MITRE ATT&CK Framework: 15 Tactics, Techniques, and How to Use Them for Insider Threat Detection [2026]

Each year, cyberattacks and data breaches are becoming more devastating for organizations. According to IBM’s 2026 Cost of a Data Breach Report, the global average cost of a data breach is $4.99 million. However, security teams are often not ready to detect all security gaps in their organizations. The scope of their monitoring capabilities is usually so broad that it’s challenging to anticipate where a potential threat might come from.

Identifying security gaps is easier if your security team understands the logic of threat actors. The MITRE ATT&CK framework helps teams translate attacker behavior into specific questions: Which actions should we detect? What evidence do we need? Where can we interrupt the attack? 

This guide explains how to apply the MITRE ATT&CK framework to detect and mitigate adversarial behavior. 

Key takeaways

• MITRE ATT&CK connects attacker goals to specific behaviors, helping teams prioritize defense mechanisms, investigate incidents, and test security controls.
• Three main matrices cover different environments: enterprise, mobile, and industrial control systems.
• ATT&CK tactics describe attacker goals, whereas techniques and sub-techniques explain how attackers achieve them.
• Syteca can help you turn ATT&CK insights into stronger defenses through privileged access management, password protection, session monitoring, threat response, and endpoint risk checks.

What is MITRE ATT&CK in cybersecurity?

MITRE ATT&CK is a publicly available knowledge base of adversary tactics and techniques based on real-world observations. It gives security teams a common language for describing attacks and improving threat modeling, detection, and mitigation. 

Initially, MITRE designed this framework to structure adversarial behavior for conducting penetration testing. But nowadays, you can use ATT&CK to advance cyber threat models, help security officers better understand attackers’ actions, and ensure timely incident detection and mitigation.

In particular, the MITRE framework enables you to look beyond traditional cyber threat indicators of compromise and employ behavioral detection analytics.

The MITRE ATT&CK model arranges adversarial behavior into matrices to show how tactics and techniques used by attackers are related, and the ways you can effectively mitigate attacks.

As of today, MITRE offers three collections of matrices:

• ATT&CK for Enterprise contains data on adversarial tactics and techniques malicious actors use for Windows, Linux, macOS, and other desktop operating systems.
• ATT&CK for Mobile compiles exploit knowledge for iOS and Android.
• ATT&CK for Industrial Control Systems (ICS) includes information about malicious actions within ICS networks.

Each MITRE ATT&CK matrix includes a set of tactics and techniques that attackers may use to achieve their malicious goals at a particular stage of an attack. Tactics describe what a perpetrator is trying to achieve, while techniques explain how they accomplish their goals. Each tactic includes a range of techniques that an attacker can use. These techniques, in turn, can contain several sub-techniques.

All information on techniques is structured in the following way:

• The procedure examples section lists malicious software often used to carry out the particular technique.
• The mitigation section provides advice on actions you should take to prevent the execution of certain techniques.
• The detection section suggests what kind of processes should be monitored in order to detect this technique.
• The references section provides links to additional resources for deeper analysis.

15 MITRE ATT&CK tactics and example techniques

MITRE ATT&CK techniques describe the methods attackers use to achieve specific goals. Enterprise v20, released October 13, 2026, includes 15 tactics, 227 techniques, and 479 sub-techniques.

The table below shows how to identify which actions to monitor, where to restrict access, and what evidence your team needs to investigate suspicious activity.

Tactic and goal	Example technique or sub-technique	Detection starting point
Reconnaissance: Research a target	T1595 Active Scanning	Use network and application security tools to identify repeated attempts to probe your systems.
Resource development: Prepare attack resources	T1583 Acquire Infrastructure	Utilize threat intelligence to identify infrastructure associated with attackers.
Initial access: Enter the environment	T1078 Valid Accounts	Require additional authentication and approval for sensitive access. Limit connections to approved systems and time windows, then monitor user activity after login.
Execution: Run code or instructions	T1059.001 PowerShell	Review recorded commands and application activity. Configure alerts for suspicious commands, and use endpoint and script logs for investigation.
Persistence: Retain access	T1098 Account Manipulation	Investigate unapproved account or permission changes. Compare identity verification system logs with session recordings to establish who made a change and whether it was authorized.
Privilege escalation: Gain higher permissions	T1548.002 Bypass User Account Control (UAC)	Remove unnecessary administrator rights and limit elevation to approved applications. Review elevation decisions and session activity; use endpoint logs to investigate suspected UAC bypasses.
Stealth: Conceal activity	T1036 Masquerading	Check applications that appear legitimate but run from unauthorized locations.
Defense impairment: Weaken defenses	T1685 Disable or Modify Tools	Check endpoint security settings and investigate unauthorized changes. Review session activity and security-tool logs for attempts to stop protection services or change their configuration.
Credential access: Obtain authentication secrets	T1003 OS Credential Dumping	Restrict administrator rights and investigate suspicious commands or tools in recorded sessions.
Discovery: Understand the environment	T1087 Account Discovery	Review commands used to list accounts and groups. Check whether the activity matches the user’s role and an approved administrative task.
Lateral movement: Reach other systems	T1021.001 Remote Desktop Protocol	Limit remote access to approved endpoints and time windows. Review remote sessions alongside authentication logs to investigate unexpected connections between systems.
Collection: Gather target data	T1005 Data from Local System	Check session recordings for suspicious file collection or copying. Use file-access logs to confirm what data was accessed and whether the activity was authorized.
Command and control: Communicate with compromised systems	T1071.001 Web Protocols	Use network security tools to investigate suspicious connections. Session recordings can provide context about related applications or commands.
Exfiltration: Move data out	T1567.002 Exfiltration to Cloud Storage	Review upload activity and visits to unapproved cloud services. Configure alerts for relevant session activity.
Impact: Disrupt operations or damage data	T1486 Data Encrypted for Impact	Use endpoint security tools to detect widespread file encryption. Session evidence can help identify related user actions, while configured response rules can block user access or terminate suspicious processes.

Start with the behaviors most relevant to your critical systems and users. For example, Verizon’s 2026 DBIR identifies vulnerability exploitation as the leading initial access vector, at 31% in its reporting dataset. This reinforces the need to address exploitable weaknesses alongside access controls and session monitoring.

MITRE ATT&CK use cases

The most useful MITRE ATT&CK use cases connect attacker behavior to a security decision. MITRE ATT&CK helps your team decide which activities to monitor, where to strengthen access controls, and how to use MITRE ATT&CK along with relevant tools to respond to suspicious behavior.

Threat modeling

Start with your most sensitive systems and consider how someone could misuse their access. 

• Could an attacker use stolen credentials to access a critical system?
• Could someone use a shared account to hide their identity?
• Could an unidentified, poorly secured admin account provide access to other systems?
• Could a user disable security tools or delete logs to conceal their actions? 

Use ATT&CK to describe these potential actions, then identify the controls needed to address them. For example, a privileged access management (PAM) solution can limit vendor access to approved systems and time windows, while a password manager can provide access without revealing credentials to reduce unnecessary exposure. Session monitoring solutions let your team review what happens after access is granted.

Detection gap analysis

Check whether your team can recognize and investigate the suspicious activities identified in your threat scenarios. For example, if a user runs an unapproved administrative command, will your team receive an alert? Or can an analyst find the relevant session and see what happened?

Review your monitoring settings, alert rules, and response actions against the selected MITRE ATT&CK techniques. Confirm that the required activity is recorded, the alert reaches the right people, and the automated response works as intended. You can also document the results in MITRE ATT&CK Navigator to visualize which techniques your team can detect and where monitoring or alerting gaps need attention.

Incident response

Use MITRE ATT&CK mapping to guide your investigation when you detect suspicious activity. An unexpected administrative command, for example, may indicate privilege escalation, attempts to disable security tools, or unauthorized access to sensitive data.

If suspicious activity is detected, open the session and review its recording. Search through session activity to identify the applications, commands, and websites involved. Compare this evidence with access approvals and other security logs to understand whether the activity was legitimate.

Based on your findings, you can then stop a malicious process. Preserve the session evidence to document what happened, support further investigation, and improve the controls that enabled the risky activity.

Red teaming

Use ATT&CK techniques to plan tests of your access policies, monitoring, endpoint vulnerabilities, and threat response effectiveness. For example, you may test whether a vendor can connect outside an approved access window, whether an unapproved application can run with elevated rights, or whether a specific command triggers a corresponding alert.

Your testers and security team should review the results together, adjust access policies or alert rules, and repeat the test to confirm that the changes actually work.

Applying the ATT&CK matrix for insider threat detection

MITRE ATT&CK can help your team recognize malicious activity even when the person behind it already has legitimate access. By mapping insider threat indicators to ATT&CK techniques, you can identify what to monitor, where to restrict permissions, and when to intervene.

Consider an employee who intends to steal confidential documents. Depending on their existing permissions, they might attempt to gain additional privileges, collect files from their workstation, and upload them to personal cloud storage. Your team can use ATT&CK to analyze each action:

These actions do not necessarily have to follow this exact sequence. An employee may already have sufficient permissions to access sensitive files, so the incident could begin with the collection. Legitimate work can also resemble individual ATT&CK techniques, so you should evaluate activity against the user’s role, assigned tasks, access approvals, and other context to develop response scenarios relevant to your case. 

Understanding attacker behavior is the first step. The next is putting controls in place to restrict access, detect misuse, and respond before an incident escalates.

Countering ATT&CK-defined malicious tactics with Syteca 

Syteca is an Inside Security Platform that helps you secure privileged access, monitor critical sessions, respond to threats, and reduce endpoint exposure. Syteca offers the following functionalities to put the MITRE ATT&CK insights into practice:

Syteca is built on a modular architecture, so you can choose only the functionality you need based on your highest-priority ATT&CK scenarios. As your security needs evolve, you can add more products and manage them through a single management console. 

Turn ATT&CK insights into stronger defenses 

Understanding attacker behavior is the first step in effective threat prevention. Use the MITRE ATT&CK framework to identify the techniques that matter to your organization, find gaps in your defenses, and test whether your team can detect and respond to suspicious activity.

Syteca helps you put MITRE ATT&CK mitigation actions into practice. Control access and privileges, protect credentials, investigate what happens during sessions, and address endpoint weaknesses with one Inside Security Platform.

FAQ