Skip to content
  • There are no suggestions because the search field is empty.
PROTECTING OVER $1B IN DAILY TRADES
DEFENDING ENERGY FOR 32+M U.S. USERS
SECURING NETWORKS FOR 52K+ TRANSPORT VEHICLES
DEFENDING $10T+ IN MANAGED ASSETS
SECURING 16+M ANNUAL PATIENT VISITS
+1(888) 547-9497
Home/Resources/Glossary/

The MITRE ATT&CK framework: Tactics, techniques, and detection coverage

The MITRE ATT&CK framework organizes adversary techniques into a practical reference. Learn how to map existing detections, close gaps, and layer telemetry.

Attackers don’t follow a script. They exploit known weaknesses, chain techniques together, and move through environments in ways that most security tools were never designed to see. The MITRE ATT&CK framework is how defenders fight back, and it works best when your detections span the full range of tactics attackers actually use. 

Key takeaways

  • Built from real-world attack observations, the MITRE ATT&CK framework’s Enterprise matrix organizes 222 adversary techniques across 15 tactics into a practical reference that security teams worldwide can use to detect and respond to threats.​
  • ​​Attackers routinely chain multiple tactics, techniques, and procedures (TTPs) in sequence, meaning detection requires behavioral coverage across the full attack chain, not just individual indicators.​ 
  • ​​Effective ATT&CK coverage requires layered telemetry across network, endpoint, cloud, and identity sources; no single tool covers the full matrix.​ 
  • ​​The most commonly exploited ATT&CK tactics, including command and control, lateral movement, discovery, and exfiltration, all produce strong evidence at the network layer, making network telemetry a critical component of any detection strategy.​

What is the MITRE ATT&CK framework? 

Definition and framing

MITRE ATT&CK is a publicly available, continuously updated knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations of cyberattacks, developed and maintained by the MITRE Corporation. The name stands for Adversarial Tactics Techniques (ATT), and Common Knowledge (CK). The “CK” reflects its design as a shared language between defenders, threat intelligence teams, red teams, and security vendors.

This article reflects the Enterprise matrix as of ATT&CK version 19.1, the current release at the time of publication.

ATT&CK is open and vendor-neutral, free to use and not owned or sold by any commercial vendor. That is one reason it has become the de facto standard for TTP mapping across the industry.

The three ATT&CK matrices

MITRE organizes ATT&CK into three matrices, each covering a distinct environment. Many core tactics, including initial access, execution, lateral movement, and impact, appear across all three, though the specific techniques and platforms differ: 

Enterprise
Covers adversary techniques used against enterprise networks, cloud environments, and on-premises infrastructure across Windows, macOS, Linux, and container platforms. This is the most widely adopted matrix and the focus of this article.

Mobile
Covers techniques used in attacks on iOS and Android devices, including both direct device compromise and network-based mobile attacks.

ICS
Covers techniques specific to industrial control systems and operational technology, increasingly relevant as attackers target manufacturing, utilities, and critical infrastructure alongside traditional IT networks.

Why it matters

Before ATT&CK, security teams described attacker behavior in inconsistent, vendor-specific terms. ATT&CK gave the industry a common vocabulary. Security tools, threat intelligence reports, government advisories (including CISA alerts), and red team engagements now routinely reference ATT&CK technique IDs, such as T1046 or T1071.

Knowing the framework is necessary but not sufficient. The framework describes what attackers do; telemetry determines whether you can detect it.

How the MITRE ATT&CK framework is organized

The framework hierarchy

The Enterprise matrix contains 15 tactics and 222 techniques, making it the largest and most commonly referenced of the three matrices. MITRE structures it in four levels, from broad to specific:

  • Tactics: The adversary’s high-level objective at each stage of an attack. The Enterprise matrix contains 15 tactics, including initial access, execution, persistence, lateral movement, command and control, and exfiltration.
  • Techniques: The specific method used to achieve a tactic. There are 222 techniques in the current Enterprise matrix, and some techniques appear under multiple tactics. For example, under lateral movement, one technique is Remote Services (T1021).
  • Sub-techniques: More granular variations of a technique. T1021 has sub-techniques including RDP (T1021.001), SMB/Windows Admin Shares (T1021.002), and SSH (T1021.004), each producing distinct, observable signatures across endpoint and network telemetry.
  • Procedures: Real-world examples of how specific threat actors have used a technique, including the exact tools, commands, and infrastructure observed in documented intrusions.

What each level means for detection

Each level corresponds to a different type of detection signal and different telemetry requirements. Tactics become visible only through correlation across multiple events from multiple sources, while sub-techniques are often observable through specific behaviors captured across endpoint, network, and identity tools.

Corelight_Infographic_MITREAttackHierarchy

How ATT&CK maps to detections, where each level of the hierarchy produces distinct evidence across endpoint, network, and identity telemetry. 

Tactics, techniques, and procedures explained

Component What it means Example Why it matters for detection

Tactic

The attacker’s goal at this phase 

 Lateral movement  Sets the investigative frame: What the attacker is trying to achieve 

Technique 

The method used to achieve the goal 

 Remote Services (T1021)  Pinpoints the specific, observable behavior to detect 

Sub-technique 

A specific variation of the technique

 RDP (T1021.001)  Determines which telemetry source and protocol to monitor 

Procedure 

How a real threat actor executed it 

 APT29 using RDP with stolen credentials  Enables threat-actor-specific detection and hunting 

How attackers chain TTPs, and why layered detection is a must

As the opening illustrates, real-world attacks rarely use a single technique in isolation. A typical intrusion chains TTPs across multiple tactics: Phishing for initial access (T1566), a scheduled task for persistence (T1053), network scanning for internal discovery (T1046), RDP for lateral movement (T1021.001), and DNS tunneling to exfiltrate data (T1048.003). Each technique serves a different tactic, uses a different method, and leaves evidence in a different place.

This is precisely why a single detection mechanism rarely catches the full attack chain, and why a layered detection approach is required. The same TTP can produce evidence across multiple telemetry layers simultaneously: RDP lateral movement, for example, appears as a process event on the endpoint, a new TCP connection on the network, and a credential event in identity logs. Defenders who see only one layer see only part of the attack. Covering the full ATT&CK matrix means combining the strengths of each telemetry source so that what one detection tool or engine misses, another catches.

What is the MITRE ATT&CK framework used for?

Core use cases

ATT&CK has become a standard operational tool across the full security function, not just detection engineering. Security teams use it to align threat intelligence to defensive priorities, structure red team exercises, plan detection strategy, and create a shared language that security operations center (SOC), cyber threat intelligence (CTI), and governance, risk, and compliance (GRC) teams can use together. Four use cases define how security teams commonly apply ATT&CK:

Threat hunting: Analysts use ATT&CK technique IDs as structured hunting hypotheses, searching for evidence of specific techniques across endpoint logs, network telemetry, identity events, and cloud activity. ATT&CK-driven hunting focuses investigation on known adversary behaviors rather than generic anomalies.​ 

Detection engineering: Security engineers map existing detections to ATT&CK techniques to identify coverage gaps. Coverage maps typically show that different tool categories cover different tactic groups; endpoint tools tend to cover execution and persistence, while network traffic monitoring and identity tools contribute coverage of credential access, lateral movement, command and control, and exfiltration.

​​Incident response: ATT&CK provides the investigative map for reconstructing an attack. Responders use technique IDs to identify what happened at each phase, then pull corroborating evidence from whichever telemetry sources captured it, including endpoint logs, network records, identity events, or cloud activity.​ 

​​Red team and gap analysis: Red teams use ATT&CK to structure adversary emulation exercises and test whether blue team detections fire against real techniques. Results reveal which techniques remain undetected and in which tactic groups, guiding investment in additional coverage.​ 

How to use the MITRE ATT&CK framework

A practical approach to operationalizing ATT&CK

ATT&CK supports a wide range of security objectives: Building detections, hunting for threats, planning cybersecurity strategy, benchmarking coverage, communicating risk to leadership, and aligning CTI, SOC, and GRC teams around a shared view of adversary behavior. Operationalizing ATT&CK follows a consistent underlying pattern regardless of objective: Understand the threat landscape relevant to your organization, map your current capabilities against it, and close gaps systematically. This approach is consistent with MITRE’s own published guidance on ATT&CK operationalization.

  1. Identify your highest-priority tactics and techniques. Start with the tactics most relevant to your threat profile. For most organizations, command and control, lateral movement, discovery, and exfiltration, are consistently among the most observed tactic groups in threat intelligence reporting. Reference CISA advisories and sector-specific threat reports to validate your priorities against real-world attacker activity.
  2. Map your existing detections to the ATT&CK matrix. Use the ATT&CK Navigator to build a coverage heatmap, color-coding each technique based on whether you have full, partial, or no detection. Be honest about partial coverage: A technique shown as covered by one tool may still have gaps for unmanaged devices, OT environments, or cloud workloads. Treat coverage mapping as a team exercise; peer review reduces bias and surfaces gaps a single analyst may overlook.
  3. Identify coverage gaps by telemetry layer. Not all ATT&CK techniques are observable from all telemetry layers. ATT&CK documents the data sources required for each technique; map your available telemetry against those sources to understand what each tool can and cannot observe before building detections.
  4. Build a layered detection strategy. Effective ATT&CK coverage requires multiple complementary detection mechanisms working together; no single mechanism is sufficient across the full range of techniques.

Common MITRE ATT&CK mistakes to avoid

  • Treating ATT&CK as a one-time exercise: ATT&CK is a living framework, updated regularly as MITRE observes new adversary behavior. Coverage maps completed once will erode as attackers evolve. Effective use requires continuous reassessment.
  • Mapping security tools rather than detections: Listing a tool in a coverage map is not the same as having a validated, tested detection. Coverage maps should reflect detections confirmed to fire against real technique behavior.
  • Assuming one security tool category covers everything: Different tool categories cover different tactic groups. Endpoint tools tend to cover execution and persistence well; network, identity, and cloud tools contribute coverage of other tactic groups. A complete picture requires understanding what each data source can and cannot observe.
  • Focusing on indicators rather than behaviors: A common mistake in threat intelligence work is mapping IOCs, such as IP addresses, domains, and file hashes, rather than the underlying techniques. IOCs change constantly as attackers rotate infrastructure; ATT&CK technique coverage remains relevant regardless of which specific infrastructure an attacker uses. Behavior-based detections outlast any individual IOC.
  • Skipping the data-source mapping step: ATT&CK documents the data sources required for each technique. Mapping your available telemetry against those data sources before building detections saves significant rework and reveals gaps earlier in the process.

How Corelight supports ATT&CK-aligned detection

Corelight provides deep coverage of network-relevant ATT&CK techniques, with coverage across 108 TTPs and over 90% of network-relevant techniques. Corelight Investigator surfaces this coverage directly in the interface, displaying alerts mapped to each ATT&CK TTP, so analysts can immediately see which techniques triggered and investigate further.

MITRE ATT&CK Coverage

108 TTPs covered across the MITRE ATT&CK Map (over 90% coverage across Network relevant TTPs)

Corelight_Graphic_MITREAttackCoverage

Corelight’s alerts mapped to the MITRE ATT&CK framework in Investigator.

Coverage at this depth is the result of a multi-layered detection approach that combines IOC matching, signature-based detection, behavioral and TTP analysis, supervised machine learning, and anomaly detection, each contributing coverage of the techniques the others cannot catch.

For security teams building or validating their ATT&CK coverage, Corelight’s network detection and response platform provides the network evidence for the tactic groups most likely to contain gaps: The techniques that happen between systems, across the network, and outside the reach of endpoint agents.

Turning ATT&CK coverage into real detection

The MITRE ATT&CK framework gives security teams the map: A shared, evidence-based model of how adversaries actually operate. But a map is only useful when you can see the territory. That visibility comes from telemetry: The network evidence, endpoint logs, identity events, and cloud activity that turn ATT&CK technique IDs into real detections. The framework sets the standard. Telemetry determines how much of it you can actually meet.

FAQs