What ATT&CK actually is, and how to stop being intimidated by it

Most people meet ATT&CK as a wall. Someone shows them the Enterprise matrix, fourteen columns of jargon and several hundred cells, and says "this is how we think about adversaries now." The reasonable reaction is to nod and quietly decide to look at it later.

This is the explanation I wish I had been given instead.

The one-sentence version

ATT&CK is a shared vocabulary for describing what attackers do after they get in. That is it. It is a dictionary, not a methodology, and not a maturity model.

Before it existed, two analysts describing the same intrusion would write different words for the same behaviour. One says "the malware set itself to run at startup", another says "persistence via autorun". Both are right, neither is searchable, and nobody can compare their reports. ATT&CK gives that behaviour a number, T1547.001, so a detection engineer in Manchester and an IR consultant in Toronto are provably talking about the same thing.

Three words you need, and only three

Tactic — the why. The attacker's goal at that moment. There are around a dozen: get in, run code, stay in, get more rights, avoid being seen, steal credentials, move sideways, take the data, break things. Tactics are the column headings on that matrix.

Technique — the how. A specific way to achieve a tactic. Persistence is a tactic; a registry Run key is a technique. Techniques carry the T-numbers.

Sub-technique — the how, precisely. T1547 is "Boot or Logon Autostart Execution", which covers a dozen mechanisms. T1547.001 is specifically the registry Run keys. The dot means "a more specific flavour of the thing before it".

That is genuinely the whole vocabulary. Everything else is detail you can look up when you need it.

Why the matrix is a bad first encounter

The matrix is a reference, and references are terrible teaching material. A dictionary is the correct tool for checking a word and the worst possible way to learn a language.

The matrix also implies something false. Laid out as a grid with tactics in a row, it looks like a process an attacker walks through left to right. Real intrusions skip columns, revisit them, and do three at once. The order is a convention for arranging the page, not a script anyone follows.

What it is not

Not a scoring system. "We cover 60% of ATT&CK" is close to meaningless. Techniques are not equally common, equally dangerous, or equally relevant to your estate. Covering ten techniques your actual adversaries use beats covering a hundred they do not.

Not a product requirement. Vendors advertise ATT&CK coverage because it is countable, and countable things sell. Coverage claimed in a datasheet and coverage that fires on your network are different quantities.

Not a threat model. ATT&CK describes what has been observed in the wild. It says nothing about what matters to you, which depends on what you run and who wants it.

How to actually use it, three ways

As a note-taking format. When you finish an investigation, tag what you saw with technique IDs. Do that for six months and you have something no threat report can give you: a record of what actually happens on your network, in a vocabulary you can compare against everyone else's.

As a gap map. Take the techniques you have tagged, and ask which ones you would have missed if nobody had reported them. That question generates a detection backlog ordered by real exposure rather than by which vendor demo you saw most recently.

As a study plan. Pick a technique you cannot currently detect, read MITRE's page for it, emulate it on a lab machine, and see what it leaves behind. That loop is what the labs here are built around, and it is the fastest route from reading about a technique to recognising one.

Where to start on Monday

Do not start with the matrix. Start with one technique you have already seen at work.

If you have ever found malware set to run at startup, you have seen T1547.001. Read MITRE's page for it. Notice the detection section, and the list of groups observed using it. Then work the Run key lab, which plants one deliberately so you can watch the artifact appear.

One technique understood properly is worth more than the whole matrix skimmed. Then do another. That is the entire method, and it works.