Cybersecurity definition
What is MITRE ATT&CK?
MITRE ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge.
By Cyber Tool Stack Editorial TeamUpdated
Definition
A free, continuously updated knowledge base, maintained by the MITRE Corporation, that catalogs real-world attacker behavior as a matrix of tactics (the attacker's goal, like lateral movement) and techniques (how it's done), giving defenders a shared vocabulary for describing and detecting threats.
Where MITRE ATT&CK fits in the security landscape
These beginner lessons use this term while explaining the surrounding security control.
Related cybersecurity terms
TTPTactics, Techniques, and ProceduresThe way security teams describe attacker behavior at three levels of detail — the high-level goal (tactic), the general method (technique), and the specific implementation (procedure) — most commonly organized using the MITRE ATT&CK framework.IOCIndicator of CompromiseForensic evidence that a system has already been breached — a malicious file hash, a known-bad IP address, a suspicious registry key — used to detect or confirm past or ongoing compromise.Threat HuntingThe practice of proactively searching historical activity data for signs of a compromise that never triggered an automatic alert.Purple TeamA collaborative security exercise where offensive (red team) and defensive (blue team) staff work together in real time, comparing what attacks were attempted against what defenses actually caught, to close detection gaps faster than either working alone.