Understanding the MITRE ATT&CK Framework

If you've read a breach report or a vendor's threat intelligence writeup, you've likely seen a reference like "T1566 — Phishing." That's MITRE ATT&CK — a publicly maintained knowledge base that catalogs how real-world attackers actually behave, broken into a common vocabulary defenders can use across tools and teams.

What problem it solves

Before ATT&CK, "the attacker used social engineering" meant something different to every analyst reading it. ATT&CK breaks attacker behavior into standardized tactics (the attacker's goal at a given stage — Initial Access, Persistence, Privilege Escalation, Exfiltration, and others) and techniques (the specific method used to achieve that goal — phishing, credential dumping, scheduled tasks). Every technique gets a stable ID, so "T1566" means the same thing in a threat report, a detection rule, and a tabletop exercise.

How defenders actually use it

• Detection engineering — mapping existing alerts to ATT&CK techniques reveals coverage gaps (which attacker behaviors would go completely undetected).
• Threat intelligence — describing a known group's behavior in ATT&CK terms makes it comparable across reports from different vendors.
• Incident response — reconstructing an intrusion technique-by-technique produces a timeline other analysts can independently verify.
• Red teaming — exercises can be scoped explicitly ("simulate techniques used by X group") rather than left vague.

A simplified example

A phishing email (Initial Access: T1566) delivers a macro-enabled document (Execution). The macro drops a scheduled task for persistence (Persistence: T1053) and dumps credentials from memory (Credential Access: T1003). Those credentials are used to move to another machine (Lateral Movement) before data is compressed and sent to an external server (Exfiltration). Every stage has a technique ID — which means every stage is independently detectable and independently defensible.

Why this matters beyond security teams

For businesses evaluating a vendor's security posture or reviewing an incident, ATT&CK gives you a way to ask precise questions: which techniques were actually observed, and which stages of the intrusion had no detection at all. "We got hacked" is not actionable. "Initial access via phishing, no detection until lateral movement" is.

GhostTrace's Threat Intelligence service uses this same framework when documenting incidents for clients, so findings are precise and comparable rather than anecdotal.