MITRE ATT&CK Framework: Tactics, Techniques, and Procedures

Objective. Students will navigate the MITRE ATT&CK framework to look up at least five techniques for a given tactic and map them to a realistic threat scenario with documented evidence.

What Is the MITRE ATT&CK Framework?

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a publicly available knowledge base maintained by MITRE Corporation. It catalogs the real-world behaviors that threat actors use after they gain a foothold in a target environment. Security professionals worldwide rely on it for threat intelligence, detection engineering, red-team planning, and incident response. CompTIA CySA+ and Security+ both expect you to understand how the framework is structured and how analysts use it.

The framework is organized into three layers: tactics, techniques, and procedures — collectively called TTPs.

Tactics are the adversary's high-level goals during an intrusion, such as gaining initial access, maintaining persistence, or exfiltrating data. Think of them as the why.
Techniques describe how an adversary achieves a tactic. Each technique has a unique ID (e.g., T1566 — Phishing). There are also sub-techniques that add specificity (e.g., T1566.001 — Spearphishing Attachment).
Procedures are the concrete, real-world implementations of a technique by a specific threat actor or tool — the who does what exactly.

The ATT&CK Enterprise Matrix

The most commonly used version is the Enterprise matrix, which covers Windows, macOS, Linux, cloud, containers, and network infrastructure. It is organized into columns, one per tactic, reading roughly left to right in the order an attacker might progress through an intrusion:

1. Reconnaissance

2. Resource Development

3. Initial Access

4. Execution

5. Persistence

6. Privilege Escalation

7. Defense Evasion

8. Credential Access

9. Discovery

10. Lateral Movement

11. Collection

12. Command and Control

13. Exfiltration

14. Impact

Not every attack uses every tactic, and attackers may cycle back to earlier tactics. The matrix is descriptive, not prescriptive.

ATT&CK Navigator

ATT&CK Navigator is a free, browser-based tool hosted at attack.mitre.org. It lets you create layers — color-coded overlays on the ATT&CK matrix — to highlight which techniques apply to a scenario, threat group, or detection gap. You can:

Search for a technique by ID or keyword.
Filter by platform (Windows, Linux, cloud, etc.).
Annotate cells with scores or comments.
Export layers as JSON files and share them with teammates.

Navigator layers are the standard artifact for communicating ATT&CK mappings in threat intelligence reports and purple-team exercises.

Mapping an Incident to ATT&CK

When you receive an incident timeline or log data, use this process:

1. Read the full timeline first. Understand the sequence of attacker actions before you start assigning IDs.

2. Identify the adversary action. What did the attacker actually do? (e.g., sent a malicious email attachment, created a scheduled task, dumped LSASS memory.)

3. Determine the tactic. What goal does that action serve? (e.g., dumping LSASS serves Credential Access.)

4. Find the matching technique. Search ATT&CK for the behavior. Use the technique ID and full name (e.g., T1003.001 — OS Credential Dumping: LSASS Memory).

5. Note the procedure. If the timeline includes a specific tool or actor, record it as the procedure example.

6. Record your evidence. Document which log line, artifact, or indicator led you to that mapping. This is the chain of evidence that makes your analysis defensible.

Accuracy matters more than speed. A wrong technique ID in a threat intelligence report can send responders looking in the wrong place.

Writing a Threat Actor Profile

A threat actor profile summarizes who attacked, what their objectives appear to be, and which TTPs they used. A good profile written in ATT&CK terminology might read:

"The observed actor established initial access via spearphishing attachments (T1566.001), then used scheduled tasks (T1053.005) for persistence. Lateral movement relied on Pass the Hash (T1550.002). These TTPs overlap with publicly reported behavior attributed to financially motivated criminal groups targeting the finance sector."

Using standardized IDs lets any reader look up the technique immediately, regardless of their background.

Accuracy and Professional Responsibility

Misattribution — incorrectly assigning an attack to the wrong threat actor or technique — can have real consequences: organizations may deploy the wrong defenses, and in some contexts, misattribution affects legal or regulatory decisions. Always base ATT&CK mappings on observable evidence, not assumption. When the evidence is ambiguous, say so. Document your confidence level. This is both a professional standard and, in sensitive environments, a safety practice for the organization.

Connection to Credentials

CompTIA Security+ tests foundational threat intelligence concepts, including attack frameworks.
CompTIA CySA+ goes deeper, expecting analysts to apply ATT&CK during threat hunting, detection validation, and intelligence reporting — exactly what today's activities practice.
ISC2 CC covers threat landscapes and the principle of understanding adversary behavior as part of a defense-in-depth strategy.

Key terms9

TacticThe high-level adversary goal during an intrusion phase, such as Initial Access or Lateral Movement; the 'why' in the ATT&CK framework.

TechniqueA specific method an adversary uses to achieve a tactic, identified by a unique ID (e.g., T1566); the 'how' in ATT&CK.

Sub-techniqueA more granular variation of a technique, identified with a decimal suffix (e.g., T1566.001 — Spearphishing Attachment).

ProcedureA real-world, actor-specific implementation of a technique, describing exactly which tool or method a known group used in an observed intrusion.

ATT&CK NavigatorA free, browser-based visualization tool that lets analysts create color-coded layers on the ATT&CK matrix to highlight relevant techniques for a scenario or actor.

Layer fileA JSON file exported from ATT&CK Navigator that encodes which techniques are highlighted, scored, or annotated in a given analysis session.

Threat Actor ProfileA structured summary of an adversary's objectives, targets, and observed TTPs, written to inform defenders and threat intelligence consumers.

MisattributionIncorrectly identifying the wrong threat actor or technique as responsible for an attack, potentially leading to incorrect defensive decisions.

TTPsTactics, Techniques, and Procedures — the three layers of adversary behavior described in the ATT&CK framework.

In class: Guided navigation exercise: instructor assigns each student a specific ATT&CK tactic (e.g., Initial Access, Persistence, Lateral Movement); students use the ATT&CK Navigator web tool to identify five techniques under that tactic and record the technique ID, name, and one real-world procedure example for each. · Students receive a fictional but realistic incident timeline (instructor-authored) and individually map each attacker action to an ATT&CK technique ID, creating an annotated ATT&CK layer file using ATT&CK Navigator. · Pairs compare their ATT&CK layer files, discuss discrepancies, and collaboratively write a one-paragraph threat actor profile using ATT&CK terminology that could be included in a threat intelligence report.
Materials: MITRE ATT&CK Navigator (web-based, attack.mitre.org/resources/attack-navigator/), instructor-authored incident timeline handout, ATT&CK layer mapping worksheet, CompTIA CySA+ study guide — threat intelligence and threat hunting chapters
Check: Submitted ATT&CK mapping worksheet and Navigator layer file; pass requires all attacker actions mapped to a technique ID with the correct tactic parent, and co-authored threat actor profile uses ATT&CK terminology accurately — 80% rubric score.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.