Important things to know
Picture this: It’s your second week as a Tier 1 SOC analyst. An alert fires in the SIEM: a PowerShell script executed on a workstation in the finance department at 11:47 PM. Nobody from finance works that late. You open the alert, read the raw log, and confirm that yes, PowerShell did run. But then what?
You could close the ticket and write “suspicious PowerShell execution observed.” And technically, you’d be done. But you wouldn’t have told anyone anything useful. Why did it run? What was it doing? Was it downloading something? Was it part of a larger attack? Is this the beginning of something, or the middle of something that started days ago?
This is the exact moment where the MITRE ATT&CK framework stops being an abstract concept and starts being the most useful tool in your head. Because ATT&CK doesn’t just tell you that PowerShell execution is suspicious. It tells you that PowerShell execution maps to Technique T1059.001 (Command and Scripting Interpreter: PowerShell) under the Execution tactic. And if you know that, you also know what to look for next: did the script try to download a payload (Ingress Tool Transfer, T1105)? Did it attempt to access credentials (Credential Access)? Did it reach out to an external IP that could be a command-and-control server (Command and Control)?
Suddenly you’re not just looking at a single alert. You’re mapping an attack. You’re thinking like an analyst.
That shift in thinking, from reacting to individual alerts to understanding how attacks unfold, is what MITRE ATT&CK is actually about. And if you’re trying to break into cybersecurity or you’ve just started your first SOC role, understanding this framework is one of the highest-leverage things you can do.
Let’s break it down from the beginning. No jargon walls. No overwhelming matrices. Just a clear explanation of what it is, why it matters, and how to actually start using it.
What Is MITRE ATT&CK, Really?
MITRE ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge. It’s a free, publicly available knowledge base maintained by the MITRE Corporation, a non-profit that operates research centres funded by the U.S. government. In plain language: it’s a giant, structured catalogue of how real attackers actually break into systems, based on what’s been observed in real breaches and real intrusions. Not theory. Not hypothetical attack scenarios someone dreamed up in a lab. Real attacks, documented, categorised, and organised so defenders can study and prepare for them.
The framework was born in 2013 as an internal MITRE research project. The original goal was simple: document how attackers move laterally within a network after they’ve already gotten in. By 2015, MITRE made it public. By 2026, it has become the global standard for how the cybersecurity industry talks about attacker behaviour. Every major SOC, every serious threat intelligence team, and virtually every enterprise EDR and SIEM vendor builds their detection logic around ATT&CK technique IDs. When a security team publishes a report saying an attacker used “T1566.001 for initial access,” every analyst in the world who reads that report knows exactly what it means without needing a paragraph of explanation. That common language is one of the framework’s most powerful and most underappreciated contributions.
The Building Blocks: Tactics, Techniques, and Sub-Techniques
ATT&CK is built on three layers, and understanding them is simpler than most guides make it seem.
Tactics: The “Why”
Tactics represent the attacker’s goal at each stage. They answer the question: what is the attacker trying to accomplish? The Enterprise matrix currently contains 14 tactics. Think of them as columns in a spreadsheet. Each one represents a distinct objective an attacker pursues as they move through an attack. They are: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact.
Here’s what makes this important for you as a beginner: these 14 tactics give you a mental map of how attacks flow. An attacker doesn’t just “hack in.” They follow a sequence of objectives. They gain initial access. They execute code. They try to persist (survive a reboot or a password change). They escalate their privileges. They move laterally to other systems. They collect data. They exfiltrate it or cause damage.
Not every attack involves all 14 tactics. Some skip steps. Some loop back. Some achieve their goal after just three or four stages. But the mental model of “attackers pursue objectives in a sequence” is the foundation of how SOC analysts think about investigations.
Techniques: The “How”
Techniques describe the specific methods an attacker uses to achieve each tactic. They answer: how is the attacker accomplishing this objective? Under the Initial Access tactic, for example, you’ll find techniques like Phishing (T1566), Exploit Public-Facing Application (T1190), and Valid Accounts (T1078). Each of these is a different method an attacker might use to get their foot in the door.
The Enterprise matrix contains over 200 techniques. That number sounds intimidating, but here’s the reality: you don’t need to memorise them all. You need to understand the structure. Once you grasp that each tactic has a set of techniques beneath it, you can look up specific techniques as they come up in your work. The framework is a reference tool, not a memorisation exercise.
Sub-Techniques: The Granular Detail
Sub-techniques add another layer of specificity beneath techniques. They exist because some techniques are broad enough to encompass several distinct methods. Take Phishing (T1566). It has sub-techniques like Spearphishing Attachment (T1566.001), Spearphishing Link (T1566.002), and Spearphishing via Service (T1566.003). Each one is a meaningfully different attack vector that requires different detection logic.
The Enterprise matrix contains over 400 sub-techniques. Again, this is a reference library. You look things up when you need them. Nobody has all 400 in their head, and nobody needs to.
Seeing It in Action: A Real-World Attack Mapped to ATT&CK
The best way to understand ATT&CK is to see how a real attack maps to it. Let’s walk through a simplified but realistic scenario. An attacker wants to compromise a mid-sized company and steal sensitive financial data.
Here’s how it unfolds, with ATT&CK mappings at each step.
Step 1: Reconnaissance (Tactic: TA0043). The attacker scrapes LinkedIn and the company’s website to identify employees in the finance department. They find the CFO’s email address and the name of the company’s accounting software. This falls under Technique T1593 (Search Open Websites/Domains).
Step 2: Initial Access (Tactic: TA0001). The attacker sends a targeted phishing email to the CFO with a malicious Excel attachment disguised as an invoice from a known vendor. This maps to T1566.001 (Spearphishing Attachment).
Step 3: Execution (Tactic: TA0002). The CFO opens the Excel file and enables macros. The macro runs a PowerShell command that downloads additional malware. This maps to T1059.001 (Command and Scripting Interpreter: PowerShell).
Step 4: Persistence (Tactic: TA0003). The malware creates a scheduled task that re-executes itself every time the machine reboots. This maps to T1053.005 (Scheduled Task/Job: Scheduled Task). The attacker now survives a restart.
Step 5: Credential Access (Tactic: TA0006). The malware runs a tool that extracts stored passwords from the system’s memory. This maps to T1003.001 (OS Credential Dumping: LSASS Memory). Now the attacker has credentials for other accounts on the network.
Step 6: Lateral Movement (Tactic: TA0008). Using the stolen credentials, the attacker logs into the file server where financial reports are stored. This maps to T1021.001 (Remote Services: Remote Desktop Protocol). They’re no longer on just one machine. They’ve moved deeper into the network.
Step 7: Exfiltration (Tactic: TA0010). The attacker compresses the financial data and uploads it to a cloud storage service they control. This maps to T1567.002 (Exfiltration Over Web Service: Exfiltration to Cloud Storage).
That’s seven steps. Seven tactics. Seven techniques. Each one documented, catalogued, and mapped to detection guidance in the ATT&CK framework. When you understand this flow, you’re not just reacting to alerts. You’re tracing an attack through its lifecycle, and you know what to look for at each stage.
Why ATT&CK Matters for SOC Analysts
If you’re wondering why a beginner needs to care about a framework with 200+ techniques, the answer comes down to three things.
- It Gives Context to Alerts: Without ATT&CK, an alert is just an alert. “Suspicious PowerShell execution detected.” Okay, but what does that mean in the context of a broader attack?
With ATT&CK, that same alert maps to the Execution tactic, specifically T1059.001. And once you know the tactic, you know what might come before it (Initial Access, probably via phishing) and what might come after it (Persistence, Defense Evasion, or Credential Access). You’re no longer investigating a single event. You’re investigating a possible attack chain.
This is the difference between closing a ticket and actually doing analysis.
- It Helps You Communicate Precisely: Before ATT&CK, security teams often used different terminology to describe the same thing. One analyst might call something “password harvesting.” Another might call it “credential theft.” A third might write “the attacker stole login information.” All three are describing the same attack, but none of them are specific enough to be actionable.
ATT&CK solves this by giving every technique a unique ID. When your incident report says “the attacker used T1003.001 (OS Credential Dumping: LSASS Memory),” every analyst who reads it, on your team, at a partner organisation, or six months from now in a post-incident review, knows exactly what happened. That precision is worth more than it sounds, especially once you’re writing your own reports and need someone else to understand exactly what you found.
- It Exposes Detection Gaps: One of the most practical uses of ATT&CK is mapping your organisation’s detection coverage against the framework. When you lay out the 14 tactics and their techniques on a grid and highlight which ones you have detection rules for, the gaps become immediately visible.
If your SIEM has strong coverage for Initial Access and Execution but almost nothing for Lateral Movement or Defense Evasion, that tells you exactly where you’re blind. And in 2026, that blindness is more dangerous than ever. Research shows that 8 out of the top 10 most commonly used attacker techniques are now focused on staying hidden, specifically on Defense Evasion, Persistence, and stealthy Command and Control. Attackers are investing their effort in not being detected, which means your detection gaps are precisely where they’ll operate.
ATT&CK vs. the Cyber Kill Chain: What’s the Difference?
You’ll hear both of these mentioned in SOC work, and it’s worth understanding how they relate.
The Cyber Kill Chain, developed by Lockheed Martin in 2011, is a linear, seven-stage model of how attacks progress: Reconnaissance, Weaponisation, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. It’s a useful high-level mental model. But it assumes attacks follow a fixed sequence, which they often don’t.
ATT&CK takes a fundamentally different approach. Instead of a fixed sequence, it’s a matrix of 14 tactics and over 200 techniques that can occur in any order, repeat, or be skipped entirely. An attacker might establish Persistence before Privilege Escalation. They might achieve Impact without Exfiltration. Real attacks are messy and non-linear, and ATT&CK reflects that reality. Think of the Kill Chain as the story arc (attacks have a beginning, middle, and end). Think of ATT&CK as the playbook (here are the specific plays an attacker might run at any point). Most modern SOCs use ATT&CK for day-to-day detection engineering because its granularity (technique IDs, sub-techniques, documented procedures) makes it directly actionable. The Kill Chain remains useful for explaining attack concepts at a high level, especially to non-technical audiences.
