The MITRE ATT&CK framework is a publicly available knowledge base that describes how cyber adversaries operate, based on observations of real attacks. The framework focuses on what attackers want to achieve and how they pursue those goals. It helps organizations connect individual security events to a broader understanding of an attack.
Core components of the MITRE ATT&CK framework
The framework organizes adversary behavior into several related concepts:
- Tactics describe an attacker’s objectives, such as gaining initial access, stealing credentials, or moving between systems.
- Techniques describe the methods used to achieve those objectives. For example, phishing can help an attacker gain initial access.
- Sub-techniques describe more specific variations of a technique, such as spearphishing attachments.
- Procedures document how particular threat actors or tools have used a technique in real attacks.
These behaviors are organized into matrices across three domains:
Industrial Control Systems (ICS), covering systems used to control industrial processes.
Enterprise, covering corporate IT environments and cloud systems
Mobile, covering Android and iOS devices
Why is the MITRE ATT&CK framework important?
The MITRE ATT&CK framework enables organizations to understand cyber attackers from the inside out. The framework covers various adversary behaviors, based on real-world observations of malicious activities.
The MITRE ATT&CK framework can help you build more resilient security systems, improve detection and response strategies, and ensure your organization can handle modern cyber threats.
For practical examples and guidance on applying the framework within your organization, explore our comprehensive guide to MITRE ATT&CK tactics and techniques.
We also offer you to book a demo of Syteca and see for yourself how it can complement the framework and enhance your security. Syteca is an Inside Security Platform that helps organizations control access, monitor sessions, control endpoint health, and respond to threats within their IT environment.
Want to try Syteca? Request access
to the online demo!
See why clients from 70+ countries already use Syteca.