MITRE ATT&CK Guide for Defenders

Most security teams use MITRE ATT&CK, but many use it as a colouring exercise rather than as a way to decide what to detect, test and fix next. ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a free knowledge base of adversary behaviour observed in real intrusions, and it has changed a lot recently: v18 replaced technique-level detection text with detection strategies and analytics, and v19 split Enterprise Defense Evasion into two tactics. This guide explains how the current release (v20, October 2026) is structured, how to map threat reports and detections to it, how to measure coverage honestly and how to run a threat-informed defence programme on top of it. It is for detection engineers, SOC leads, threat intelligence analysts and purple teams.

Key takeaways

• ATT&CK describes behaviour, not tools or indicators. A technique is how an adversary achieves a tactical goal; procedures are the specific implementations a group or malware family used.
• v20 has 15 Enterprise tactics. Defense Evasion is gone from Enterprise: TA0005 is now Stealth and TA0112 Defense Impairment holds techniques that disable or undermine security controls, so old mappings to the revoked Impair Defenses technique must be updated.
• Detection strategies are the new defensive layer. Since v18 each technique links to detection strategies (DET IDs) built from platform-specific analytics (AN IDs) that cite data components and log sources.
• Coverage is a scale, not a tick box. A technique with a log source but no tested analytic is not covered, and a heat map that treats it as green is a vanity metric.
• Prioritise before you map everything. Use threat intelligence on the groups that target you, prevalence data and choke points to pick a short list of techniques, then validate those through purple teaming.

How ATT&CK is structured

ATT&CK has three technology domains, each with its own matrix. Enterprise covers Windows, macOS, Linux, cloud (IaaS, SaaS, Office Suite, Identity Provider), network devices, containers and ESXi, plus pre-compromise activity. Mobile covers Android and iOS. ICS covers industrial control systems and adds asset objects (18 in v20) such as controllers and engineering workstations. Within a domain the knowledge base is a set of linked objects, each with a stable ID.

The v20 Enterprise release contains 227 techniques, 479 sub-techniques, 178 groups, 842 software entries, 57 campaigns, 44 mitigations, 106 data components, 703 detection strategies and 1,770 analytics. Mobile and ICS each have 78 techniques. For profiles of the groups behind the techniques, see the Threat Actor Groups Guide.

Enterprise tactics in v20

Tactic IDs are not sequential and do not change when tactics are renamed, which is why TA0005 survives with a new name. The table lists the 15 Enterprise tactics in matrix order, verified against the v20 STIX data.

Many techniques sit under more than one tactic: T1078 Valid Accounts appears under Initial Access, Persistence, Privilege Escalation and Stealth, because the same behaviour serves several goals. The other domains differ. Mobile v20 still has 12 tactics including Defense Evasion, and ICS has 12 tactics from TA0108 Initial Access to TA0105 Impact, including TA0103 Evasion, TA0107 Inhibit Response Function and TA0106 Impair Process Control.

What changed in v18 to v20

• v18 (28 October 2025): MITRE states that "Detections in techniques have been replaced with Detection Strategies", adding detection strategy and analytic objects, deprecating data sources and making major updates to data components. Data components now carry log source references, for example DC0084 lists Security Event IDs 4768 and 4769.
• v19 (28 April 2026): the release notes describe "the split of the Defense Evasion Tactic in Enterprise ATT&CK into the Stealth and Defense Impairment Tactics", and Mobile received its first detection strategies.
• v20 (13 October 2026): nine AI-focused Enterprise techniques (including prompt injection and AI-enabled exfiltration), six new Enterprise detection strategies and 12 analytics, new ICS command and scripting interpreter techniques and ICS detection strategies with platform and asset context.

The split revoked IDs that many SIEM rules and reports still use. The Impair Defenses technique is revoked; its content moved to new Defense Impairment techniques such as T1685 Disable or Modify Tools (T1685.001 Disable or Modify Windows Event Log, T1685.005 Clear Windows Event Logs), T1686 Disable or Modify System Firewall, T1689 Downgrade Attack and T1690 Prevent Command History Logging. T1070.002 Clear Linux or Mac System Logs is now T1685.006. Indicator Removal (T1070) stays under Stealth. Rules tagged with revoked IDs silently drop out of coverage reports built on v20, so re-map before regenerating dashboards.

How a detection strategy reads

Take T1003.001 LSASS Memory. Its detection strategy DET0363 links to analytic AN1030 for Windows, which describes a non-privileged or abnormal process opening lsass.exe with full access (0x1F0FFF) followed by a dump or file creation, citing Sysmon Event IDs 10, 1 and 11 and Security Event ID 4673. Analytics also list mutable elements, the parts you are expected to tune: AN1252 for PowerShell (DET0455) names CommandLinePattern, ParentProcessName and a ScriptBlockLengthThreshold for Event ID 4104; the T1078 strategy DET0560 has five analytics (Windows, Linux, macOS, Identity Provider, Containers) with LogonType and GeoIPMismatch as tuning points. Treat analytics as specifications to implement in your own query language, not as ready rules. See the Credential Dumping Guide for the controls behind T1003.

Techniques defenders often get wrong

These techniques are often mis-mapped because names overlap or the v19 split moved them. IDs and tactics are verified for v20; telemetry comes largely from the ATT&CK analytics.

Living off the land makes many of these hard to separate from administration; see the Living off the Land Guide.

Tools: Navigator, STIX data, Workbench and Attack Flow

• ATT&CK Navigator: a client-side web app for annotating matrices with layers (JSON files) holding scores, colours and comments per technique. Layers can be generated by script, and new layers can be combined from existing ones with a score expression for gap analysis. MITRE recommends running your own instance for sensitive layers, which coverage layers always are.
• STIX data: the mitre-attack/attack-stix-data repository publishes each domain as STIX 2.1 JSON collections, a versioned bundle per release plus an unversioned latest bundle, with an index.json collection index. Pin a version in pipelines so a release does not silently change your reports.
• ATT&CK Workbench: a self-hosted application (Docker Compose, MongoDB, REST API, optional TAXII 2.1 server) for extending ATT&CK with local techniques, groups or notes while subscribing to MITRE releases.
• Attack Flow: a STIX 2.1 extension from the Center for Threat-Informed Defense (CTID) for sequencing techniques into flows with attack-action, attack-asset, attack-condition and attack-operator (AND/OR) objects. Flows show which technique is a choke point in a real intrusion, which a flat heat map cannot.
• Mappings Explorer: CTID's mappings of NIST SP 800-53, CIS Controls, CSA CCM, the CRI Profile, VERIS, the KEV catalogue and native AWS, Azure, GCP and Microsoft 365 capabilities to ATT&CK.
• Top ATT&CK Techniques: a CTID methodology and calculator that ranks techniques by prevalence, choke point value and actionability to produce a tailored top 10.

Reading ATT&CK Evaluations

MITRE ATT&CK Evaluations (formerly under the MITRE Engenuity name) emulate a known adversary against participating products and publish the results. The 2025 Enterprise round, released on 10 December 2025, used scenarios inspired by Scattered Spider and Mustang Panda, included the first cloud-focused emulation and added the Reconnaissance tactic. MITRE states that "The evaluations do not rank vendors". Read the per-step detail for your priority techniques, note where detections needed configuration changes, and discount claims of total coverage: one emulated scenario is not your environment.

Mapping threat reports and detections to ATT&CK

CISA's Best Practices for MITRE ATT&CK Mapping (updated January 2023 with HSSEDI) is the reference method. For finished reports it sets six steps:

1. Find the behaviour (what the adversary did, not hashes or IPs).
2. Research the behaviour until you know what it achieves.
3. Translate the behaviour into a tactic.
4. Identify the technique that applies.
5. Identify the sub-technique, mapping to the parent "only if there is not enough context to identify a sub-technique".
6. Compare results with other analysts.

For raw data, CISA gives three starting points: a data source, specific tools or attributes, or existing analytics. It names three common mistakes (leaping to conclusions, missed opportunities, miscategorisation) and five biases (novelty, visibility, producer, victim and availability). Visibility bias matters most for defenders: you over-map techniques you happen to log well. Map to tactic level only when the report lacks detail, because a tactic alone is not actionable.

Apply the same discipline to your own rules: tag the most specific sub-technique, the platform, the data component and the ATT&CK version, so intelligence and detection layers can be compared. See the Threat Intelligence Guide.

Measuring coverage honestly

Binary coverage (green if any rule mentions the technique) overstates readiness. A single rule for T1059.001 that matches -EncodedCommand does not cover PowerShell abuse in general. Score each technique, per platform, on a graded scale instead.

Build three Navigator layers: a threat layer (techniques of relevant groups and campaigns, weighted by frequency), a coverage layer using the scale above, and a gap layer from a score expression combining the two. The gap layer, not the coverage layer, is the work queue. Revalidate after each ATT&CK release and log pipeline change.

Metrics that show the programme is working:

• Percentage of priority techniques at level 3 or above, per platform.
• Number of priority techniques with no telemetry (level 0), trending down.
• Median days from a new priority technique being identified to a validated detection.
• Purple team pass rate: emulated procedures that produced an alert a responder could act on.
• Share of detection rules tagged to a current (non-revoked) technique ID.
• Mean time to detect in exercises for the top 10 techniques.

Running threat-informed defence in practice

Threat-informed defence means using knowledge of real adversary behaviour to decide what to detect, test and fix first. A phased approach:

1. Scope: pick one domain and platform set (for example Windows, Entra ID and AWS) and record the ATT&CK version.
2. Prioritise: build the threat layer from intelligence on relevant groups, your own incident history and the Top ATT&CK Techniques calculator. Aim for 15 to 30 techniques, not 700.
3. Baseline: map existing rules and data components to those techniques and score them honestly.
4. Close telemetry gaps first: without the data component, no analytic helps.
5. Build or adapt analytics: start from the ATT&CK analytic description, write the rule, and deploy it in log-only or low-severity mode for one to two weeks to measure noise. Roll back by disabling the rule or reverting it in version control if it floods the queue. See the Detection Engineering Guide.
6. Validate: run the procedures in a purple team exercise or a BAS tool, in a test segment first, then production with change approval. See the Breach and Attack Simulation (BAS) Guide.
7. Add mitigations: for techniques you cannot detect reliably, apply the linked mitigations, for example M1043 Credential Access Protection and M1026 Privileged Account Management for T1003.001.
8. Repeat each release: MITRE releases twice a year (April and October); review revoked IDs and new techniques each time.

Small vs large organisations: a small team should take a top 10 list and ask its managed detection provider for level 3 evidence. A large SOC benefits from pinned STIX versions in CI and a regular purple team cadence. Navigator vs Workbench: Navigator is enough for comparing layers; Workbench is worth hosting only when you need to add and share your own techniques or annotations.

Where identity fits: T1078 Valid Accounts, T1078.004 Cloud Accounts, T1098 Account Manipulation and T1556 Modify Authentication Process span several tactics and are hard to cover with endpoint telemetry alone. Identity provider logs and service account behaviour need their own analytics; see the ITDR Guide.

Framework mapping

MITRE D3FEND is the companion knowledge base of defensive techniques and links to ATT&CK at the technique level. For translating between control frameworks, see the Control Mapping Guide.

Common failure patterns

• Heat maps as vanity: a mostly green matrix reported to the board, built from rule names rather than tests.
• Binary coverage of broad techniques: marking T1078 Valid Accounts as covered because failed logons alert. The Colonial Pipeline ransomware attack began with a valid but unused VPN account, behaviour a failed-logon rule never sees.
• Ignoring non-endpoint procedures: help desk social engineering maps to T1566.004 Spearphishing Voice and then T1078, yet coverage layers often only reflect EDR. The MGM Resorts breach shows the gap.
• Stale IDs after a release: rules still tagged with Impair Defenses or T1070.002 drop out of v20 reports or are counted under the wrong tactic.
• Mapping everything, prioritising nothing: months spent tagging 700 techniques and sub-techniques, none validated.
• Hybrid identity blind spots: cloud techniques such as T1078.004 and T1098 stay uncovered when only on-premises logs feed the SIEM. In the Storm-0501 hybrid cloud attacks, stolen Entra Connect Sync credentials carried operators from on-premises into the cloud.

Practitioner checklist

• Record the ATT&CK version in every rule, report and Navigator layer, and pin the STIX bundle in pipelines.
• Replace revoked IDs (Impair Defenses and its sub-techniques, T1070.002 and others) with their v20 successors.
• Build a threat layer of 15 to 30 priority techniques from relevant groups, incidents and prevalence data.
• Score coverage per technique and platform on a graded scale, not green or red.
• Close data component gaps before writing new analytics.
• Validate priority techniques by purple teaming or BAS at least twice a year.
• Map threat reports with the CISA six-step method and peer review.
• Add identity provider and cloud audit logs to coverage for T1078, T1098 and T1556.
• Report gap and validation metrics to leadership, not raw heat maps.

Standards and references

• MITRE ATT&CK: ATT&CK v20 Release Notes
• MITRE ATT&CK: ATT&CK v19 Release Notes
• MITRE ATT&CK: TA0112 Defense Impairment
• CISA: Best Practices for MITRE ATT&CK Mapping
• MITRE ATT&CK: ATT&CK STIX Data
• MITRE ATT&CK: ATT&CK Navigator
• Center for Threat-Informed Defense: Mappings Explorer
• Center for Threat-Informed Defense: Attack Flow

Related NHI Mgmt Group resources: Detection Engineering Guide · Threat Actor Groups Guide · Breach and Attack Simulation (BAS) Guide · Living off the Land Guide · Credential Dumping Guide