MITRE ATT&CK

The taxonomy nearly every detection claim in this spoke is written in. MITRE‘s own definition: “ATT&CK is a knowledge base of cyber adversary behavior and taxonomy for adversarial actions across their lifecycle.” It began in 2013 out of internal research and is now the common vocabulary vendors, SOCs and government advisories all describe threats in.

Tier: T1 — first-party documentation of the framework by the organization that maintains it.

The hierarchy

Four levels, and the distinctions matter because the paper below turns on them:

• Tactics — the why. “The adversary’s tactical goal: the reason for performing an action.” Fourteen of them in the Enterprise matrix, replacing the older kill-chain phases.
• Techniques — the how. The method used to reach that goal.
• Sub-techniques — the same behaviour described at finer grain.
• Procedures — specific implementations actually observed in the wild.

Three matrices: Enterprise (Windows, macOS, Linux, network devices, containers, cloud — IaaS/SaaS/Office/identity providers), Mobile (Android, iOS), and ICS. Content comes from “publicly available threat intelligence and incident reporting” and is revised bi-annually. Intended uses, per MITRE: security operations, threat intelligence, and security architecture.

Why it changed the practice

Before ATT&CK, a detection either fired or it didn’t, and comparing two products meant comparing marketing. ATT&CK gives an alert an address in a shared space, so a SOC (security-operations-center) can talk about what it can and cannot see, and a SOAR playbook can be written against a behaviour rather than a signature. It is the missing definition behind soc-fast-slow-thinking‘s triage tiers and behind every “coverage” claim in the spoke.

The catch, and it is a serious one

Because a technique has an ID, technique coverage became a security metric — the count of ATT&CK techniques your tooling has a rule for. endpoint-detection-attack-coverage (USENIX Security 2024) tested that metric and found it does not carry the weight put on it: commercial rulesets cover 48–55% of techniques, that drops to 25–26% once low- and medium-risk rules are excluded, 53 techniques (27.7%) are implemented by nobody and mostly cannot be, and two products covering the same technique frequently are not detecting the same threat.

Read ATT&CK as what its own FAQ says it is — a taxonomy of behaviour. It was not built as a scorecard, and this spoke should not use it as one. That is the same failure mode security-benchmark records for compliance scores: a number that describes the programme rather than the security.