MITRE ATT&CK Framework: Tactics, Techniques and Use Cases

The MITRE ATT&CK framework (formally MITRE ATT&CK®) is a free, public knowledge base of how real attackers behave, organized by their goals (tactics) and the methods used to reach them (techniques and sub-techniques), with documented real-world procedures. It works as a shared language: defenders map detections to it to find coverage gaps, threat analysts tag adversary activity with it, and red teams use it to plan emulations and report results. The current version, ATT&CK v20, was released on October 13, 2026 and covers Enterprise, Mobile and ICS environments.

Key facts as of November 2026:

• Current version: ATT&CK v20, released October 13, 2026. MITRE publishes major releases twice a year.
• Matrices: Enterprise (15 tactics), Mobile (12 tactics) and ICS (12 tactics).
• Biggest recent change: in v19 (April 2026), MITRE split the Enterprise Defense Evasion tactic into Stealth (which keeps ID TA0005) and a new Defense Impairment tactic (TA0112).
• Cost: free for any person or organization to use under MITRE's terms of use.

What Is the MITRE ATT&CK Framework?

ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge. MITRE describes it as "a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations." In practice, it is a catalog with an ID for every documented attacker behavior, from sending a phishing attachment (T1566.001) to encrypting data for impact (T1486). When an analyst writes T1003.001 in a report, every reader knows the behavior is credential theft from LSASS memory.

ATT&CK started inside MITRE in 2013. According to MITRE's ATT&CK FAQ, the team needed to document the tactics, techniques and procedures that advanced persistent threats used against Windows enterprise networks for a research project called FMX, which tested how well endpoint telemetry and analytics could catch attackers after a compromise. MITRE's design and philosophy paper says the first model was created in September 2013 and released publicly in May 2015 with 96 techniques. The knowledge base has since grown to cover Linux, macOS, cloud, identity providers, network devices, containers, mobile devices and industrial control systems.

Two design choices explain why ATT&CK is so widely adopted:

• It is grounded in real activity. MITRE builds it mainly from public threat intelligence and incident reporting, and each technique page lists procedure examples with source references.
• It describes behavior, not vulnerabilities. A CVE tells you a product is flawed. ATT&CK tells you what an attacker does before and after exploiting it, which is what detection and response teams need to see.

What ATT&CK is not

• Not a vulnerability catalog. MITRE points readers to CAPEC and CWE for attack patterns against software and for weakness types.
• Not a maturity model or compliance standard. No regulator certifies "ATT&CK compliance," and covering every technique is neither possible nor the goal.
• Not a strict sequence. Tactics are arranged left to right in a rough attack lifecycle, but real intrusions skip, repeat and loop through them.
• Not proof of protection. A detection mapped to a technique may catch one procedure and miss another variant of the same technique. Coverage claims need testing.

Tactics, Techniques, Sub-Techniques and Procedures (TTPs)

"TTPs" is shorthand for tactics, techniques and procedures. ATT&CK adds a fourth level, the sub-technique, between technique and procedure. MITRE's FAQ defines each level with a simple question.

The difference between sub-techniques and procedures trips up many readers. MITRE explains that sub-techniques categorize behavior, while procedures describe actual in-the-wild use. A single procedure can contain several techniques: the PowerShell example above combines PowerShell execution, process injection and LSASS credential dumping. That matters when you map an incident, because one observed action may deserve more than one technique ID.

Around these four levels, ATT&CK links other objects that make it useful for operations:

• Groups: named threat actors and the techniques attributed to them in public reporting
• Software: malware and tools, with the techniques each one implements
• Campaigns: intrusion activity tracked over a defined period
• Mitigations: security controls that can prevent a technique from succeeding
• Detection Strategies, Analytics and Data Components: since ATT&CK v18 (October 2025), these replaced the older detection text and data sources, describing what telemetry and logic can detect each technique

The Three ATT&CK Matrices: Enterprise, Mobile and ICS

ATT&CK is organized into three technology domains, each with its own matrix. The counts below come from MITRE's v20 release notes.

Each domain has its own tactic list. The Mobile tactics still include Defense Evasion (TA0030), and the ICS tactics use Evasion (TA0103), so the Enterprise split described below does not apply to them. ATT&CK for ICS also has two tactics found nowhere else: Inhibit Response Function (TA0107), where the attacker tries to stop safety and protection functions from responding, and Impair Process Control (TA0106), where the attacker tries to manipulate or damage the physical process. If you test industrial networks, our guide to OT/ICS penetration testing shows how to map findings to ATT&CK for ICS without putting a live process at risk.

The 15 Enterprise Tactics in ATT&CK v20

The Enterprise tactics page lists 15 tactics in this column order. The goals below summarize MITRE's own one-line descriptions.

Reconnaissance and Resource Development describe activity before the attacker touches your network, so their techniques carry the "PRE" platform label. They are harder to detect directly but useful for threat intelligence and attack surface work. For how attackers gather this pre-compromise information from public sources, see our guide to OSINT and the Reconnaissance tactic.

What changed: Defense Evasion became Stealth and Defense Impairment

If you learned ATT&CK before 2026, you learned 14 Enterprise tactics, including Defense Evasion (TA0005). MITRE's v19 release notes (April 28, 2026) describe the change directly: the biggest change in v19 was "the split of the Defense Evasion Tactic in Enterprise ATT&CK into the Stealth and Defense Impairment Tactics."

The two new tactics separate two different attacker goals:

• Stealth (TA0005) keeps the old ID. MITRE describes it as blending in with legitimate activity or minimizing observable signals without modifying security controls. Masquerading (T1036), Obfuscated Files or Information (T1027) and Indicator Removal (T1070) now sit here.
• Defense Impairment (TA0112) is new, created April 14, 2026. It covers direct interference with defensive systems, such as disabling tools or corrupting logging. Disable or Modify Tools moved here under a new ID, T1685.

Some technique IDs changed with the split. On attack.mitre.org on November 4, 2026, the old Disable or Modify Tools sub-technique T1562.001 redirects to T1685, and the old Clear Windows Event Logs sub-technique T1070.001 redirects to T1685.005 under Defense Impairment. Detection rules, SIEM tags and Navigator layers that hard-code the old IDs need a review.

Older reports are not wrong; they use an older version. CISA's February 2024 Volt Typhoon advisory, AA24-038A, states that it uses ATT&CK for Enterprise version 14 and groups activity under a "Defense Evasion" heading. Always record which ATT&CK version a mapping uses before you compare results over time.

Source: MITRE ATT&CK version history and release notes.

How to Read the ATT&CK Matrix

Open the Enterprise matrix and it looks like a wall of boxes. Five rules make it readable:

1. Columns are tactics, read left to right. The order follows a typical intrusion, from Reconnaissance to Impact, but attackers do not have to use every column or follow the order.
2. Cells are techniques. Each box under a tactic is a way to achieve that goal. A gray bar or expand control means the technique has sub-techniques.
3. One technique can appear in several columns. Valid Accounts (T1078) serves Initial Access, Persistence, Privilege Escalation and Stealth, because a stolen login can achieve all four goals. Scheduled Task (T1053.005) serves Execution, Persistence and Privilege Escalation. Privilege Escalation (TA0004) and its 13 techniques are covered in depth in our privilege escalation guide.
4. Filter by platform. A Windows-only shop can hide macOS and Linux techniques; a cloud team can focus on IaaS, SaaS and Identity Provider.
5. Use the technique page, not just the box. Each page gives the ID, description, platforms, procedure examples with references, mitigations, detection strategies, and the version and last-modified date.

To work with the matrix rather than just read it, use the ATT&CK Navigator, MITRE's free web tool for annotating the matrix. You create "layers" that color, score or comment on techniques, for example the techniques a threat group is known to use or the techniques your SOC can detect. Navigator can also load older ATT&CK versions, which helps when you compare old and new mappings.

How Defenders Use ATT&CK

Threat-informed defense

MITRE's Center for Threat-Informed Defense describes ATT&CK as "an important foundation for threat-informed defense." The idea is simple: prioritize defenses around the behaviors the adversaries you actually face are known to use, instead of around a generic checklist. In practice, that means four steps:

1. Pick the threat groups or campaigns most relevant to your sector, region and technology.
2. Pull their techniques from the ATT&CK group and campaign pages or from advisories that map them.
3. Compare those techniques with what you can prevent, detect and investigate today.
4. Test the comparison, fix the gaps, and repeat when the threat or the environment changes.

Detection coverage mapping

A coverage map is a Navigator layer that scores each relevant technique by what your controls do against it. A simple four-level scheme works better than a binary yes or no:

This scheme is DeepStrike editorial guidance, not a MITRE standard. Two cautions apply. First, a mapped technique is not a covered technique until someone has tested it, because one procedure can trigger a rule while another variant of the same technique slips past. Second, a heat map is a planning tool, not a score to report upward; 60% coverage of irrelevant techniques is worth less than 30% coverage of the techniques your adversaries actually use. Track detection speed alongside coverage, for example with mean time to detect.

Threat intelligence and control validation

Government advisories increasingly ship with ATT&CK mappings, which turns intelligence into test cases. AA24-038A maps Volt Typhoon activity to techniques such as Exploit Public-Facing Application (T1190), LSASS Memory (T1003.001) and Valid Accounts (T1078). The authoring agencies then recommend testing your existing security controls against the mapped techniques: select a technique from the advisory, align your security technologies to it, test them, analyze detection and prevention performance, repeat for all technologies, and tune people, processes and technology based on the results. The same advisory points readers to CISA's Decider tool and to CISA and MITRE's Best Practices for MITRE ATT&CK Mapping for help mapping activity themselves.

Defenders automate parts of that loop. Breach and attack simulation platforms run scripted technique tests on a schedule, and a continuous threat exposure management (CTEM) program uses ATT&CK-mapped validation to confirm which exposures attackers could really use.

Incident response and SOC triage

Tagging alerts and incident timelines with technique IDs helps responders see where an intrusion sits in the lifecycle and what usually comes next. An alert for LSASS access (T1003.001) should trigger a look for Lateral Movement techniques, because attackers steal credentials to use them. Consistent tags also let you compare incidents over time and feed lessons back into your coverage map and incident response plan.

How Pentesters and Red Teams Use ATT&CK

ATT&CK was built partly for adversary emulation: the design paper notes that both the emulation team and the defender team in MITRE's FMX research used it. Offensive teams still use it in three ways.

Building an adversary emulation plan

An emulation plan describes, step by step, how a test team will reproduce a specific adversary's behavior in your environment. A typical build looks like this:

1. Choose the adversary from threat intelligence that matches your sector and technology.
2. Extract its techniques from ATT&CK group pages and recent advisories, keeping the procedure detail where it is safe to reproduce.
3. Order them into a scenario with an objective, such as reaching a payment system or a domain administrator account.
4. Agree on rules of engagement: scope, safety limits, deconfliction contacts and what the team must never do.
5. Decide how each step will be logged, with timestamps, hosts, accounts and technique IDs, so defenders can match every action to their telemetry.

You do not have to start from scratch. The Center for Threat-Informed Defense maintains a free Adversary Emulation Library with full emulation plans for groups such as APT29, FIN6, FIN7, menuPass, OilRig, Sandworm, Turla and Wizard Spider, and micro emulation plans for compound behaviors such as webshells. Caldera, MITRE's open-source automated adversary emulation platform built on ATT&CK, was contributed to the Apache Incubator on May 20, 2026 and continues as Apache Caldera (Incubating).

Emulation is the core of a red team engagement: an objective-based exercise that tests whether people, processes and technology can prevent, detect and respond to a realistic attacker. For how the attack and defense sides work together, see red team vs blue team.

Reporting in ATT&CK terms

ATT&CK makes offensive reports actionable for defenders. A useful ATT&CK-mapped report, or a penetration testing report with an ATT&CK appendix, records for every step:

A scoped penetration test can use ATT&CK too. Findings such as password spraying (T1110.003) or an exploited internet-facing application (T1190) map naturally. Remember that ATT&CK labels behaviors; the vulnerability itself still belongs in CVE and CWE terms.

Replaying results with the blue team

The most valuable step often comes after the report. In a purple teaming session, the red team replays its techniques one at a time while defenders watch their tools, tune detections and retest on the spot. ATT&CK IDs keep both teams talking about the same thing.

ATT&CK vs the Cyber Kill Chain vs D3FEND

These three frameworks are often compared, but they answer different questions. The Lockheed Martin Cyber Kill Chain, from a 2011 white paper by Hutchins, Cloppert and Amin, describes an intrusion in seven phases: reconnaissance, weaponization, delivery, exploitation, installation, command and control (C2), and actions on objectives. MITRE D3FEND is a knowledge graph of defensive countermeasure techniques linked to ATT&CK techniques; it is funded by the NSA Cybersecurity Directorate and organizes countermeasures into seven tactics: Model, Harden, Detect, Isolate, Deceive, Evict and Restore.

MITRE's own design paper makes the distinction clear: high-level lifecycle models such as the Cyber Kill Chain help explain adversary goals, but they do not convey individual actions or how those actions relate to data sources and defenses. D3FEND's FAQ is equally candid: it standardizes defensive vocabulary but "does not prescribe specific countermeasures, it does not prioritize them, and it does not characterize their effectiveness."

Most mature programs use all three together. The kill chain frames the story for executives, ATT&CK describes exactly what the attacker did, and D3FEND names the countermeasures that could stop or reveal each step.

For the seven stages, defender actions and a real campaign walked through them, see our guide to the cyber kill chain.

Worked Example: Mapping an Attack Path to ATT&CK (Illustrative)

The scenario below is an illustrative example, not a real incident or a DeepStrike engagement. It shows how a red team exercise against a fictional mid-size company would be mapped. Technique IDs and D3FEND IDs were checked against ATT&CK v20 and D3FEND 1.6.0 on November 4, 2026. Actions are described at a high level, with lab-built, harmless payloads assumed throughout.

After the exercise, the blue team turns this table into a Navigator layer: two techniques detected, two logged only and three missed. The priorities follow from the outcomes:

1. Close the missed steps on the attacker's critical path first. Steps 4 and 7 let the attacker stay and leave with data. Add scheduled-task creation monitoring and egress controls for unsanctioned cloud storage.
2. Turn "logged only" into detections. Steps 3 and 6 already have telemetry; writing rules is cheaper than adding new data sources.
3. Check the response, not just the alert. Steps 2 and 5 fired alerts, but the attacker still moved on. Measure how long triage took and why containment did not follow.
4. Retest. Replay steps 3, 4, 6 and 7 after the fixes, ideally in a purple team session, and update the layer.

Notice what the mapping adds. A list of findings would say "PowerShell not monitored" and "RDP allowed." The ATT&CK version shows that a single chain of seven behaviors went from email to data theft, and exactly which links in that chain your defenses can already break.

Common Mistakes When Using ATT&CK

• Treating the heat map as a score. Coverage percentages hide whether the techniques matter to you and whether the detections were ever tested.
• Mixing ATT&CK versions. A v14 mapping and a v20 mapping disagree on tactics and some IDs. Record the version in every layer and report.
• Mapping only to the parent technique. "T1059" is far less useful to a detection engineer than "T1059.001, PowerShell."
• Forcing one ID per action. Real procedures often combine several techniques; tag all of them.
• Ignoring prevention and response. ATT&CK is not only a detection checklist; mitigations and response times count too.
• Using it as a compliance framework. ATT&CK describes threats. Pair it with a governance framework such as the NIST Cybersecurity Framework for program structure.

A Practical Starting Plan

1. Pick three to five adversaries relevant to your sector, using ATT&CK group pages and recent government advisories.
2. Build one Navigator layer of their combined techniques for the platforms you run.
3. Score your current coverage with the four-level scheme above, using evidence rather than vendor claims.
4. Validate the riskiest gaps with an emulation plan, a red team exercise or automated technique tests.
5. Fix, retest and re-score, then repeat at each ATT&CK release or major change in your environment.

Frequently Asked Questions

What does ATT&CK stand for?

ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge. MITRE asks that the first reference in writing use "MITRE ATT&CK" and that the name is never abbreviated or hyphenated.

What is the MITRE ATT&CK framework used for?

Security teams use it as a common language for attacker behavior. Defenders map detections to it to find coverage gaps, threat intelligence analysts tag adversary activity with it, incident responders use it to structure timelines, and red teams use it to build emulation plans and report results that defenders can act on.

How many tactics are in MITRE ATT&CK?

In ATT&CK v20 (October 2026), the Enterprise matrix has 15 tactics, and the Mobile and ICS matrices have 12 each. Enterprise went from 14 to 15 tactics in v19 (April 2026), when Defense Evasion was split into Stealth and Defense Impairment.

What happened to the Defense Evasion tactic?

In ATT&CK v19, released April 28, 2026, MITRE split Enterprise Defense Evasion into two tactics. Stealth keeps the ID TA0005 and covers blending in with normal activity. Defense Impairment (TA0112) covers disabling or undermining security tools and logging. Some techniques received new IDs, such as Disable or Modify Tools, now T1685. The Mobile matrix still uses Defense Evasion (TA0030).

What is the difference between tactics, techniques and procedures?

A tactic is the attacker's goal (why), a technique is how they achieve it, a sub-technique is a more specific how, and a procedure is the exact implementation observed in a real attack. For example: Credential Access, OS Credential Dumping, LSASS Memory, and a specific group's use of PowerShell to scrape LSASS memory.

Is MITRE ATT&CK free to use?

Yes. MITRE states that ATT&CK is open and available to any person or organization at no charge, subject to its terms of use. You may not use the ATT&CK name in a way that implies MITRE endorses a product or service.

How often is MITRE ATT&CK updated?

MITRE publishes major releases twice a year, typically in April and October, with minor releases for corrections in between. The current version is v20, released October 13, 2026.

What is the difference between MITRE ATT&CK and the Cyber Kill Chain?

The Cyber Kill Chain is a seven-phase, high-level model of an intrusion from reconnaissance to actions on objectives. ATT&CK is far more detailed, with 15 Enterprise tactics and hundreds of techniques grounded in real reporting, and it covers post-compromise behavior in depth. Many teams use the kill chain to explain an attack and ATT&CK to analyze and test against it.

What is MITRE D3FEND?

D3FEND is MITRE's knowledge graph of defensive countermeasures, funded by the NSA Cybersecurity Directorate. It organizes countermeasures into seven tactics (Model, Harden, Detect, Isolate, Deceive, Evict and Restore) and links them to the ATT&CK techniques they address.

Is MITRE ATT&CK one of the top cybersecurity frameworks?

It is one of the most widely used, but it does a different job from governance frameworks. Programs are usually structured with frameworks such as the NIST Cybersecurity Framework, ISO/IEC 27001 or the CIS Critical Security Controls, while ATT&CK describes the threats those programs must handle. Most mature teams use ATT&CK alongside one of them.

Next Step: Test Your Defenses Against Real Adversary Behavior

ATT&CK tells you what attackers do. The only way to know what your defenses do against it is to test. Start with a coverage layer for the adversaries that matter to you, then validate the gaps with an exercise that behaves like those adversaries.

DeepStrike's red teaming services run objective-driven campaigns across people, identity, cloud, applications and internal systems, with adversary profiles that include nation-state or APT group simulation. Each engagement measures your SOC, alerting and response workflows against realistic tradecraft and ends with a debrief covering attacker pathways, evidence, remediation priorities and retest-ready next actions. To scope an exercise around the threats you face, contact DeepStrike.

About The Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements for Fortune 500 companies, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.

Sources and References

• MITRE ATT&CK: Version History (v20.0, October 13, 2026)
• MITRE ATT&CK: Updates, October 2026 (v20)
• MITRE ATT&CK: Updates, April 2026 (v19)
• MITRE ATT&CK: Updates, October 2025 (v18)
• MITRE ATT&CK: Enterprise tactics
• MITRE ATT&CK: Mobile tactics
• MITRE ATT&CK: ICS tactics
• MITRE ATT&CK: Stealth (TA0005)
• MITRE ATT&CK: Defense Impairment (TA0112)
• MITRE ATT&CK: Enterprise matrix
• MITRE ATT&CK: FAQ
• MITRE: ATT&CK Design and Philosophy (March 2020)
• MITRE ATT&CK Navigator (GitHub)
• Center for Threat-Informed Defense
• Center for Threat-Informed Defense: Adversary Emulation Library (GitHub)
• MITRE: Caldera
• MITRE D3FEND
• MITRE D3FEND: FAQ
• CISA, NSA, FBI and partners: AA24-038A, PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (February 7, 2024)
• CISA and MITRE: Best Practices for MITRE ATT&CK Mapping
• Hutchins, Cloppert and Amin, Lockheed Martin: Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains (2011)
• Wikipedia: ATT&CK