Innomerc Choose your depth. Learn at your own pace.
Understand it
MITRE ATT&CK is a knowledge base of observed adversary behavior. A tactic describes a goal; a technique describes a way of achieving it. Sub-techniques add detail. It gives teams a shared language for discussing activity across systems.
A technique can be used by many actors and can overlap with legitimate administration. The framework is not a fixed sequence that every attack must follow. Start with evidence and use the model to explain what the behavior may represent.
Under the hood
This release uses official Enterprise ATT&CK 19.2 data. The current tactic order and names come from the dataset, including Stealth and Defense Impairment. The explorer omits revoked and deprecated objects rather than presenting historical entries as current.
Relationships connect techniques with groups, software, mitigations and detection strategies. Strategies can point to analytics and data components. These relationships help identify investigation and implementation questions; they are not ready-made guarantees.
Practitioner perspective
For detection engineering, begin with the behavior and required telemetry. Confirm that your environment collects the fields an analytic needs, then test the logic against positive and benign cases. Mapping an alert to T1059 does not demonstrate coverage of every interpreter or platform.
For assessments and intelligence, distinguish an observed procedure from a broad technique label. Track version changes and preserve historical mappings in reports. ATT&CK helps structure analysis but does not assign business risk or establish actor attribution on its own.
Watch it work
A fictional, simplified model. Select a component to inspect it, or follow the steps in order.
Explore the system
Observation
A process starts an interpreter on a monitored host.
Read every step without animation
Evidence to framework
- Observation. A process starts an interpreter on a monitored host.
- Behavior. Determine what the interpreter did and why it matters.
- Technique. Compare the evidence with the applicable technique and sub-technique.
- Detection requirements. Inspect relevant analytics, telemetry and limitations.
- Validation. Test the detection with representative authorized activity.
The mapping connects evidence with a shared model.
Attack view
The fictional lesson uses interpreter execution as a behavior example. T1059 describes a family of activity; context determines whether a particular instance is malicious.
Defender view
- Use the official version and review changes before updating mappings.
- Validate collection and detection logic in your own environment.
- Treat technique mappings as analytical context, not proof of complete coverage.
Common mistakes
- ATT&CK is not a mandatory linear kill chain.
- One technique does not uniquely identify an actor.
Check your understanding
Active recall: explain this idea in 30 seconds
MITRE ATT&CK is a knowledge base of observed adversary behavior. A tactic describes a goal; a technique describes a way of achieving it. Sub-techniques add detail. It gives teams a shared language for discussing activity across systems.
Now give an example and name one limitation. Revisit the explanation if you get stuck.
Primary sources
Original explanations informed by these specifications and official resources. Source versions and lesson review are separate from product updates.
Content reviewed 2026-09-10. Framework reference: MITRE ATT&CK 19.2. Read the editorial policy.