The MITRE ATT&CK matrix, made explorable.
ATT&CK is the shared language of attackers' behavior: what they do, in what order, and what a defender can see. The official site is a reference. This page is a place to learn it: every cell is clickable, every tactic answers a plain-English question, six real-world intrusions trace their path across the matrix and end by asking where you would have broken the chain, and a drill checks whether it stuck.
- 15
- tacticsthe attacker's goals, in columns
- 227
- techniquesthe ways each goal is reached
- 479
- sub-techniquesthe specific variants
How to read the matrix in ninety seconds
Columns are tactics: the why
Each of the 15 columns is a goal the attacker has at some stage: get in, run code, stay, escalate, hide, steal credentials, move, take. Read them left to right and you have the rough shape of an intrusion.
Cells are techniques: the how
The 227 cells are the ways a goal gets achieved. Phishing is a technique for Initial Access; PowerShell is a technique for Execution. Techniques that serve two goals appear in two columns.
Sub-techniques are the specifics
479 sub-techniques narrow a technique down: Phishing becomes Spearphishing Attachment, Spearphishing Link, Spearphishing via Service. Toggle them on when you want the detail, off when you want the shape.
One warning the exams love: the matrix is not a strict timeline. Attackers skip columns, loop back, and run discovery five times. It is a vocabulary, not a checklist. That is why it pairs so well with the Kill Chain, which is a sequence, and the Diamond Model, which is about relationships.
Enterprise matrix v20.0 · 15 tactics · 227 techniques · 479 sub-techniques
The eight words that make ATT&CK make sense
Exam questions often turn on the difference between two of these. Tactic versus technique is the classic; procedure versus technique is the one that separates a pass from a strong pass.
- Tactic
- The attacker's goal at a stage of the intrusion, the why. The fifteen columns. Example: Credential Access.
- Technique
- How the goal is reached, in general terms. The cells. Example: OS Credential Dumping (T1003).
- Sub-technique
- A more specific way of doing a technique. Example: LSASS Memory (T1003.001).
- Procedure
- The exact implementation a real group used, such as the specific tool and command. ATT&CK records these as examples under each technique.
- Mitigation
- A defensive measure that prevents or reduces a technique, with its own M-number. Example: Credential Guard, privileged account management.
- Detection strategy
- What to monitor and how to analyze it to notice a technique in progress. Recent ATT&CK versions replaced the old data source notes with these.
- Group
- A named intrusion set (APT29, FIN7) tracked by the community, with the techniques it has been observed using.
- Software
- Malware and legitimate tools (Mimikatz, Cobalt Strike, PsExec) tracked with the techniques they implement.
Where ATT&CK shows up on your certification
Not sure you're ready to buy? Security+ Domain 1 is free, all 82 pages →
Go deeper
- From the blogMITRE ATT&CK v20: what is new, and what it means for your exam
- From the blogKill Chain, Diamond Model, ATT&CK: three maps of the same attack
- From the blogThreat intelligence, the Pyramid of Pain, and hypothesis-driven hunting
- From the blogMITRE ATLAS: the ATT&CK-style matrix for AI systems
- From the blogContainment, eradication and recovery, technique by technique
- From the blogNetwork, application and password attacks and their indicators
Know the framework. Now find out if you know the exam.
Ten exam-style questions scored by domain, so you learn which one is costing you marks before you buy anything.
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. Matrix content © The MITRE Corporation, Enterprise ATT&CK v20.0, reproduced from the official STIX data under the ATT&CK terms of use. Descriptions are abridged; the tactic explanations, attack stories, exam notes and drill are Skillthropic's own. Skillthropic is not affiliated with or endorsed by MITRE.