Simple definition
A knowledge base of adversary tactics, techniques, and procedures used by security teams to model threats and evaluate detection coverage.
ATT&CK is most useful when mapping reflects evidence and telemetry rather than becoming a checklist exercise. A technique can be considered covered only when the relevant data exists, the analytic is validated, and the operational workflow can act on the result.
How is MITRE ATT&CK organized?
Tactics
Represent the adversary's tactical objective or why an action is being performed.
Techniques
Describe how adversaries achieve tactical goals through particular behaviors.
Sub-techniques
Provide more specific descriptions of a technique when useful.
Procedures
Describe concrete implementations or observed ways adversaries use techniques.
Threat groups
Connect documented adversary groups and campaigns to observed behaviors where evidence exists.
Software
Relate tools and malware to techniques they have been observed using.
Why MITRE ATT&CK matters
- ATT&CK gives security teams a common vocabulary for describing adversary behavior.
- Detection engineers can organize rules by the behaviors they are intended to detect.
- Threat intelligence can be translated into concrete analytics and telemetry requirements.
- Coverage mapping can expose techniques where data, detections, validation, or response workflows are missing.
- Purple-team and adversary-emulation exercises can test whether mapped detections work in practice.
- ATT&CK mapping should not be treated as proof of coverage without technical validation.
How MITRE ATT&CK works
Define the threat scenario
Identify the adversary behavior, incident lesson, intelligence report, or security use case.
Map the behavior
Associate the activity with the relevant tactic, technique, or sub-technique based on evidence.
Identify required telemetry
Determine which data sources and fields can observe the behavior.
Develop detection logic
Create queries, correlations, sequences, or other analytics that use the available evidence.
Test and tune
Validate the detection against representative activity and expected benign patterns.
Measure coverage
Track validated coverage, data dependencies, detection gaps, and response readiness.
ATT&CK concepts detection teams should understand
Tactic
The adversary objective or reason for an action.
Technique
The behavior used to achieve a tactical objective.
Sub-technique
A more specific form of a broader technique.
Procedure
A real-world implementation or observed example of a technique.
Mapping
Connecting detections, incidents, threats, or controls to ATT&CK behavior.
Coverage
The degree to which telemetry and validated detections address relevant ATT&CK behaviors.
Common MITRE ATT&CK use cases
Detection engineering
Organize analytics by threat behavior and identify required telemetry.
Threat intelligence
Translate reports and campaigns into behaviors defenders can monitor.
Incident response
Describe observed adversary actions consistently during investigation.
Purple teaming
Test whether detections identify emulated adversary techniques.
Gap analysis
Find relevant tactics or techniques without sufficient telemetry or validated detections.
Use case development
Build security use cases from threat behavior through data, detection, triage, and response.
MITRE ATT&CK vs Tactic vs Technique
| Concept | Primary meaning | Example role |
|---|---|---|
| MITRE ATT&CK | The broader knowledge base and behavior model. | Organize adversary behavior and defensive coverage. |
| Tactic | Why an adversary performs an action. | A tactical objective groups related techniques. |
| Technique | How an adversary carries out behavior to achieve an objective. | A detection can be mapped to the specific behavior it is designed to identify. |
Key technical considerations
Map based on evidence
Avoid attaching techniques to alerts only because the label seems plausible.
Track data dependencies
A mapped technique needs telemetry capable of observing the behavior.
Validate coverage
A rule existing in a repository does not prove that it works against current data.
Track ATT&CK updates
Technique definitions and mappings evolve, so internal content should be reviewed over time.
Allow multiple mappings
One detection or incident can involve several techniques when the evidence supports them.
Connect response
Coverage is more operationally useful when triage and response steps are also defined.
Benefits and common problems
Benefits
- Common language for adversary behavior.
- Structured detection and use-case planning.
- Better threat-intelligence translation.
- Clearer coverage and gap analysis.
- Useful framework for purple-team validation.
Common problems
- ATT&CK treated as a compliance checklist.
- Mappings created without evidence.
- Coverage claimed because a rule exists but telemetry is missing.
- Technique tags become stale after detection changes.
- Teams track mapping but not response readiness.
How ForshTec helps with MITRE ATT&CK
ForshTec helps security teams map threat behavior to telemetry, detection logic, validation, coverage metrics, and operational workflows rather than stopping at technique labels.
- ATT&CK mapping and coverage analysis
- Detection engineering
- Telemetry and data-source mapping
- Use-case development
- Detection-gap identification
- Purple-team validation and tuning
Need ATT&CK mapping tied to real telemetry and tested detections?
ForshTec can connect threat behaviors to data sources, detection logic, coverage evidence, and SecOps workflows.
Talk to ForshTecFAQs
What is MITRE ATT&CK?
MITRE ATT&CK is a knowledge base of adversary tactics, techniques, and procedures used to model threats and evaluate security coverage.
What is the difference between a tactic and a technique?
A tactic represents why an adversary is acting, while a technique represents how the adversary performs an action to achieve that objective.
What is a sub-technique?
A sub-technique is a more specific description of behavior under a broader ATT&CK technique.
How is ATT&CK used in detection engineering?
Teams map threat behavior to required telemetry, build detections, validate them, and measure which relevant techniques have meaningful coverage.
Does mapping a detection to ATT&CK prove coverage?
No. Coverage should be supported by available telemetry, working detection logic, validation, and an operational response process.
How is ATT&CK used with threat intelligence?
Threat reports can be mapped to tactics and techniques so defenders can identify relevant data sources, detections, hunts, and gaps.