MITRE ATT&CK

ATT&CK’s value is not the taxonomy, it is that offense and defense can finally use the same words. A finding described as “we moved laterally” and a detection described as “we watch for lateral movement” could never be checked against each other. Mapped to T1021, they can.

That shared vocabulary is what makes purple teaming possible — running the offensive technique and checking the defensive response in one exercise — which is the whole reason this sits in the offensive pillar rather than the defensive one.

Verify technique IDs against current ATT&CK

The matrix is revised regularly — techniques are added, split, renumbered and deprecated. Treat any ID in a reference, including this page, as needing confirmation against the current version before it goes in a report or a detection.

Structure

Three levels, and using them at the right altitude is most of the skill:

• Tactics — the why: the adversary’s goal at a stage (Initial Access, Persistence, Exfiltration). The columns of the matrix.
• Techniques — the how: a way to achieve a tactic (Phishing, Valid Accounts).
• Sub-techniques — the specific how: spearphishing attachment vs. link.

The common error is reasoning at the wrong level. “We detect T1078 (Valid Accounts)” is nearly meaningless — it spans four sub-techniques across cloud, domain, local and default accounts, and detecting one is not detecting the technique. Precision about altitude is precision about coverage.

Separate matrices exist for Enterprise, Cloud, Containers, Mobile and ICS. Use the one that matches the environment — the cloud matrix, not the enterprise one, for a cloud engagement.

Mapping findings for handoff

Mapping engagement activity to ATT&CK is what converts a report from a list of what you did into a coverage question the defenders can act on. Each technique used becomes a testable claim: did anything detect this?

Map at the sub-technique level where you can, record the specific procedure — the exact command or method — and be honest about techniques you used but didn’t map. A report mapped to ATT&CK hands the blue team a prioritised list of exactly what to check, which is worth far more than a PDF they file.

Navigator, and its trap

ATT&CK Navigator colours the matrix to show coverage, and it is the most over-read artefact in security. A green cell nearly always means “a rule exists” and gets read as “we detect this”.

The distinctions it hides — all of which detection quality turns on:

• Rule exists vs. rule is tested
• Detects one procedure vs. detects the technique
• Fires everywhere vs. only where the agent runs
• Alerts vs. alerts usefully

Use at least three states — untested, tested, validated by emulation — and never let a sub-technique detection colour its parent green. A matrix that is all green usually means the mapping is optimistic, not that the coverage is complete.

Purple teaming — the loop that keeps it honest

The point of the shared language. Purple teaming runs the offensive technique and checks the defensive response in one exercise, closing the gap between “we have a rule” and “the rule fired”.

• Atomic Red Team — a library of small, precise tests, one per technique. The unit-test layer: execute the atomic, check the alert. Cheap, repeatable, ideal for CI-style validation.
• Caldera — automated adversary emulation, chaining techniques into sequences. Closer to a real intrusion than isolated atomics.
• A full red team engagement — the integration test: the whole path under realistic constraints.

Each round produces the same verdict per technique — detected, detected late, not detected — and each not-detected is either a detection gap or a broken rule. That verdict feeds detection engineering’s backlog, and the fix gets re-tested next round. It is the same circuit as the incident-to-detection loop, run deliberately instead of after a breach.

The failure mode: running emulation and filing the results without closing anything. An emulation that finds a gap and changes nothing is the purple team version of a pentest report nobody reads.

D3FEND and mitigation mapping

D3FEND is ATT&CK’s defensive counterpart — a taxonomy of countermeasures, mapped to the techniques they address. Where ATT&CK maps coverage of detection, D3FEND helps reason about mitigation: for a technique you can’t reliably detect, what would prevent or harden against it. It is younger and less complete than ATT&CK, but the framing — pairing every offensive technique with detection and mitigation options — is the right one for turning an engagement into durable defensive change rather than a one-time score.

Where this connects

ATT&CK is the vocabulary shared with detection engineering, where the purple team verdicts land as backlog. It structures the threat-informed targeting that decides what to emulate. And it is the measurement framework a red team engagement reports against.