What Is MITRE ATT&CK? The Attacker Playbook, Explained
MITRE ATT&CK, pronounced attack, is a free, continually updated knowledge base that documents how real-world attackers actually behave, step by step, based on observed incidents. Think of it as a shared encyclopedia of the adversary playbook.
Security teams worldwide use it as a common language to describe attacks, find gaps in their defenses, and test whether they could detect a given technique. This guide explains the structure without the jargon.
Tactics: the attacker goals
ATT&CK is organized into tactics, the why behind each step of an attack. These read like the stages of a break-in.
Tactics include Initial Access (getting in), Persistence (staying in), Privilege Escalation (gaining more power), Lateral Movement (spreading), Exfiltration (stealing data), and Impact (causing damage such as ransomware).
Techniques: how they reach each goal
Under each tactic sit techniques, the specific methods attackers use. For Initial Access, techniques include phishing, exploiting a public-facing application, or using valid stolen accounts.
Each technique has a page describing how it works, which real groups use it, and, crucially, how to detect and mitigate it.
- Techniques are numbered (for example, T1566 is Phishing) so teams can refer to them precisely.
- Sub-techniques add detail, such as spearphishing attachment versus spearphishing link.
- The catalog is drawn from real, reported intrusions, not theory.
How defenders actually use it
ATT&CK turns a vague worry, are we secure, into concrete questions, can we detect lateral movement.
Teams map their detections and controls to the matrix to find blind spots, run exercises that emulate specific groups, and communicate clearly during incidents.
- Coverage mapping: highlight which techniques you can detect and which you cannot.
- Red teaming: emulate a known group technique-by-technique to test defenses.
- Shared language: saying a technique id means the same thing to everyone.
How it plays out in the real world
Based on real, widely reported incident patterns; names and details are illustrative.
Turning a scary report into an action plan
A security team read a threat report warning that a group targeting their industry logged in with stolen credentials, created new admin accounts to stay in, and then deployed ransomware.
Instead of panicking, they mapped each step to ATT&CK: Valid Accounts for initial access, Create Account for persistence, and Data Encrypted for Impact for the ransomware. Then they checked their detections for each and found they had no alert for new admin account creation.
- ATT&CK converts stories into checklists. A narrative report becomes a specific list of techniques you can test yourself against, one by one.
- Gaps become obvious. Mapping coverage to the matrix showed exactly one missing detection, the new-admin-account step, which they then built.
- It is a shared map, not a product. ATT&CK is free and vendor-neutral, so teams, tools, and reports can all point at the same techniques.
Test yourself
Test your knowledge of attacker tactics, free.
Frequently asked questions
What does ATT&CK stand for?
Adversarial Tactics, Techniques, and Common Knowledge. It is maintained by MITRE, a non-profit, and is free for anyone to use.
Is MITRE ATT&CK only for large security teams?
No. Even small teams can use it to prioritize: pick the handful of techniques most relevant to your business and make sure you can prevent or detect those first.
How is ATT&CK different from the Cyber Kill Chain?
The Kill Chain is a simple linear model of an attack stages. ATT&CK is far more detailed and non-linear, cataloging hundreds of specific techniques under each tactic, based on real observed behavior.