I remember the first time someone handed me a MITRE ATT&CK matrix printout and told me to “map my findings to it.” I had no idea what half the technique IDs meant, and I definitely didn’t understand why a client would care about a spreadsheet of tactic names. Years later, ATT&CK is one of the most useful frameworks I use on every single engagement — it’s the shared language that lets red teams, blue teams, and executives all talk about the same attack in the same terms.
What Is MITRE ATT&CK?
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a publicly available, continuously updated knowledge base of real-world attacker behavior. It organizes attacker actions into tactics (the “why” — the attacker’s goal at a given stage) and techniques (the “how” — the specific method used to achieve that goal).
The matrix covers categories like:
- Reconnaissance
- Resource Development
- Initial Access
- Execution
- Persistence
- Privilege Escalation
- Defense Evasion
- Credential Access
- Discovery
- Lateral Movement
- Collection
- Command and Control
- Exfiltration
- Impact
Each tactic contains dozens of techniques (and sub-techniques), each with a unique ID like T1566 (Phishing) or T1003 (OS Credential Dumping).
Why MITRE ATT&CK Matters for Red Teams
Before ATT&CK became the de facto standard, red team reports were inconsistent — every firm described findings in its own language, making it hard for clients to compare engagements or track improvement over time. ATT&CK fixed that by giving everyone a common vocabulary.
For red teams specifically, ATT&CK matters because it:
- Structures engagement planning around realistic attacker behavior, not a random grab-bag of exploits
- Makes reporting comparable across engagements and vendors
- Powers adversary emulation, since ATT&CK catalogs known techniques by threat group (see our adversary emulation guide for how this connects)
- Helps defenders prioritize detection engineering based on technique coverage gaps
Understanding the Structure: Tactics, Techniques, and Sub-Techniques
It helps to think of it as a hierarchy:
- Tactic = the goal (e.g., Credential Access)
- Technique = the method (e.g., T1003 OS Credential Dumping)
- Sub-technique = the specific variant (e.g., T1003.001 LSASS Memory)
So when a red team report says “we achieved T1003.001,” a defender immediately knows exactly what happened: credentials were dumped from the LSASS process memory — a technique closely associated with tools like Mimikatz (see our breakdown of how Mimikatz extracts credentials for more detail on that specific technique in a lab setting).
Step-by-Step: Using ATT&CK to Plan a Red Team Engagement
- Start with the ATT&CK Navigator. This free web tool (available at mitre-attack.github.io) lets you visualize and color-code the matrix based on planned or observed techniques.
- Select a relevant threat group profile, or build a custom technique list based on the client’s risk profile and industry.
- Map each planned action to a specific technique ID before the engagement starts — this becomes your test plan.
- Cross-reference techniques with available detections. If the client has an EDR or SIEM, check what’s supposedly covered so you can test whether that coverage actually works.
- Execute techniques in a logical attack chain, tracking exactly which technique ID corresponds to each action taken.
- Log results against each technique — detected, not detected, partially detected, blocked outright.
- Build the final report using the Navigator’s heat-map export, so the client visually sees their coverage gaps.
Practical Example: Mapping a Simple Attack Chain
| Action | Tactic | Technique ID |
|---|---|---|
| Send phishing email with malicious attachment | Initial Access | T1566.001 |
| Execute PowerShell payload | Execution | T1059.001 |
| Add a registry run key for persistence | Persistence | T1547.001 |
| Enumerate domain accounts | Discovery | T1087.002 |
| Use pass-the-hash for lateral movement | Lateral Movement | T1550.002 |
| Exfiltrate data over C2 channel | Exfiltration | T1041 |
Each row here isn’t just a checklist item — it’s a specific, documented technique with known detection opportunities that the blue team can be measured against.
Useful Tools for Working with ATT&CK
- ATT&CK Navigator — visualize technique coverage
- MITRE Caldera — automated adversary emulation mapped to ATT&CK
- Atomic Red Team — small, discrete test cases for individual techniques, great for validating detections one at a time
- DeTT&CT — helps blue teams score their own detection and visibility maturity against the matrix
Common Mistakes and Troubleshooting Tips
- Treating ATT&CK as a checklist instead of a planning tool. Running every technique in the matrix regardless of relevance wastes engagement time and produces noisy, unfocused reports.
- Ignoring sub-techniques. Reporting only at the tactic level (“we did Credential Access”) is far less actionable than citing the specific sub-technique used.
- Not validating technique IDs before reporting. MITRE periodically updates and deprecates technique IDs — always double-check against the current matrix version.
- Confusing ATT&CK with a vulnerability list. ATT&CK describes attacker behavior, not CVEs — it’s a behavioral framework, not a vulnerability database.
- Skipping the Navigator export. A wall of technique IDs in a PDF report is far less useful to a client than a visual heat map they can share internally.
Security Risks and Defensive Recommendations
For blue teams using ATT&CK defensively:
- Build a detection coverage matrix using the Navigator, marking which techniques you can currently detect, partially detect, or can’t detect at all.
- Prioritize investment based on your actual threat landscape — don’t try to cover all ~200+ techniques equally; focus on what’s relevant to actors targeting your industry.
- Use Atomic Red Team regularly to continuously validate that existing detections still fire after environment changes.
- Feed ATT&CK mappings into your SIEM so alerts are automatically tagged with the technique they correspond to, speeding up triage.
Frequently Asked Questions
Q1: Is MITRE ATT&CK free to use? Yes, it’s a publicly available knowledge base maintained by MITRE, free for anyone to use, including commercially.
Q2: What’s the difference between ATT&CK and the Cyber Kill Chain? The Kill Chain is a simpler, linear model of an attack’s phases; ATT&CK is far more granular, cataloging specific, real-world techniques within each phase, and it isn’t strictly linear.
Q3: Does ATT&CK cover cloud and mobile environments? Yes — in addition to the Enterprise matrix, MITRE maintains separate matrices for Cloud, Mobile, and ICS (industrial control systems) environments.
Q4: How often is ATT&CK updated? MITRE updates the matrix multiple times per year, adding new techniques, sub-techniques, and threat group profiles as intelligence evolves.
Q5: Can beginners use ATT&CK without red team experience? Absolutely — it’s a great learning tool even for defenders or students, since it organizes attacker behavior in a structured, digestible way.
Q6: What’s the ATT&CK Navigator best used for? Visualizing technique coverage — whether that’s planning an engagement, tracking detections, or presenting findings to non-technical stakeholders.
Q7: Should every red team report include ATT&CK mappings? In most professional engagements today, yes — it’s become close to an industry standard for reporting because it lets clients benchmark results over time.
Conclusion
MITRE ATT&CK turns red teaming from an ad hoc collection of exploits into a structured, measurable discipline. Once you get comfortable mapping actions to technique IDs and using the Navigator to visualize coverage, you’ll find it changes how you plan engagements, communicate findings, and prioritize what to test next. If you’re just starting out, spend an afternoon exploring the Navigator with a sample threat group profile — it’s the fastest way to internalize how the framework actually works in practice.
References: MITRE ATT&CK (attack.mitre.org), MITRE ATT&CK Navigator documentation, Atomic Red Team project, MITRE Caldera documentation.