MITRE ATT&CK is a knowledge base of the methods that attackers use against enterprise systems, cloud apps, mobile devices, and industrial control systems. ATT&CK, which stands for Adversarial Tactics, Techniques, and Common Knowledge, can help you understand how cyber attackers think and work.
The MITRE Corporation is a non-profit organization, founded in 1958, that provides engineering and technical guidance on advanced technology problems like cybersecurity for a safer world.
ATT&CK amasses information that can help you understand how attackers behave so you can better protect your organization and defend against cyber threats.
MITRE organizes its observations about attack behaviors into tables called Matrices. Each Matrix addresses a different target, like enterprise operating systems and cloud platforms, mobile devices, or industrial control systems.
ATT&CK's descriptions of tactics, techniques, and procedures (TTPs) provide deep insight into attacker behavior. Tactics describe their goals, like getting inside your network or stealing credentials. Techniques show how they do it. Procedures are highly detailed examples of the tools and actions of specific attacker groups.
Mitigations explain how to defend against attacker TTPs. A single Mitigation can apply to multiple TTPs; for instance, multi-factor authentication addresses account manipulation, brute force, external remote services, and many others.