Glossary

MITRE ATT&CK framework

A public knowledge base of adversary tactics and techniques used as a shared vocabulary for describing attacker behavior.

Also called: ATT&CK

The MITRE ATT&CK framework is a publicly maintained knowledge base of adversary tactics and techniques, organized into a matrix that describes the stages of an attack, from initial access through execution, persistence, and exfiltration, and the specific methods attackers use at each stage. Security teams use it as a common vocabulary for describing attacker behavior rather than only isolated indicators.

Unlike an indicator of compromise list, which describes specific artifacts from one attack, ATT&CK describes reusable techniques, such as a particular method of credential theft, that persist across many campaigns even as the specific files and infrastructure change. Teams map detection rules in a SIEM and coverage in endpoint detection and response or XDR tools against the matrix to see which techniques they can and cannot detect.

ATT&CK matters because it shifts defense planning from chasing individual indicators to closing gaps in technique coverage, and it gives red teams and threat intelligence analysts a shared language for describing what an attacker actually did. A common misreading is treating full matrix coverage as a checklist to complete rather than a prioritization tool, since not every technique is equally relevant to every organization.

Last reviewed September 22, 2026

In the index now

Related terms

Threat intelligence Analyzed information about attacker groups, tools, and techniques used to anticipate and defend against threats, not just react to them. Indicator of compromise (IOC) A piece of forensic evidence, such as a file hash or IP address, suggesting a system has been breached or contacted by an attacker. Endpoint detection and response (EDR) Software that continuously records endpoint activity, applies detection logic, and lets responders investigate and contain threats. Extended detection and response (XDR) A platform that correlates telemetry across endpoints, network, identity, and cloud into a single detection and investigation view. Security operations center (SOC) The team responsible for continuously monitoring an organization's systems, triaging alerts, and coordinating incident response.

Related guides

Security analytics, explained How security teams turn logs and network noise into detected threats — SIEM, threat intelligence, and the metrics that measure a SOC's speed.