Where ATT&CK came from and why SOCs adopted it
MITRE, a US not-for-profit, built ATT&CK from publicly reported intrusions. Instead of listing malware names or IP addresses, which attackers change easily, it describes behaviour: how attackers get in, stay in, move around and reach their goal. Behaviour is much harder for an attacker to change.
That shift is why security operations teams adopted it. An alert labelled with an ATT&CK technique tells the next analyst what the attacker was trying to do, and a team can measure which techniques it can and cannot detect.
Tactics in the Enterprise matrix
Tactics are the columns of the matrix, roughly in the order an intrusion unfolds:
- Reconnaissance and Resource Development: researching the target and preparing infrastructure.
- Initial Access: getting a first foothold, for example through phishing or an exposed service.
- Execution and Persistence: running code and making sure access survives a reboot.
- Privilege Escalation and Defense Evasion: gaining higher rights and avoiding security tools.
- Credential Access and Discovery: stealing passwords and learning about the network.
- Lateral Movement and Collection: moving to other systems and gathering data.
- Command and Control, Exfiltration and Impact: controlling compromised machines, taking data out, or disrupting systems, as ransomware does.
Reading a technique ID
Every technique has an ID you will see in alerts, reports and SIEM rules.
T1566 Phishing
A technique under Initial Access. Sub-techniques add a suffix, such as T1566.001 for a spearphishing attachment.
T1059.001 PowerShell
Command and scripting interpreter, used under Execution. A common sign of hands-on-keyboard activity on Windows.
T1078 Valid Accounts
Attackers using real, stolen credentials. It appears under several tactics because the same login can serve many goals.
T1486 Data Encrypted for Impact
The ransomware step under Impact. Seeing earlier techniques in time can stop an attack before it gets here.
How a SOC analyst uses ATT&CK during an alert
Take an alert for a suspicious PowerShell command started by a Word document.
Map the alert
Label it with the techniques it shows: a malicious attachment (T1566.001) leading to PowerShell execution (T1059.001).
Ask what comes next
Use the matrix to predict the attacker's likely next tactics, such as persistence or credential access, and search the logs for them.
Scope the incident
Look for the same techniques on other hosts and accounts, so you know whether this is one machine or several.
Record it clearly
Write the technique IDs into the ticket and the handover, so the next shift and the incident responders read the same story.
Feed detection engineering
If a step was only found by hand, suggest a new SIEM rule for that technique, so it is alerted on next time.
Quick answers about MITRE ATT&CK
Short answers to what SOC learners ask most.
Is MITRE ATT&CK free to use?
Yes. The knowledge base and the ATT&CK Navigator tool for colouring and comparing techniques are freely available on MITRE's website.
What is the difference between a tactic and a technique?
A tactic is the attacker's goal at a step, such as gaining access or moving laterally. A technique is the specific method used to reach that goal, such as phishing or remote desktop.
Is ATT&CK the same as the Cyber Kill Chain?
No. The Cyber Kill Chain is a short, high-level sequence of attack stages. ATT&CK is far more detailed, with hundreds of techniques, and is designed to map real detections and alerts.
Do SOC interviews ask about MITRE ATT&CK?
It is a common topic. Be ready to explain tactics versus techniques, name a few technique IDs and describe how you would map an alert you have investigated.
How do I practise using ATT&CK?
Take alerts or write-ups from your lab or public incident reports, map each step to a technique, and colour them in ATT&CK Navigator to see the full attack path.
Build your SOC investigation skills
See how threat frameworks fit the SOC Analyst syllabus, or read the guides that use them.
Map every alert you study
Each time you investigate an alert or read an incident report, write down its tactics and technique IDs. After a few weeks the matrix stops looking like a wall of boxes and starts reading like the story of an attack.