What is MITRE ATT&CK — The Common Language of Adversary Behavior

Answer first

MITRE ATT&CK answers two questions about an attack: why the adversary does something (the tactic) and how they do it (the technique). It is the shared vocabulary for threat intelligence and detection engineering.

1. What it is

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a free, publicly maintained knowledge base of adversary behavior, built by MITRE from real-world threat reports and incident data — not from theory. It organizes proven attack behavior so defenders can compare, detect and respond to it in a standard way.

2. The building blocks

• Tactics describe the why — the operational goal of a step, such as Initial Access, Execution, Persistence, Credential Access or Exfiltration.
• Techniques describe the how — the concrete method used to achieve a tactic, such as Phishing (T1566) for Initial Access or Valid Accounts (T1078) for Defense Evasion.
• Sub-techniques (e.g. T1566.001 Spearphishing Attachment) refine techniques with more specific variants.
• Procedures are the specific implementations a given threat actor uses, referenced in ATT&CK group and software entries.

3. Why it matters

• Shared vocabulary: analysts, vendors and researchers can describe the same attack in the same terms.
• Detection engineering: technique IDs map directly to detection coverage — a gap in coverage of a common technique is a gap in your detection.
• Investigation structure: incident response can be framed as walking a chain of techniques from Initial Access to Exfiltration.
• Threat profiling: groups and malware are tagged with the techniques they use, which supports attribution and hunting.

4. What it is not

ATT&CK is a behavior framework, not a list of software vulnerabilities, not a risk scoring system, and not proof of attribution by itself. A technique match means “this behavior is consistent with”, not “this actor did it”. Treat mappings as evidence to validate, not as a verdict.

5. How to use it in an investigation

1. Map observed behaviors to technique IDs as you gather evidence.
2. Order them into a tactic chain — from Initial Access through Exfiltration.
3. Compare the chain against known group profiles for consistency, not certainty.
4. Use the technique IDs to find existing detection coverage or gaps, and to search threat intelligence for similar campaigns.

OpenTrojan’s threat-intelligence pages and investigation workspaces reference technique IDs so you can follow the same flow without leaving the platform.

6. References

• MITRE ATT&CK
• MITRE — About ATT&CK