MITRE ATT&CK
ATT&CK · ATT&CK matrix · Adversarial Tactics, Techniques, and Common Knowledge · TTP · tactics and techniques
A free knowledge base, maintained by the US not-for-profit organisation MITRE, that describes the tactics and techniques attackers actually use, based on public observations.
In practice
Tactics are the attacker’s goals (initial access, persistence, privilege escalation, lateral movement, exfiltration and so on); techniques are the ways of achieving them, each with an identifier (such as T1046), groups known to use it, detection ideas and mitigations. The Enterprise matrix has 15 tactics in version 19, released in 2026. Defenders use it to map what their tools really detect, prioritise SOC rules and give red and blue teams a shared language.
Fictional case: a CISO colours the ATT&CK matrix by SOC coverage, green for detected techniques and red for blind spots. They discover that nothing monitors the creation of scheduled tasks, a very common way of gaining persistence, and make it the quarter’s priority.
