Learn
MITRE ATT&CK
Why this framework exists
Before ATT&CK, there wasn't a consistent way to describe what an attacker actually did during an intrusion. One report might call something "lateral movement," another might call the same behavior "internal reconnaissance," and a third might just describe the tool used without naming the underlying technique at all. That inconsistency made it hard to compare intrusions, build detections that generalized beyond one incident, or even have a clear conversation across teams and vendors.
MITRE ATT&CK is a knowledge base of adversary behavior built from real, observed intrusions, organized so the field has one shared vocabulary for it. When this program's scenarios reference a MITRE ID like T1558.003, that's not decoration. It's a precise, industry-standard pointer to a specific, well-documented behavior, and every tool, report, or detection rule that also references that ID is talking about the exact same thing.
Tactics, techniques, and sub-techniques
The framework has three levels, and the distinction matters.
A tactic is the adversary's goal at a given stage: Credential Access, Lateral Movement, Exfiltration. It answers "why" they're doing something. As of the current version of the framework, there are 15 tactics covering the full arc of an intrusion, from initial reconnaissance through final impact.
A technique is how they achieve that goal. Kerberoasting is how an attacker achieves Credential Access, specifically by abusing Kerberos service ticket requests. A sub-technique narrows that further when a technique has meaningfully different variations. OS Credential Dumping is a technique. LSASS Memory is one specific sub-technique of it, distinct from dumping credentials out of the Windows registry's SAM database instead.
This structure is deliberately practical, not academic. Knowing a technique's ID tells you its tactic, its typical telemetry, and often points you straight to prebuilt detection content, because the entire industry has standardized on referencing things this way.
ID formats
The IDs follow a consistent pattern, and once you recognize it, you can tell a lot about a reference just from its shape:
- Tactics: TAxxxx. Credential Access, one of the examples already used above, is TA0006. This is the "why."
- Techniques: Txxxx. Steal or Forge Kerberos Tickets is T1558. This is a specific "how" under that tactic.
- Sub-techniques: Txxxx.yyy. Kerberoasting is T1558.003, a three-digit suffix on the parent technique's ID identifying this specific variant. The prefix tells you immediately which technique it belongs to before you even look it up.
How the matrix is organized
The ATT&CK Matrix lays techniques out with tactics as columns, roughly following the order an intrusion tends to unfold. Reconnaissance and Initial Access sit on the left, Impact on the right, with everything an attacker might do in between arranged underneath the relevant tactic. It's not a strict linear path every attacker follows step by step, but it does reflect the general shape of how intrusions progress. That makes it a genuinely useful map for both attackers planning an operation and defenders reasoning about where to focus.
The current Enterprise matrix has 222 techniques and 475 sub-techniques, and it keeps growing. MITRE updates it as new adversary behavior gets documented, and occasionally restructures it when the existing categories stop making sense. The most recent example: in April 2026, MITRE retired the long-standing Defense Evasion tactic entirely, splitting it into Stealth (techniques focused on staying hidden) and Defense Impairment (techniques focused on actively breaking security controls). That distinction matters operationally. A hidden attacker and one who's disabled your logging call for genuinely different responses, and lumping them into one tactic made that harder to see. This platform's TTP Catalog reflects the current, post-split framework.
Why the field indexes on it
Threat-informed defense, the practice of building your detection and response priorities around what adversaries actually do rather than what seems theoretically important, depends on having a shared, current map to work from. ATT&CK is that map. Threat intelligence reports reference it. Detection rules, including the Elastic Security rules you'll use throughout this program, are tagged against it. Red teams and purple teams plan exercises around specific technique coverage. When a team says "we have detection coverage for Credential Access," ATT&CK is what makes that statement precise instead of vague.
Where this shows up in this program
Every scenario's objectives are mapped to real ATT&CK techniques. The TTP Catalog is a browsable, searchable reference covering the full current matrix, with in-depth write-ups for the techniques this platform's scenarios actually exercise, and a coverage map showing what's written up versus what's still just indexed. As you work through scenarios, you'll start recognizing technique IDs the way you'd recognize any other piece of professional vocabulary, and the catalog is there whenever you need the specifics.
Where to go from here