MITRE ATT&CK: a catalog of what attackers really do

ATT&CK has three levels. A tactic is the goal the attacker wants to reach, a technique is the way they reach it, and a sub-technique is a more specific variant of the same technique. The Enterprise matrix currently holds fifteen tactics, ordered roughly by how they follow one another in an attack.

The order of the tactics isn’t a script the attacker has to go through end to end. It is a list of goals they pick from according to where they got and what they need next.

One of the later tactics is Command and Control (C2), the channel through which an attacker remotely controls the access they gained inside the network.

The label takes the form of the letter T and a number; a sub-technique adds a period and three digits. T1558.003 Kerberoasting therefore means sub-technique 003 under technique T1558, which describes the theft and abuse of Kerberos tickets, and it falls under the Credential Access tactic.

The practical benefit is precision. When a report says T1558.003 Kerberoasting, a defender can look up which log sources catch it and which measures limit it, no matter what the tester called the finding. The same IDs are used by the vendors of detection tools and by the authors of campaign analyses.

During a test, ATT&CK serves two purposes: as a check that a whole group of techniques wasn’t forgotten, and as a shared language for describing what happened. Findings labeled with IDs can be compared between two tests a year apart, even if someone else ran them.

It makes the most sense on an internal network and in scenario-based operations, where the point isn’t one vulnerability but a chain of steps. That is how a cyberattack simulation works with it, and so does an infrastructure penetration test, where the path through the domain is made up of several techniques in a row.

A defender uses ATT&CK as a coverage map. For each technique they record whether they have a log source for it, whether an alert comes out of it, and whether anyone evaluates that alert. The result is a picture of where the holes in detection are, not a list of the tools that were bought.

This view is uncomfortably sober. It can turn out that techniques built on ordinary operating system tools aren’t covered at all, while exotic attacks have three layers of protection over them. ATT&CK won’t improve detection by itself, it only shows where detection is missing.

ATT&CK is not a testing methodology, it is not a list of vulnerabilities, and it is not a severity rating. It describes attacker behavior, not a specific flaw in a specific version of software, and not a procedure for running a test.

• The course of a test is described by PTES, not by ATT&CK.
• The severity of a specific vulnerability is expressed by CVSS.
• A specific flaw in a product is identified by a CVE record, not by a technique ID.
• Coverage of techniques says nothing about whether a vulnerability really can be exploited.

A common misunderstanding shows up in tenders that ask for a test under ATT&CK. You can’t test under a knowledge base; you can only use it to describe what was done and to check what was left out.

ATT&CK comes out in versions several times a year, and since August 2026 the regular half-yearly cadence has been joined by narrower releases that add only groups, software, and campaigns in between. The number of the current version therefore ages fast, and you will find it in the table at the top of this page.

Between versions, techniques get added, descriptions change, and sometimes whole tactics do: in v19 the original Defense Evasion tactic split in two. The label TA0005 stayed with the one now called Stealth, and a new tactic TA0112 Defense Impairment appeared next to it. That is why the Enterprise matrix has had fifteen tactics instead of fourteen since April 2026.

For the reader of a report only one rule follows from this. A mapping to ATT&CK should state the version it was mapped against, otherwise it can’t be reliably compared with an older deliverable a year later. Technique IDs hold longer than their names.