receives its first Detection Strategies.
Mitigations describe preventive measures that make individual techniques harder or impossible – from hardening and network segmentation to application control. Data sources and data components answer the question that comes first: which telemetry – process events, network traffic, cloud audit logs – do you need to collect to be able to see a technique at all? Without the right data source, every detection rule remains theory.
The ATT&CK Navigator visualises as coverage layers which techniques your SIEM rules, EDR detections and Sigma rules cover – and where the gaps are. In a gap assessment you match this coverage against the TTPs of the groups relevant to you and prioritise your detection engineering roadmap from it. Via STIX/TAXII feeds and the ATT&CK Workbench, the framework integrates directly into your own tooling.
Adversary emulation builds attack simulations along the documented TTPs of real groups – so the red team tests exactly the behaviour that actually hits your industry. In purple teaming, attackers and defenders verify together, technique by technique, whether telemetry, detection and response actually work. Regulatory threat-led testing such as DORA TLPT or TIBER-EU presupposes exactly this ATT&CK-based approach.
ATT&CK is descriptive: it catalogues observed TTPs, but it is neither a catalogue of controls nor a compliance checklist. Coverage heatmaps can create a false sense of security – 200 weak rules do not beat 20 well-tested ones; quality matters more than the number of covered techniques. Complementary resources include MITRE D3FEND (defensive countermeasures), MITRE ATLAS (attacks on AI systems), CAR, Sigma, Atomic Red Team and Caldera – plus the MITRE ATT&CK Evaluations for vendor comparisons.
MITRE ATT&CK only creates value once TTPs are translated into concrete tests and working detection. That is exactly our craft: VamiRedteam maps every finding to ATT&CK techniques, our Managed Detection & Response measures and closes coverage gaps – and in purple teaming we bring both sides to one table.
Typical entry point: a purple team workshop – measured current coverage, prioritised gaps, a concrete roadmap.
The content on this page is based on the following publicly available guides and studies.
Primary source: matrices, techniques, groups, software, campaigns
All releases at a glance – Enterprise v19 current since 28 April 2026
Defense Evasion split, ICS sub-techniques, Detection Strategies for Mobile
Background on the tactic split and the new AI and social engineering techniques
Open-source tool for coverage layers and heatmaps
Defensive counterpart: countermeasure techniques linked to ATT&CK
Talk to us about purple teaming, coverage assessments and managed detection – we turn TTPs into measurable detection.
