What Is MITRE ATT&CK? Mapping Attacker Tactics and Techniques

On a quiet Friday afternoon, an employee opens an attachment in an email that looks like a routine shipping update. Within minutes a macro runs, an account is taken over, and an attacker begins moving quietly across the network. By the time anyone notices on Monday, sensitive data may already be gone. If every step of that chain had a name that all your teams and tools shared, you would have caught it far sooner. That is exactly the problem MITRE ATT&CK was built to solve: turning attacker behavior into a single map everyone can read.

What Is MITRE ATT&CK? The Structure of the Framework

In short, MITRE ATT&CK is an open, free knowledge base of attacker behavior observed in real-world intrusions. It is maintained by the non-profit MITRE and has become the shared vocabulary of defensive teams worldwide.

The framework rests on three layers:

• Tactic: the attacker's objective at a given step, such as initial access, privilege escalation, or exfiltration.
• Technique: the method used to reach that objective, such as gaining a foothold through a phishing attachment.
• Procedure: the concrete implementation, such as a specific malware family running a specific command.

Together these are known as TTPs (tactics, techniques, and procedures). Because they describe behavior rather than a single tool, they stay useful even when a signature changes: the tooling may shift, but the underlying behavior usually does not. That durability is where the framework earns its lasting value.

Why a Common Language, Not a Product

ATT&CK is not something you buy or install; it is a reference framework. Its value is that different products and teams can describe the same event with the same names. When a firewall alert, an endpoint alarm, and a log entry all map to one technique, they tell a single story instead of speaking in separate dialects, and analysts stop drowning in scattered, disconnected alerts.

How to Read the Matrix

The ATT&CK matrix is a wide table whose columns are tactics and whose cells are techniques. Read left to right, it traces the typical lifecycle of an intrusion, from initial access through to exfiltration and impact. Every technique carries an identifier beginning with T, and sub-techniques are separated by a dot. You can review the current version at the official MITRE ATT&CK resource.

There are three matrices — Enterprise (classic IT networks), Mobile, and ICS (industrial control systems) — and most organizations start with Enterprise. The point is not to memorize every cell but to mark which techniques you can actually detect in your environment. This exercise is called coverage analysis: what you can see turns green, and your blind spots turn red. The red cells show where your next investment should go, so your budget rests on visible gaps rather than guesswork. Refresh the map each quarter, because as your network changes, your blind spots move with it.

Using ATT&CK in the SOC and SIEM

A security operations center (SOC) is the team that monitors and responds to threats, and its main eyes are usually the SIEM. A SIEM (security information and event management) collects logs from many sources and correlates them in one place. ATT&CK is the common framework that binds the two together.

Three uses stand out in practice:

1. Rule tagging: each correlation rule is labeled with an ATT&CK technique, so "which techniques do we actually catch" becomes measurable.
2. Blind-spot detection: once tagged rules are projected onto the matrix, the techniques with no rule at all stand out.
3. Alert enrichment: when an alarm fires, the linked tactic and technique give the analyst instant context.

Tagging rules to techniques also drives prioritization. Five alarms that fire at once often map to different steps of one attack chain and can be merged into a single incident, so the analyst works from one story instead of five fragments. Organizations that want this run end to end can rely on our Managed SOC / MDR service, and anyone curious about the collection layer beneath it can read our guide to what a SIEM is.

Example Chain: From Phishing to Data Exfiltration

A concrete scenario shows the framework's value best. The table below maps a chain that runs from an opening phishing email to data exfiltration, one ATT&CK step at a time.

Each step can look harmless in isolation — a macro here, a scheduled task there, a remote connection somewhere else. Read together as a sequence of tactics, the picture becomes unmistakable, and that holistic reading is the real strength of ATT&CK. The first link in the chain is almost always a person, so practical tips for spotting suspicious messages are collected in our guide to recognizing phishing emails.

ERBE SIEM Correlation Mapping

A framework only creates value once it is reflected in a real system. ERBE SIEM is a platform, developed entirely in-house and deployed on-premise, that maps ATT&CK techniques to correlation rules and supports TÜBİTAK RFC 3161 time stamping.

Turkish regulatory context: foreign companies operating in Turkey should note that ERBE SIEM is built to comply with Law No. 5651, the statute governing retention of internet traffic logs. Processing records on-premise, without transferring them abroad, helps satisfy these local retention obligations.

Version 1.0.0 ships with 27 modules, 31 dashboard screens, and 111 tests, and several dashboards are organized directly by ATT&CK tactic. When an alarm fires, the related technique identifier is shown to the analyst. As a concrete example, data from one of our own deployments recorded 262 attack attempts over 24 hours from 104 different IPs, peaking at 16 attempts per second, with all records processed on-site and 0 cloud transfer. Every attempt was tagged by the technique it triggered and gathered onto a single timeline, turning scattered logs into a coherent attack story and making executive reports far easier to read when incidents are described by tactic rather than raw technical code.

Conclusion

MITRE ATT&CK turns attacker behavior into a map that everyone can read. Its tactic, technique, and procedure layers connect scattered alerts into a single story, and on the SOC and SIEM side that map makes your blind spots visible and steers investment to the right layer. The framework earns its keep when you embed it in your correlation rules rather than leaving it on a shelf. To build that mapping on an in-house, on-premise platform, explore the tactic-and-technique map behind our ERBE SIEM correlation platform.

Frequently Asked Questions

What is the difference between MITRE ATT&CK and the Cyber Kill Chain?

The Cyber Kill Chain splits an attack into seven linear stages and gives a high-level view. ATT&CK details the hundreds of concrete techniques that sit beneath those stages. The Kill Chain describes what happens; ATT&CK shows exactly how it is done. The two do not conflict — many teams use the Kill Chain as the overall frame and ATT&CK for technical depth.

Is MITRE ATT&CK worth adopting for a small business?

Yes, but scaled to your size. A small business does not need to cover the whole matrix. Starting with a few of the most common tactics is enough: initial access, persistence, and exfiltration. Gaining visibility across those three catches the bulk of attacks early, and expanding coverage gradually is a far better strategy than never starting at all.

How do I map ATT&CK techniques to my SIEM rules?

Begin by adding the relevant technique identifier as a tag on each correlation rule. Project those tags onto the matrix, then mark any technique with no rule as a blind spot. Set priorities according to the attack chains most likely in your own environment. Platforms such as ERBE SIEM ship these mappings as ready-made rules, which noticeably speeds up the process.