MITRE ATT&CK Framework: Tactics, Techniques, and How Teams Use It

The MITRE ATT&CK framework is a free, public knowledge base of adversary tactics and techniques based on real-world observations, maintained by the MITRE Corporation. It gives defenders a shared language for attacker behavior: each behavior gets an ID, such as T1566 for Phishing, filed under a tactic that names the attacker's goal, such as Initial Access. As of October 2026, the current release is ATT&CK v20, published October 13, 2026, and its Enterprise matrix holds 15 tactics, 227 techniques, and 479 sub-techniques. Security teams use it to map threat intelligence, plan red and purple team tests, and measure detection coverage. This guide explains the matrix, what versions 19 and 20 changed, how test reports map findings to technique IDs, and how to score coverage without overstating it.

What MITRE ATT&CK is

MITRE's ATT&CK home page defines it as "a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations." Its entries cite intrusion reporting, threat intelligence, and government advisories, so the framework records what attackers have done in practice. MITRE started ATT&CK in 2013 for a research project called FMX, according to the ATT&CK FAQ, and released it publicly in May 2015 with 96 techniques under 9 tactics, per MITRE ATT&CK: Design and Philosophy. The FAQ states that ATT&CK is "open and available to any person or organization for use at no charge," under MITRE's terms of use.

The design paper calls ATT&CK a mid-level model, sitting between high-level models such as the Lockheed Martin Cyber Kill Chain and low-level catalogs of exploits and malware. The FAQ adds that ATT&CK tactics "are unordered and may not all occur in a single intrusion." Our guide to the cyber kill chain compares the two models stage by stage.

What is the current version of MITRE ATT&CK?

The current release is ATT&CK v20, published October 13, 2026. MITRE ships major releases each April and October, per its version history, and since August 2026 it has added agile releases of groups, software, and campaigns in between. Version 20 added AI techniques, including T1699 Direct Prompt Injection, T1698 Indirect Prompt Injection, and T1700 AI-Enabled Exfiltration. It also gave ATT&CK for ICS a Command and Scripting Interpreter technique, T1701, and added campaigns for the 2026 attacks on U.S. water utilities and an AI-assisted breach of Mexican government infrastructure, according to the v20 release notes and MITRE's v20 announcement.

The bigger structural change came in v19, released April 28, 2026, which retired the Defense Evasion tactic and replaced it with two: Stealth, which keeps the ID TA0005 and covers blending in with normal activity, and Defense Impairment, TA0112, which covers breaking security tools and logging. MITRE also revoked T1562 Impair Defenses and merged its core into T1685 Disable or Modify Tools, per MITRE's v19 post. Detection rules and reports still tagged Defense Evasion or T1562 point at retired objects, so run them through MITRE's crosswalk before reporting coverage.

The three matrices: Enterprise, Mobile, and ICS

ATT&CK has three matrices, one per technology domain. The Enterprise matrix covers Windows, macOS, Linux, PRE (pre-attack preparation), Office Suite, Identity Provider, SaaS, IaaS, Network Devices, Containers, and ESXi. Mobile covers Android and iOS across 12 tactics. ICS covers industrial control systems across 12 tactics, including Inhibit Response Function and Impair Process Control, which have no Enterprise equivalent, and it models 18 asset types, such as programmable logic controllers and safety controllers.

The 15 Enterprise tactics

Tactics are the columns of the matrix, and each one names a goal. The goal column quotes MITRE's wording from the Enterprise tactics page, and the last column gives one well-documented technique per tactic.

Techniques, sub-techniques, and procedures

Techniques are the cells under each tactic. The FAQ defines the layers: tactics are the "why," techniques are the "how," sub-techniques are "a more specific description of the adversarial behavior," and procedures are "the specific implementation the adversary uses." A technique ID has four digits, such as T1003 OS Credential Dumping, and a sub-technique adds a suffix, such as T1003.001 LSASS Memory. One technique can serve several tactics: T1078 Valid Accounts sits under Initial Access, Persistence, Privilege Escalation, and Stealth, because a stolen login serves all four goals.

Procedures carry the evidence. Each technique page lists cited procedure examples by group and software, and the entry for Medusa Group, G1051, records its use of remote access software, citing CISA's March 2025 advisory on the group. That chain from report to group to technique lets a defender ask a precise question: which of this group's techniques can we see?

Groups, software, campaigns, mitigations, and detection strategies

Five more object types attach to techniques. Groups are "activity clusters that are tracked by a common name in the security community." Software covers malware and tools, including legitimate administration software that adversaries abuse. A campaign is "any grouping of intrusion activity conducted over a specific period of time with common targets and objectives." Mitigations, such as M1032 Multi-factor Authentication, are "security concepts and classes of technologies" that keep a technique from succeeding.

Detection changed the most. In v18, released October 28, 2025, MITRE deprecated data sources and replaced each technique's detection text with detection strategies, defined as "high-level approaches for detecting specific adversary techniques." Each strategy holds platform-specific analytics, and each analytic names the data components, meaning the log sources, it needs and the values a team must tune. For T1219 Remote Access Tools, strategy DET0496 describes a tool-agnostic chain: a remote access agent runs, persists as a service or autorun entry, and holds a long-lived outbound connection. Its Windows analytic, AN1366, calls for process creation, service creation, registry, file, and network connection events, with an allowlist of approved tools and external addresses to tune.

How defenders use ATT&CK

ATT&CK earns its place through threat-informed defense, which the Center for Threat-Informed Defense defines as "the systematic application of a deep understanding of adversary tradecraft and technology to improve defenses," across three dimensions: cyber threat intelligence, defensive measures, and testing and evaluation.

CISA's Best Practices for MITRE ATT&CK Mapping, updated in January 2023, says ATT&CK "can be used to identify defensive gaps, assess security tool capabilities, organize detections," and CISA advisories carry ATT&CK technique tables for that reason. For tool evaluation, MITRE published its 2025 Enterprise ATT&CK Evaluations on December 10, 2025, in which 11 vendors faced emulations of Scattered Spider and Mustang Panda, including the program's first attacks run within cloud infrastructure. MITRE states that "the evaluations do not rank vendors," so read results against your own priority techniques. For hands-on work, the free ATT&CK Navigator builds scored, commented layers and runs entirely in the browser, so you can host it offline, and the knowledge base ships as STIX 2.1 in the attack-stix-data repository, through a TAXII 2.1 server, and as Excel workbooks.

How a test report maps findings to technique IDs

A useful red team or penetration test report gives every action and every proven finding a technique ID and a detection outcome, so the report doubles as a coverage measurement. CISA's guide supplies the mapping method: find the behavior, research it, translate it into a tactic by asking why the adversary did it, identify the technique, go to the sub-technique only when the evidence supports it, and compare the result with a second analyst. The entries below are illustrative.

The outcome column takes four values, prevented, alerted, logged only, and not observed, which feed the coverage score below. Across an engagement, the share of actions your own tooling caught first is the self-detection rate that our guide to red, blue, and purple teams tracks across cycles. Ask for the mapping as an ATT&CK Navigator layer file as well as a table, so your team can compare it year over year.

How to score detection coverage against ATT&CK

Score each priority technique by the strongest evidence you hold for it, then report the share that reaches validated detection. A binary heat map, green whenever a rule carries the technique tag, overstates coverage because one rule may catch one way of performing a technique and miss the rest. MITRE's design paper puts it plainly: "it's unrealistic to expect coverage of all procedures of a given technique." BD Emerson scores coverage on five levels instead.

Score by platform, since Windows coverage says nothing about macOS or a SaaS tenant, and roll up only the techniques on your priority list, built from the groups and CISA advisories that match your sector. The headline number is the percentage of priority techniques at level 3 or above. The Center for Threat-Informed Defense measured the gap this closes. Its September 29, 2026 study, Putting Detection Coverage to the Test, evaluated 144 Sigma analytics built on Windows Security logs and mapped to 84 ATT&CK techniques, and found about 26.8 percent implementation coverage, roughly a quarter of the catalogued ways to perform those techniques. Its companion post, Beyond the Heatmap, pairs implementation coverage with detection quality, which it splits into robustness and precision.

Limitations and common misuses

Most misuse comes from treating ATT&CK as a scorecard, a checklist, or a complete list. Beyond the green heat map, four mistakes recur. Chasing completeness wastes money, because ATT&CK "is not an exhaustive enumeration of attack vectors against software," in MITRE's words, and "coverage of every ATT&CK technique is unrealistic." Biased priorities follow from biased reporting: CISA's guide names five analytical biases, including novelty bias, where unusual techniques get reported more than routine ones, and visibility bias, where each publisher reports what its own sensors see. Reading tactics as a sequence misleads, because attackers repeat and skip tactics, as the figure above shows. Version drift breaks comparisons, because a v18 coverage map still carries Defense Evasion and T1562 until someone remaps it.

Worked example: from a threat report to a coverage update

One technique, followed from an advisory through a purple team test, shows the loop. T1219 Remote Access Tools suits the example: ransomware crews use it, and many environments log it without alerting.

Start with the report. CISA advisory AA25-071A, published March 12, 2025, says Medusa actors used legitimate remote access software in victim networks and maps the behavior to T1219. The team adds T1219 on Windows workstations to its priority list at score 1, because process creation events reach the SIEM but nothing alerts on them.

Next, write a hypothesis a test can disprove: if an unapproved remote access tool starts on a Windows workstation, the SIEM alerts within ten minutes. The detection engineer builds the analytic from DET0496 and AN1366, checking new remote access services and long-lived outbound sessions against the approved tool list.

Then validate it in a purple team session. Under the signed rules of engagement, the red team operator runs a commercial remote access tool the organization does not use on one designated test workstation while the blue team watches the SIEM. In this example the first run is logged but raises nothing, because the allowlist came from an old inventory that still approved that product. The teams fix the allowlist, the operator repeats the test, and the alert fires in four minutes.

Finally, update the map. T1219 on Windows workstations moves from 1 to 3 with the test date and evidence attached, servers and macOS keep their scores until someone tests them, and the next cycle tests a second implementation to reach level 4.

Related MITRE resources: D3FEND, ATLAS, CAR, and Mappings Explorer

Four companion resources extend ATT&CK into countermeasures, AI systems, analytics, and control frameworks.

ATLAS and Enterprise ATT&CK now overlap: v20 added prompt injection to Enterprise as T1699 and T1698, and ATLAS tracks the same behavior as AML.T0051 LLM Prompt Injection. Use ATLAS for the model and agent layers and Enterprise for the hosts and identities around them, as our guide to AI red teaming describes.

How BD Emerson uses ATT&CK in red and purple team engagements

We use ATT&CK as the shared language between our operators and the client's defenders. We build red team scenarios from the groups and CISA advisories that match the client's sector and name each planned behavior by technique ID before testing starts. Every action in the engagement carries its technique ID and detection outcome, so the report's attack narrative and detection timeline double as a coverage map, as our guide to what red teaming is explains. Purple team sessions then replay the missed techniques and move their scores up the five levels. When we run the blue side through SOC as a service, the detections live in the client's own tenant, so the gains stay with the client.

Frequently asked questions

What is the MITRE ATT&CK framework? MITRE ATT&CK is a free, public knowledge base of adversary tactics and techniques based on real-world observations, maintained by the MITRE Corporation. Tactics name the attacker's goal, and techniques and sub-techniques describe how the goal is reached, each with an ID such as T1566 Phishing. Defenders use it to map threat intelligence, plan red and purple team tests, and measure detection coverage.

What is the latest version of MITRE ATT&CK? As of October 2026, the latest version is ATT&CK v20, released October 13, 2026, with 15 Enterprise tactics, 227 techniques, and 479 sub-techniques. Version 20 added AI-related techniques such as Direct and Indirect Prompt Injection. Version 19, released April 28, 2026, split Defense Evasion into Stealth and Defense Impairment.

How many tactics are in MITRE ATT&CK? ATT&CK for Enterprise has 15 tactics in version 20: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact. Mobile and ICS have 12 tactics each. Enterprise had 14 until version 19 replaced Defense Evasion with Stealth and Defense Impairment.

What is the difference between MITRE ATT&CK and the Cyber Kill Chain? The Cyber Kill Chain, published by Lockheed Martin in 2011, describes an intrusion as seven ordered phases from reconnaissance to actions on objectives. ATT&CK works at a lower level, cataloging hundreds of specific techniques under unordered tactics that attackers can repeat or skip. Teams use the kill chain to decide where to break an attack and ATT&CK to build and measure the detections that break it.

How do you measure detection coverage with MITRE ATT&CK? Score each priority technique by its strongest evidence: no telemetry, logged only, alert deployed, alert validated by a test, or validated across several implementations. Score each platform separately and report the share of priority techniques with validated detection. A heat map that turns a cell green whenever a rule carries the technique tag overstates coverage, because one rule rarely catches every way to perform a technique.

If you want to know which ATT&CK techniques your detections catch in practice, our offensive security team can build a red or purple team engagement around your priority techniques and hand back a scored coverage map your SOC can keep improving.