TechKnowSurge

VideoSecurityFree

MITRE ATT&CK

MITRE ATT&CK is a publicly available framework that catalogs the tactics, techniques, and sub-techniques used by real-world adversaries, organized across enterprise, mobile, and industrial control system environments. Security professionals use it to understand attacker behavior, identify defensive gaps, and investigate known threat groups.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

MITRE ATT&CK is a comprehensive, publicly available knowledge base that documents the tactics, techniques, and sub-techniques employed by real-world adversaries. Maintained by MITRE, a nonprofit organization focused on national security and public interest research, the framework serves as a structured reference for understanding how attacks are planned and executed across different technology environments. Three distinct matrices cover enterprise systems, mobile platforms, and industrial control systems, each reflecting the unique threat landscape of that environment. The framework organizes adversary behavior into two primary layers. Tactics represent the high-level objectives an attacker pursues, such as reconnaissance, initial access, privilege escalation, or credential access. Beneath each tactic sit techniques and sub-techniques that describe the specific methods used to achieve those objectives. A key characteristic of the framework is that a single technique can appear under multiple tactics, reflecting the reality that the same action, such as an adversary-in-the-middle attack, may serve different purposes depending on the attacker's goal. Beyond the matrix itself, MITRE ATT&CK includes detailed profiles for known threat groups, including nation-state actors, linking each group to the techniques they have used in documented campaigns. Every technique entry provides procedural examples drawn from real incidents, recommended mitigations, and detection guidance, giving security teams actionable intelligence for hardening their environments and identifying malicious activity on their networks.

What you'll learn

Describe the structure of the MITRE ATT&CK framework, including the relationship between matrices, tactics, techniques, and sub-techniques
Explain how security professionals can use the MITRE ATT&CK framework to research adversary groups, identify attack procedures, and inform detection and mitigation strategies

What's covered

MITRE ATT&CK Framework

What is MITRE ATT&CK
- MITRE Organization
  - Non-profit, public interest
  - Advances national security
- ATT&CK Defined
  - Adversarial Tactics Techniques Knowledge
  - Database or framework
Available Matrices
- Enterprise Matrix
  - Primary focus area
- Mobile Matrix
- ICS Matrix
  - Industrial Control Systems
Tactics and Techniques
- Tactics Across Matrix Top
  - Reconnaissance, Initial Access
  - Persistence, Privilege Escalation
- Techniques Per Tactic
  - e.g. Active Scanning
  - Sub-techniques available
- Technique Spans Multiple Tactics
  - Adversary-in-the-Middle example
Navigating the Database
- Matrix View Options
  - Flat vs. side view
  - Show or hide sub-techniques
- Technique Detail Pages
  - Procedures, mitigations, detection
  - References and IDs
- CTI Groups Section
  - Adversary group profiles
  - e.g. Ember Bear, nation-state

Key terms

Threat Actor: An individual or group responsible for a security incident or attack.
Threat Intelligence: Information about existing or emerging threats that helps organizations make informed security decisions.
Privilege Escalation: An attack that exploits vulnerabilities to gain higher-level access than originally authorized.
MITRE ATT&CK: A globally accessible knowledge base that categorizes adversary tactics and techniques based on real-world observations, used to understand and defend against cyber threats.
Tactic: In the MITRE ATT&CK framework, a high-level objective or goal an adversary seeks to achieve during an attack, such as reconnaissance or privilege escalation.
Technique: In the MITRE ATT&CK framework, a specific method an adversary uses to accomplish a tactic.
Sub-technique: A more granular variation of a MITRE ATT&CK technique that describes a specific implementation or method used to carry out that technique.
Adversary Group: A tracked threat actor collective, such as a nation-state or criminal organization, whose known tactics, techniques, and procedures are documented in the MITRE ATT&CK framework.

Topics

Mitre Attack Threat Intelligence Tactics Techniques Procedures Adversary Behavior Cybersecurity Threat Hunting

Transcript

What MITRE ATT&CK Is

One of the amazing tools that you can use to really understand how an attack is carried out is MITRE ATT&CK. MITRE ATT&CK essentially is a database of tactics and techniques.

So what is MITRE ATT&CK? Well, MITRE is just an organization that puts this together for us. ATT&CK stands for adversary tactics, techniques, and common knowledge. I like to essentially just think of it as a database.

Here I'm on the mitre.org website, where we can get a glimpse into what this MITRE organization is. Right from the get-go, we can see "Mission First, People Always." If we read a little bit further, it's a not-for-profit organization. MITRE acts as a p in the public interest by delivering objective, cost-effective solutions to many of the world's biggest challenges. So you can see that it's an organization that's really here to help us out. If we jump on to the Who We Are page, we can see a little bit more about them, and they were established to advance national security. One of the many things that they deliver is this ATT&CK essentially database. Some people call it a framework, so this is the MITRE ATT&CK framework or database right here.

The Matrices

Let's take a look at the different aspects of this page and what we can see through this matrix down here. The first thing that I want to point out is this is not their only matrix that they have here. In fact, we can go to the menu up here at the top, and this is a menu where we can shuffle through a lot of this information.

We see the different matrices. So we have the enterprise matrix, we have the mobile matrix, and the ICS matrix, which is industrial control systems. If I click on the mobile, notice that it will change here, and we have a different set of tactics and a different set of techniques. I can also go to the industrial control systems, and once again the matrix changes to show us — it's very similar, there's a lot of similarities between these, but there are differences with it. The main one that we're going to be taking a look at is the enterprise matrix.

Tactics, Techniques and Sub-techniques

As for the matrix itself, we can see that the different tactics are across the top — the tactics that an adversary will use. So they'll go through the reconnaissance and do some discovery there. They do then resource development, initial access, execution, persistence, privilege escalation, defense. So these are the different tactics.

And then for the different tactics, there's techniques. There are 10 different techniques to carry out reconnaissance. Here we see active scanning, we see gather victim host information, gather victim identity information, we see gather victim network information, and so on and so forth. So we see the different techniques that they'll carry out to do this reconnaissance. And then with each one of these techniques, there can also be some sub-techniques. So we see quite a few techniques and quite a few different sub-techniques.

Across the top here we see a few things that we can manipulate this matrix with. We can see a little different view here: the flat view versus the side view. The flat view just puts the subcategories underneath rather than to the side, so that actually displays a little better on the screen, so we'll do that. I can also do show the sub-techniques, and if I click on that, then it's going to show all of the sub-techniques, so it's essentially showing all of this all at once. Or I can do the hide and hide them all at once.

Another way that I could view this is I could go into the top menu up here, and let's say I want to view the tactics for enterprise. Remember the tactics are across here: the reconnaissance, resource development, initial access. So I can come up here and view the enterprise tactics, and we see the same ones — reconnaissance, resource development, initial access — and for each one of these it gives a description.

Digging Into a Technique

Whether I'm back on the matrix or in here, I can click on each one of these tactics to dig a little deeper. So let me do that. Here's reconnaissance. It gives me a little more description about what reconnaissance is, and then the different techniques. Both the techniques and the sub-techniques give me a description of each of those, and then also an ID for that technique and the sub-techniques. So the sub-technique of scanning IP blocks would be T1595.001.

Let's dig a little deeper, and we see this scanning IP blocks. I can click on that and dig a little deeper into this. We see some procedure examples, mitigation, detection. So this allows us as security professionals to really understand what it is that could happen on our network. For instance, scanning IP blocks: procedures that past groups have used, such as Ember Bear. We'll get into groups here in a second. But mitigations that we can do on our network, and ways we can detect this type of attack, and then any references.

Of course, if I want to dig deeper and figure out what groups have used this — so these are adversary groups — I could click on Ember Bear, and then this would give me a description of Ember Bear, which is a Russian state-sponsored group. So this is a state-sponsored, or nation-state, group here that carries out attacks, and I can see different groups that are associated with them, different techniques they've used. So it's really a comprehensive database of all this information.

Not only can I click on it to get into here from the techniques, but across the top here I can see the tactics, the techniques, defenses, CTI — so this is the different groups that we can take a look at. So I have a bunch of resources here across the top that I can navigate to these areas as well.

A Technique Can Serve More Than One Tactic

Before we finish up, there was one more thing that I wanted to point out. What I'm going to do is go back to our matrix. We'll do the enterprise matrix. I just want to point out that let's say there's an adversary in the middle. I'm going to highlight the adversary in the middle, and we can see that adversary in the middle. I'm going to scroll over a little bit so we can have a better view of this. But we can see the adversary in the middle is a technique for credential access and a technique for collection. I can open these up and I can see the different sub-techniques, and we can see that those are the same as well.

The point I'm trying to make here is that a technique is not necessarily specific to any one tactic — a technique could actually apply to multiple tactics here. The reason why that's important is because maybe they're doing adversary in the middle to gain credential access, or maybe they're doing adversary in the middle for collection purposes. So there are different motivations, or different tactics once again, for carrying out these different techniques.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →