MITRE ATT&CK
MITRE ATT&CK is a free, globally used knowledge base of adversary tactics and techniques based on real-world observations. It organises attacker behaviour into tactics (the goal) and techniques (how it is achieved), giving defenders a common language to map detections and threat activity.
ATT&CK describes what adversaries do after gaining access, from initial access through to impact. Each technique carries a stable ID (for example T1059, Command and Scripting Interpreter) referenced across the industry.
Teams use ATT&CK to map detection coverage, attribute activity to threat groups, and drive purple-team exercises.
The ATT&CK framework is organised as a matrix of tactics and techniques. Tactics are the adversary’s goals, such as initial access, persistence, privilege escalation, lateral movement and exfiltration. Techniques are the specific methods used to achieve each goal, and many break down further into sub-techniques. This structure gives defenders a shared, detailed vocabulary for describing exactly how an attack works.
ATT&CK is grounded in observed, real-world adversary behaviour rather than theory, which is a large part of why it has become an industry standard. Each technique is documented with descriptions, examples of the groups and software that use it, detection guidance and mitigations, so a defender can move directly from understanding a technique to acting on it.
The framework is used across the whole of security. Detection teams map their coverage against the matrix to find gaps. Red and purple teams use it to plan and measure exercises. Threat intelligence uses it to describe adversary behaviour consistently. Because everyone references the same taxonomy, ATT&CK also improves communication between tools, teams and organisations.
A key advantage of ATT&CK over older, linear models is that it reflects how attacks actually unfold, without assuming a fixed sequence, and it focuses on behaviours that are harder for attackers to change than the indicators older approaches relied on. For AI and machine learning systems, the related MITRE ATLAS framework extends the same idea to adversarial techniques against AI.
Each technique in the framework is richly documented, with descriptions, real examples of the threat groups and malware known to use it, guidance on the data sources that would reveal it, and specific mitigations. This lets a defender move directly from recognising a technique to acting on it, whether by building a detection, closing a gap, or checking whether a relevant adversary is known to use it against their sector.
ATT&CK is maintained across several technology domains, including enterprise IT, mobile and industrial control systems, so that organisations can apply the same behavioural taxonomy across very different environments. Its consistency is a large part of its power: because tools, teams, threat-intelligence providers and testers all reference the same technique identifiers, ATT&CK improves communication and lets detection coverage be compared and combined across an entire security programme.
For organisations deploying artificial intelligence, the related MITRE ATLAS framework extends the same behavioural, evidence-based approach to adversarial techniques against machine learning and AI systems. Together, ATT&CK for conventional systems and ATLAS for AI give defenders a consistent way to reason about, test for and detect adversary behaviour across both the traditional estate and the newer AI systems increasingly embedded within it.
Precursor maps threat actors and vulnerabilities to ATT&CK techniques, and exposes the full tactics and techniques reference publicly and via its MCP server.