Use ATT&CK Mobile tactics to organise mobile threat detection around attacker objectives on phones and tablets. Focus on the tactics most relevant to your mobile fleet, map them to available device and application telemetry, and check that incident responders can distinguish malicious activity from normal mobile behaviour.
What ATT&CK Mobile tactics are best used for
ATT&CK Mobile tactics work best as an objective-based layer for mobile detection engineering. They help you decide what adversary behaviour you want to see on phones and tablets, and they keep your detections tied to realistic attacker goals instead of platform noise. That makes them most useful when you need to prioritise coverage across a mixed Android and iOS fleet.
A practical starting point is to pick the tactics that match your highest-risk mobile use cases, then map each tactic to the telemetry you actually have. For example, device signals, app activity, mobile threat defence alerts, identity events, and managed app logs often provide different pieces of the same picture. The tactic becomes the organising lens, not the detection itself.
One useful reference point for this workflow is MITRE ATT&CK Guide for Defenders, which is helpful when you need a repeatable way to map techniques, coverage, and priority before you narrow the focus to mobile. For mobile-specific context, Mobile Malware Guide helps translate ATT&CK Mobile tactics into common Android and iOS abuse patterns.
How to build useful mobile tactic coverage
The strongest mobile programmes do not try to cover every tactic equally. They focus on the tactics that are most plausible for the fleet, the apps in use, and the attacker paths that matter in the organisation. That usually means watching for initial access, execution, persistence, credential access, discovery, and command-and-control behaviours, then expanding only where the business exposure justifies it.
Coverage should be measured against the telemetry stack, not against the matrix alone. If your mobile visibility is mostly MDM and app-level telemetry, some tactics will be easier to express than others. If you also have mobile threat defence, network proxies, and identity telemetry, you can build richer detections that correlate device, app, and session behaviour rather than treating each alert in isolation.
For teams that want to anchor mobile tactic work in broader adversary behaviour, the MITRE ATT&CK Enterprise Matrix is a useful comparison point because it shows how mobile tactics relate to the wider ATT&CK model. Where detection engineering is the real goal, the MITRE D3FEND Guide is a useful companion for thinking about defensive techniques rather than only attacker actions.
What good mobile detection coverage looks like in practice
Good coverage is not a complete matrix. It is a defensible set of mobile tactics that your team can actually detect, triage, and investigate with confidence. The aim is to distinguish malicious activity from normal mobile behaviour, such as legitimate app installs, device enrollment, push-notification traffic, and approved enterprise mobility workflows.
The best programmes also make room for mobile-specific false positives. Phones and tablets behave differently from laptops, so a tactic that is suspicious on one platform may be normal on another. Detection content should therefore be validated against real mobile usage patterns, especially where app permissions, background activity, accessibility abuse, or user-driven configuration changes can blur the line between legitimate and hostile behaviour.
When your mobile telemetry shows signs of secret exposure or app abuse, the issue often becomes an access and credential problem as much as a device problem. The API Key Management Guide is relevant wherever mobile apps or companion services rely on exposed keys, tokens, or other secret material that can widen the blast radius of a compromise.
Risk and Threat Considerations
Mobile tactic coverage can fail in two ways: either the organisation overestimates what it can see, or it builds detections that do not reflect how mobile attacks actually unfold. The result is blind spots in persistence, secret theft, phishing follow-on activity, and abuse of trusted mobile apps or managed devices.
Failure mechanism: Teams map tactics to the ATT&CK Mobile matrix, but do not validate whether the needed telemetry exists on-device, in the MDM layer, in the app, or in supporting identity and network systems. Attackers then exploit the gap by using mobile-native behaviour that looks normal unless multiple sources are correlated.
Impact: Response teams miss early signs of compromise, triage becomes noisy, and malicious mobile activity can blend into routine user or app behaviour long enough to support credential theft, data exposure, or persistence.
Practitioner Guidance
What to prioritise: Start with the few mobile tactics that align to your highest-value data and highest-likelihood abuse paths, then expand coverage only after you can detect and explain those behaviours reliably. A broad matrix with weak telemetry is less useful than a narrow set of tactics backed by solid evidence.
What to verify: Before you trust a mobile detection, confirm which signals prove the tactic on your fleet, which signals only suggest it, and which normal mobile behaviours can mimic it. Test that your analysts can reproduce the same conclusion from device, app, and responder views.
Practitioner takeaway: ATT&CK Mobile is most valuable when it is used as a prioritisation and correlation model, not as a checklist, because mobile detections only hold up when tactics are matched to real telemetry and real user behaviour.