MITRE ATT&CK

Hand-drawn sketch: A field guide, not a battle plan. ATT&CK is a shared name for behaviour somebody has already watched happen.

ATT&CK is a shared catalogue of what adversaries have actually been observed doing, organised by tactic and technique.

Its value is a common vocabulary: detections, intelligence, testing and gap analysis can all reference the same identifiers. It describes behaviour rather than prescribing controls, which makes it a map of what to be able to see rather than a list of what to buy.

Checked against the primary source.

MITRE ATT&CK

More on Frameworks & standards