MITRE ATT&CK

ATT&CK, which stands for Adversarial Tactics, Techniques and Common Knowledge, is maintained by the not-for-profit MITRE Corporation. It is organized as a matrix. Tactics describe the attacker's goal at each stage, such as initial access, execution, persistence, privilege escalation, defence evasion, credential access, discovery, lateral movement, collection, exfiltration and impact. Techniques and sub-techniques describe how each goal is achieved.

Security teams use ATT&CK to map detections and identify coverage gaps, to describe incidents in a common language, to plan red team and purple team exercises and to compare security products. Threat intelligence reports from the Canadian Centre for Cyber Security and other agencies routinely reference ATT&CK technique identifiers.

For an SMB, ATT&CK is mainly useful as a question to ask providers. Which techniques does your MDR service detect, and how is that tested? Can incident reports reference ATT&CK so they can be compared with public advisories? You do not need to master the framework to benefit from providers who use it well.