What Is MITRE ATT&CK?

What is MITRE?

The MITRE Corporation is a non-profit organization, founded in 1958, that provides engineering and technical guidance on advanced technology problems like cybersecurity for a safer world.

Why is ATT&CK important?

ATT&CK amasses information that can help you understand how attackers behave so you can better protect your organization and defend against cyber threats.

What is an ATT&CK Matrix?

MITRE organizes its observations about attack behaviors into tables called Matrices. Each Matrix addresses a different target, like enterprise operating systems and cloud platforms, mobile devices, or industrial control systems.

What are TTPs?

ATT&CK's descriptions of tactics, techniques, and procedures (TTPs) provide deep insight into attacker behavior. Tactics describe their goals, like getting inside your network or stealing credentials. Techniques show how they do it. Procedures are highly detailed examples of the tools and actions of specific attacker groups.

What are ATT&CK Mitigations?

Mitigations explain how to defend against attacker TTPs. A single Mitigation can apply to multiple TTPs; for instance, multi-factor authentication addresses account manipulation, brute force, external remote services, and many others.