Simple definition
MITRE ATT&CK is a knowledge base describing adversary behaviors observed in real attacks.
Purpose and use
It provides a shared vocabulary for incident analysis, test scenarios and assessment of detection capabilities.
How does it work?
Tactics express objectives; techniques and sub-techniques describe ways to achieve them. Entries include examples, sources and detection information.
Key points
- Example: a team maps incident events to techniques to identify missing logs and ineffective controls.
- Support each mapping with evidence and state which parts of the environment are actually covered.
Points to watch
Coloring a matrix does not prove effective detection or complete coverage. Adversary behavior and knowledge-base versions evolve.
In short
ATT&CK structures analysis of adversary behavior and validation of defensive capabilities.