Safety Center

MITRE ATT&CK Explained for Beginners

MITRE ATT&CK is the shared map of how real attackers behave — tactics, techniques and procedures, organised so defenders can recognise them. This guide explains it in plain English, with examples of what each tactic looks like in practice.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

The problem ATT&CK solves

Before ATT&CK, defenders described attacks in incompatible ways. One team would say 'the attacker got in through email', another would say 'phishing', a third would describe the malware — and nobody could be sure they were talking about the same thing. MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) fixes that by giving the whole field a shared map: a structured list of what attackers try to achieve (tactics), the methods they use (techniques), and the specific variations (sub-techniques), all grounded in observed real-world attacks.

It was built by MITRE, a not-for-profit organisation, from public reporting and research, and it is freely available. Threat-intelligence practitioners describe it as close to non-negotiable knowledge for the field — not because you must memorise it, but because it is the language the field now speaks.

Tactics: the attacker's goals

A tactic is a 'why' — the goal an attacker is pursuing at a given stage. ATT&CK for Enterprise organises tactics in the rough order an attack unfolds, though real attacks jump around. The main tactics are: reconnaissance (learning about the target), resource development (building tools and infrastructure), initial access (getting in), execution (running code), persistence (staying in), privilege escalation (gaining higher access), defence evasion (avoiding detection), credential access (stealing logins), discovery (learning the environment), lateral movement (moving to other systems), collection (gathering data), command and control (communicating with the attacker's infrastructure), exfiltration (taking data out), and impact (damaging, encrypting or disrupting).

Notice that none of these is a tool or a piece of malware. They are goals. That is the point: the same goal can be pursued many ways, and defenders who think in goals can recognise an attack even when the tool is new.

Techniques: how the goal is achieved

A technique is a 'how' — a specific method for achieving a tactic. Under Initial Access, for example, the techniques include phishing, exploiting a public-facing application, using valid accounts (stolen or leaked credentials), and supply-chain compromise. Under Credential Access, they include brute-forcing passwords, stealing credentials from memory or files, and intercepting network authentication. Each technique has sub-techniques for the variants, and each entry in the knowledge base describes what the technique looks like, which groups have been observed using it, and how defenders can detect and mitigate it.

The technique entries are the practical heart of the framework. A SOC analyst investigating an alert can look up the technique and find: what evidence to look for in logs, what mitigations exist, and what other techniques the same attacker usually pairs with it. That is why ATT&CK is a working tool, not a textbook — it tells you what to check next.

An example: one attack, mapped

Consider a realistic attack, step by step. The attacker sends a phishing email with a malicious attachment (Initial Access: phishing). The victim opens it, the attachment runs a script (Execution). The script establishes persistence on the machine, for example by adding a scheduled task (Persistence). The attacker steals the user's credentials from memory (Credential Access), uses them to log into another server (Lateral Movement, using valid accounts), collects documents (Collection), and sends them to an external server (Exfiltration). Finally, ransomware is deployed (Impact).

Six tactics, several techniques, one coherent story — and any defender reading the mapping knows exactly what to look for at each step. That is the value: a shared map turns a confusing incident into a structured investigation. In a SOC, analysts map alerts to ATT&CK as they triage, which is why the framework appears in the SOC analyst guide as core knowledge.

How to learn ATT&CK as a beginner

1. Learn the fourteen Enterprise tactics first — just the names and what each goal means. That is the skeleton of the whole framework.
2. Pick one tactic and learn its three or four most common techniques, with a real example for each.
3. Practise mapping: take a news report of an incident (a breach case study in our Research Library, for example) and map the reported steps to tactics and techniques.
4. Use the framework as a reference while you study logs: when you see a suspicious event, ask which tactic it serves.
5. Do not try to memorise every technique. There are hundreds. Professionals look them up; what they remember is the structure and the common ones.

ATT&CK, CVE and threat intelligence

ATT&CK describes behaviour; CVE describes individual vulnerabilities (see our CVE guide). The two connect in practice: an attacker may use a CVE — a specific weakness in a specific product — as the technique for Initial Access, and the defender's job is to recognise both the weakness and the behaviour around it. Threat-intelligence reports tie the three together: who is attacking, which techniques they use (ATT&CK), and which vulnerabilities they exploit (CVE). Learning all three, in that order, gives a beginner the vocabulary of the whole field.

Limits and honest caveats

ATT&CK is a map of observed behaviour, not a complete catalogue of everything possible. New techniques appear, old ones fade, and not every attack maps cleanly. It also describes what attackers do, not why a specific organisation was targeted. Use it as a structured lens for investigation and detection, not as a guarantee that anything unlisted is safe. Check MITRE's site for the current version — the framework is updated regularly, and technique names and structure change over time. Last checked: 14 November 2026.

Detection: what each tactic looks like in logs

The framework is most useful when it meets real logs. Initial access by phishing shows up as an email attachment or link followed by a process starting from an unusual parent. Execution shows up as scripts or commands running from temporary folders. Persistence shows up as new scheduled tasks, new services, or new registry entries. Credential access shows up as unusual reads of credential stores or a sudden burst of failed logons. Lateral movement shows up as logons between machines that do not usually talk to each other. Exfiltration shows up as large or unusual outbound transfers, especially to new destinations. None of these alone proves an attack — each is a signal to investigate, and ATT&CK tells you what the signal could mean and what to check next.

ATT&CK Navigator and keeping current

MITRE publishes a free tool, ATT&CK Navigator, that lets you view the framework as a matrix and mark the techniques your organisation detects, partially detects, or does not detect. For a beginner, it is worth opening once just to see the shape of the framework — the matrix makes the scale real in a way a list does not. Remember the framework is updated regularly: technique names change, new sub-techniques are added, and group attributions are revised. Cite the version you used when you write about it, and check MITRE's site for the current release rather than relying on a blog post from two years ago. Last checked: 14 November 2026.

Sources

• MITRE ATT&CK — official knowledge base
• TryHackMe — threat intelligence and ATT&CK role guidance
• Research methodology — how this guide was researched

Last checked: 14 November 2026

Frequently asked questions

What is MITRE ATT&CK?

MITRE ATT&CK is a publicly available knowledge base of attacker tactics, techniques and procedures, built from real-world observations. Defenders use it as a common language to describe, detect and discuss attacks.

What is the difference between a tactic and a technique in ATT&CK?

A tactic is the attacker's goal — for example, getting initial access or stealing data. A technique is how they achieve it — for example, phishing or exploiting a public-facing application. One tactic can be achieved by many techniques.

Do I need to memorise ATT&CK to work in a SOC?

No. You need to understand its structure and be able to map an alert to a tactic and a technique. SOC analysts use it as a reference and a shared vocabulary, not as a list to recite.

Is MITRE ATT&CK free to use?

Yes. ATT&CK is published by MITRE, a not-for-profit organisation, and the knowledge base is freely available. Check MITRE's site for the current version and the terms of use.

How does ATT&CK relate to threat intelligence?

Threat intelligence describes who is attacking, how, and why — and ATT&CK provides the vocabulary for the 'how'. Intelligence reports routinely map observed activity to ATT&CK techniques, which lets defenders compare, prioritise and detect.

What is the difference between ATT&CK for Enterprise, Mobile and ICS?

They are versions of the same framework tuned to different environments: Enterprise covers Windows, macOS, Linux and cloud; Mobile covers phones and tablets; ICS covers industrial control systems. Beginners should start with Enterprise.