ConceptsMITRE ATT&CK Framework

MITRE ATT&CK Framework

A widely used knowledge base of adversary tactics, techniques, and procedures, organized into a matrix, that defenders use as a common language to describe attacks, plan detections, and assess coverage.

Glossary definition

31 direct links5 lessons

Concept Neighborhood

Explore this concept’s connections in the groups below.

PrerequisiteRelated

Start here

Threat-Based Identification

A related concept to explore, covered by 13 lessons.

Open concept →

Builds towardMITRE ATT&CK Framework is a foundation for these

ATT&CK Navigator

A free tool for working with the MITRE ATT&CK matrix visually, letting defenders annotate, color, and layer techniques to track detection coverage, map threat-actor behavior, or plan detection work.

lessons

Detection Development Cycle

The repeatable process of creating a detection from an attacker technique: research the behavior, write the detection logic, test it against the technique, validate coverage, document it, and deploy, often organized around the MITRE ATT&CK framework.

lessons

Relatedsorted by lesson coverage

Threat-Based IdentificationStart here

lessons

Detection Strategy

lessons

Tactical Intelligence

lessons

Threat to Detection

lessons

Detection Testing

lessons

Hypothesis Sources

lessons

Show 23 more connections

Related Lessons

5 lessons cover this concept

Use ATT&CK Without Overclaiming Coverage

SOC Analyst

From Hypothesis to Telemetry Contract

SOC Analyst

Build Endpoint Behavior Analytics

SOC Analyst

Correlate Identity, Remote Access, and Network Behavior

SOC Analyst

Engineer Rules, Tuning, and Response Contracts

SOC Analyst