Application & OT Security · Foundational

MITRE ATT&CK

A globally accessible knowledge base of adversary tactics, techniques and procedures based on real-world observations.

Definition

ATT&CK organizes adversary behavior into tactics (the why, such as Initial Access or Lateral Movement) and techniques and sub-techniques (the how), each with an ID like T1003 for OS Credential Dumping. Matrices exist for Enterprise, Mobile and ICS. Red teams use it to plan adversary emulation and blue teams use it to map detection coverage.

Don't confuse it with

Related terms