Lesson 3.3: MITRE ATT&CK: a shared language for attacker behaviour
MITRE ATT&CK is a free, public knowledge base of what real attackers do, organised as tactics (the goal of a step: why) and techniques (how it's done), each with an ID such as T1566 Phishing. You label the incident's alerts with ATT&CK names, count which tactics appear, and compare them with the company's detection rules to find what it couldn't see.
18 min
You will learn to
- Explain tactics, techniques and procedures (TTPs)
- Read an ATT&CK technique ID
- Label alerts with ATT&CK names
- Find detection gaps by comparing alerts with rules
Key terms
- MITRE ATT&CK
- A free, public knowledge base of attacker behaviour based on real incidents, maintained by the US non-profit MITRE.
- Tactic
- The goal of an attacker's step: the 'why'. The Enterprise matrix has 14, from Reconnaissance to Impact.
- Technique
- How a tactic is carried out. Each has an ID beginning with T; sub-techniques add a number after a dot.
- Procedure
- The specific way a particular group used a technique in a real case.
- Detection coverage
- Which techniques your monitoring can actually notice. Mapping rules to ATT&CK shows the gaps.
← The Linux filesystem hierarchy · All lessons · Absolute and relative paths →