What is the MITRE ATT&CK Framework?

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally accessible knowledge base of adversary behavior, maintained by MITRE, a not-for-profit organization. It is built from real-world observations of how attackers actually operate.

Red teams, defenders, threat hunters, and detection engineers use ATT&CK as a common language to describe attacks, plan detections, and measure coverage. ATT&CK has separate matrices for Enterprise, Mobile, and ICS environments. This site uses the Enterprise matrix, which covers Windows, macOS, Linux, cloud, network, and container environments.

The ATT&CK Framework is broken into the following components:

Tactics

Tactics are the adversary's goal at a given stage of an attack, or the "why" behind an action. Each tactic has an ID that starts with TA, for example TA0006 for Credential Access.

The Enterprise tactics are listed below, in the order they typically appear in an attack:

• Reconnaissance (TA0043) - The adversary is trying to gather information they can use to plan future operations.
• Resource Development (TA0042) - The adversary is trying to establish resources they can use to support operations.
• Initial Access (TA0001) - The adversary is trying to get into your network.
• Execution (TA0002) - The adversary is trying to run malicious code or instructions on a system.
• Persistence (TA0003) - The adversary is trying to maintain their foothold.
• Privilege Escalation (TA0004) - The adversary is trying to gain higher-level permissions.
• Stealth (TA0005) - The adversary is trying to hide and conceal their actions, appearing as normal behavior.
• Defense Impairment (TA0112) - The adversary is trying to break security mechanisms, pipelines, and tooling so defenders can't see or trust what's happening.
• Credential Access (TA0006) - The adversary is trying to steal account names and passwords.
• Discovery (TA0007) - The adversary is trying to figure out your environment.
• Lateral Movement (TA0008) - The adversary is trying to move through your environment.
• Collection (TA0009) - The adversary is trying to gather data of interest to their goal.
• Command and Control (TA0011) - The adversary is trying to communicate with compromised systems to control them.
• Exfiltration (TA0010) - The adversary is trying to steal data.
• Impact (TA0040) - The adversary is trying to manipulate, interrupt, or destroy your systems and data.

Note: In recent versions of ATT&CK, the former Defense Evasion tactic was split into two tactics: Stealth (TA0005) and Defense Impairment (TA0112).

Techniques

Techniques describe how an adversary achieves a tactic's goal, or the "how." Each technique has an ID that starts with T, for example T1558 (Steal or Forge Kerberos Tickets) under Credential Access. Some techniques serve more than one tactic.

Many techniques also have more specific sub-techniques, such as T1059.001 (PowerShell) under T1059 (Command and Scripting Interpreter).

Content on this site is tagged at the technique level, and each technique tag appears right after its tactic, so you can search broadly by tactic or narrowly by technique.