Skip to content
WorakornKoonawootrittriron
Back to blog
Network security

How to read MITRE ATT&CK without treating it as a checklist

What MITRE ATT&CK is, how tactics, techniques and procedures fit, how to read a technique page, and how to use Navigator layers without chasing 100%.

Beginner9 min read

On this page
  1. What ATT&CK is
  2. Reading the legend: tactics, techniques, procedures
  3. Reading one technique page, top to bottom
  4. Colouring the map with the Navigator
  5. D3FEND: the defender's companion map
  6. Three practical ways to use it
  7. Where to start

Sooner or later every alert, vendor report and threat brief you read carries a strange little code like T1566.001. It looks like a part number. It is actually a grid reference on a map, and once you can read that map, a lot of security writing suddenly gets easier to follow.

This post is my beginner's guide to that map: MITRE ATT&CK. I'll go through what it is, how its pieces fit, how to read one page from top to bottom, and how defenders actually use it. I'll also cover the one mistake that's easy to make with it: treating it like a checklist.

What ATT&CK is

MITRE describes ATT&CK as a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. In other words, it isn't a list of everything an attacker could do. It records what attackers have been seen doing, drawn largely from publicly reported incidents, and MITRE's own design paper says it is not an exhaustive enumeration of attack vectors. It is free for anyone to use, subject to its terms of use.

It started as an internal research tool. MITRE's design and philosophy paper says the first model was created in September 2013, focused on Windows enterprise networks, and was released publicly in May 2015 with 96 techniques under 9 tactics. It has grown a lot since then. The current release, ATT&CK v20 (13 October 2026), lists 15 tactics, 227 techniques and 479 sub-techniques for Enterprise alone. There are also separate matrices for Mobile and for industrial control systems (ICS).

The map analogy works well here. A map doesn't tell you where to go. It shows you the ground, gives every place a name everyone agrees on, and lets two people talk about the same spot without confusion. ATT&CK does that for attacker behaviour.

Reading the legend: tactics, techniques, procedures

Every map has a legend. ATT&CK's legend has four levels, which are often shortened to "TTPs". CISA's Best Practices for MITRE ATT&CK Mapping and the ATT&CK FAQ define them like this:

Level Question it answers Example ID format
Tactic Why: the attacker's goal at that step Credential Access TA0006
Technique How they reach that goal OS Credential Dumping T1003
Sub-technique A more specific way of doing it LSASS Memory T1003.001
Procedure What a real group or tool actually did Recorded under "Procedure Examples" (none)

On the Enterprise matrix, tactics are the columns and techniques are the cells under them. Read across the top and you get the 15 tactics, from Reconnaissance on the left to Impact on the right.

An imaginary intrusion lighting up technique cells across the tactic columns. Every ID shown is a real ATT&CK technique.

Two things about this grid confuse newcomers, so I'll point them out early.

It's a map, not a route. CISA's guide says ATT&CK is not meant to be read as linear: attackers don't march left to right, and they don't need every tactic. An intruder can steal data and only then add more persistence, which means moving "backwards" across the columns.

One cell can appear in more than one column. A technique can serve several goals. Scheduled Task (T1053.005), for example, sits under Execution, Persistence and Privilege Escalation, because the same scheduled task can run code, survive a reboot, and run with higher rights.

The map gets redrawn

Like any good map, ATT&CK is revised. In v19 (28 April 2026), MITRE split the old Defense Evasion tactic into two: Stealth (hiding and blending in, which reuses Defense Evasion's old ID TA0005) and Defense Impairment (breaking security tools and pipelines, TA0112), according to the tactic list and Elastic's remapping guide. Your tools may not update on the same day. At the time of writing, Microsoft's documentation says Sentinel's MITRE page is aligned to ATT&CK version 18. So when someone shows you a mapping, it's worth asking which version of the map they used.

Reading one technique page, top to bottom

The best way to learn the map is to zoom in on one place. Let's open Spearphishing Attachment (T1566.001), a sub-technique of Phishing.

  1. The header. It gives the ID, the parent technique (T1566), the tactic (Initial Access, TA0001), the platforms (Linux, Windows, macOS), a version number and the date it was last modified. Check the date: pages change between releases.
  2. The description. It explains the behaviour in plain words: a targeted email with a malicious file attached, which usually depends on the user opening it.
  3. Procedure Examples. This is the "what actually happened" level. Each row is a real group, piece of software or campaign with a citation. For this page they include APT28 and APT29 sending spearphishing emails with malicious attachments.
  4. Mitigations. These are things that reduce the risk, each with an M ID: for example M1049 Antivirus/Antimalware, M1031 Network Intrusion Prevention, M1021 Restrict Web-Based Content and M1017 User Training.
  5. Detection. Newer pages describe detection as a detection strategy. Here it's DET0236, which contains one analytic per platform. The Windows analytic follows a chain: a suspicious email arrives, a file is written to disk, an Office application starts PowerShell or CMD, and then there's outbound network traffic. It names the data it needs (application logs, file creation, process creation, network connections, with Sysmon event codes 11, 1, 3 and 22 listed as sources). It also lists tunables such as the time window, so you can tune the analytic to your environment.
  6. References. These are the sources behind every claim on the page. When a mapping looks doubtful, this is where you check it.

This order is a good habit for any technique: what is it, who has really used it, how do I reduce it, how would I see it, and where does that knowledge come from.

Colouring the map with the Navigator

ATT&CK Navigator is MITRE's free web tool for colouring the matrix. You build layers, which its README calls custom views of the knowledge base. According to the usage guide, you can:

  • give techniques a score and colour them along a gradient you choose (the Navigator deliberately doesn't define what a score means: that's up to you);
  • add comments, colours and links to cells, and hide or disable techniques that don't apply;
  • combine layers with expressions such as a+b or (a+b)/2, for example to compare "what attackers we care about use" with "what we detect";
  • export a layer as JSON, Excel or SVG.

If your layer describes your own defences, the README recommends running the Navigator yourself rather than using the public copy, because the files can be sensitive.

A coverage layer filling in as detection rules are added. The map gets darker, but gaps stay, and some cells don't apply at all.

The trap: chasing 100%

A coloured matrix is satisfying to look at, and it tempts you to paint every cell. MITRE warns against this directly. Its design paper says that, in general, covering every ATT&CK technique is unrealistic, and that ATT&CK documents known behaviour and is "not intended to provide a checklist of things that need to all be addressed."

The paper gives two reasons that stuck with me:

  • Some behaviour is normal. Running ipconfig.exe falls under System Network Configuration Discovery, but people also run it often and legitimately, for example to troubleshoot a network connection. Alerting on every run would be excessive. Simply keeping a record of it may be enough.
  • A cell is not a single thing. One technique can have many procedures, and you can't know all of them in advance. Watching for ipconfig.exe doesn't cover the same discovery done through a PowerShell cmdlet.

So a green cell should mean "we can explain which procedures we see, and we've tested it", not "we bought a product that says this technique is covered". The paper puts it simply: anyone mapping to ATT&CK should be able to explain the procedures they cover.

D3FEND: the defender's companion map

ATT&CK describes the attacker. MITRE D3FEND describes the countermeasures. It is a knowledge graph of defensive techniques, funded by the US National Security Agency, organised under seven tactics: Model, Harden, Detect, Isolate, Deceive, Evict and Restore.

The part I find clever is how it links the two maps. In the D3FEND paper, attack and defence techniques are connected through digital artifacts: things like files, emails or network traffic that both sides touch. The attacker's technique produces an artifact, and a defensive technique acts on that same artifact.

For our example, D3FEND's page for T1566.001 links the technique to the artifacts it produces, one of which is an Email (the relations are in D3FEND's data for this technique). Many defences act on that email; three of them are Email Filtering (Isolate), which filters it, Sender Reputation Analysis (Detect), which analyzes it, and Email Removal (Evict), which deletes it.

D3FEND joins the two maps through a shared artifact: the attack produces an email, and each defence acts on that email.

One detail is a good reminder that the two maps were built for different jobs. ATT&CK lists User Training as a mitigation for spearphishing, but the D3FEND paper places awareness training out of scope, because it doesn't act directly on a digital artifact. Neither map is wrong. They answer different questions.

Three practical ways to use it

1. Tagging alerts

Most SIEMs let you attach techniques to a detection rule. In Microsoft Sentinel, for example, you pick MITRE techniques when you configure an analytics rule, and incidents created from that rule carry the same techniques. A tag like T1003.001 tells the next analyst what kind of behaviour this is before they read a single log line. CISA's guide adds some useful habits:

  • map to the most specific sub-technique the evidence supports;
  • don't infer a technique you can't see;
  • remember that one behaviour can map to several techniques at once (HTTP command-and-control on port 8088 is both Non-Standard Port and Web Protocols).

2. Planning detections

Start from the techniques that matter to you: the groups that target your sector, the platforms you run, the incidents you've had. Then open each technique page and work through its detection strategy. Do you collect the data it needs? Can you write and test the analytic? A Navigator layer of "relevant" combined with a layer of "detected" shows the gaps worth working on first.

3. Talking to management

The design paper lists gap assessments that help prioritise security investments as a core use. A coloured layer is a picture a non-specialist can read in seconds. Be honest about what the colours mean, though. "We have tested detections for these procedures" is a claim you can defend. "We cover most of ATT&CK" usually isn't.

Where to start

If ATT&CK is new to you, try this: pick one alert you saw this week, find its technique on the map, and read that page from header to references. Then ask the four questions the page is built around: why, how, who has done it, and how would we see it. After a few of these, the codes in reports stop looking like part numbers and start looking like places you've been.

Sources

Keep reading

Related posts

Back to blog