MITRE ATT&CK Framework Cheat Sheet

Updated 2026-04-30

Next Topic: Network Security Cheat Sheet

🧠Study flashcards on this topic86 cards · spaced repetition→

The MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework is a globally accessible knowledge base documenting adversary tactics and techniques based on real-world observations. Created by MITRE Corporation in 2013, ATT&CK has become the industry standard for understanding and communicating cyber threat behaviors across three primary matrices: Enterprise (covering Windows, macOS, Linux, cloud, and containers), Mobile (iOS and Android), and ICS (Industrial Control Systems). The framework organizes adversary behaviors into 14 tactical objectives spanning the attack lifecycle—from reconnaissance through impact—with each tactic containing multiple techniques and sub-techniques that describe specific methods attackers use. What makes ATT&CK uniquely valuable is its behavior-centric approach: rather than focusing on indicators of compromise or specific malware families, it maps how adversaries operate, enabling defenders to build detections that remain effective even when attacker tooling changes.

What This Cheat Sheet Covers

This topic spans 15 focused tables and 122 indexed concepts, 86 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: ATT&CK Tactics (Attack Lifecycle Stages)Table 2: ATT&CK Matrices and PlatformsTable 3: Techniques and Sub-Techniques StructureTable 4: Threat Groups and AdversariesTable 5: Software CatalogTable 6: Data Sources and DetectionTable 7: ATT&CK Navigator ToolTable 8: Mitigations and Defensive CountermeasuresTable 9: ATT&CK Data Formats and AccessTable 10: Use Cases and ApplicationsTable 11: Related MITRE Frameworks and ToolsTable 12: Implementation Best PracticesTable 13: Common Pitfalls and Anti-PatternsTable 14: Training and CertificationTable 15: Version History and Evolution

Quick IndexSubscribe to unlock

A jump-to index of every table row in this cheat sheet.

Mind MapSubscribe to unlock

An interactive map of every table and concept in this topic.

Table 1: ATT&CK Tactics (Attack Lifecycle Stages)

Tactics are the "why" of the framework — the goal an adversary is pursuing at each stage of an intrusion, from first scanning the target to finally encrypting or destroying data. Read top to bottom, these 14 stages trace the arc of a typical attack, and every technique elsewhere in ATT&CK hangs off one or more of them. Learn these first; everything else is detail underneath.

Tactic	Example	Description
Reconnaissance (TA0043)	`Active Scanning (T1595)` `Gather Victim Identity (T1589)`	• Gathering information about the target to plan future operations • includes both active scanning and passive OSINT collection
Resource Development (TA0042)	`Acquire Infrastructure (T1583)` `Develop Capabilities (T1587)`	Establishing resources to support operations such as infrastructure, accounts, and capabilities before initial access.
Initial Access (TA0001)	`Phishing (T1566)` `Exploit Public-Facing Application (T1190)`	Techniques used to gain initial entry into a network, most commonly through user interaction or exposed vulnerabilities.
Execution (TA0002)	`Command and Scripting Interpreter (T1059)` `User Execution (T1204)`	Running malicious code on a target system to achieve tactical goals through interpreters, scheduled tasks, or user actions.
Persistence (TA0003)	`Scheduled Task/Job (T1053)` `Boot or Logon Autostart (T1547)`	Maintaining foothold across restarts, credential changes, and system modifications to ensure continued access.
Privilege Escalation (TA0004)	`Exploitation for Privilege Escalation (T1068)` `Access Token Manipulation (T1134)`	Gaining higher-level permissions to access restricted resources or elevate from user-level to administrator or system access.
Defense Evasion (TA0005)	`Obfuscated Files or Information (T1027)` `Process Injection (T1055)`	Avoiding detection by security tools through obfuscation, disabling defenses, hiding artifacts, and masquerading as legitimate processes.
Credential Access (TA0006)	`OS Credential Dumping (T1003)` `Brute Force (T1110)`	Stealing credentials such as passwords, hashes, or tokens to access systems and move laterally within the network.
Discovery (TA0007)	`System Information Discovery (T1082)` `Network Service Discovery (T1046)`	Exploring the environment to understand the system configuration, network topology, accounts, and available resources.
Lateral Movement (TA0008)	`Remote Services (T1021)` `Pass the Hash (T1550.002)`	Moving through the network from one system to another to reach high-value targets or expand access.
Collection (TA0009)	`Data from Local System (T1005)` `Input Capture (T1056)`	Gathering information of interest from target systems including files, credentials, screenshots, and keystrokes.
Command and Control (TA0011)	`Application Layer Protocol (T1071)` `Encrypted Channel (T1573)`	• Communicating with compromised systems to issue commands and receive data • often uses legitimate protocols to blend in
Exfiltration (TA0010)	`Exfiltration Over C2 Channel (T1041)` `Exfiltration Over Alternative Protocol (T1048)`	Stealing data from the target network by transmitting information to attacker-controlled infrastructure.
Impact (TA0040)	`Data Encrypted for Impact (T1486)` `Inhibit System Recovery (T1490)`	Disrupting availability or integrity of systems and data through destruction, encryption, manipulation, or denial of service.

Table 2: ATT&CK Matrices and Platforms

ATT&CK isn't one matrix but a family of them, each scoped to a different technology domain — Enterprise for traditional IT and cloud, Mobile for iOS and Android, ICS for industrial control systems. Picking the right matrix matters because the techniques that apply to a Kubernetes cluster have little to do with those that target a PLC on a factory floor. Note too that the old PRE-ATT&CK matrix has been folded into Enterprise.

Matrix	Example	Description
Enterprise Matrix	`Covers Windows, macOS, Linux, Cloud (AWS, Azure, GCP), Network, Containers`	• Primary matrix covering traditional IT environments with 216 techniques and 475 sub-techniques • includes platform-specific behaviors

The rest of this section is part of the full cheat sheet

Table 3: Techniques and Sub-Techniques Structure

If tactics are the "why," techniques are the "how" — and this is the anatomy of a single technique entry. Each one carries an ID like T1059, optional sub-techniques (T1059.001), the platforms it applies to, the data sources that reveal it, and the mitigations that blunt it. Understanding this structure is what lets you read any ATT&CK page fluently and turn it into a concrete detection or control.

Concept	Example	Description
Technique	`T1059 - Command and Scripting Interpreter`	• High-level description of how adversaries achieve tactical objectives • numbered with T#### identifier

The rest of this section is part of the full cheat sheet

Table 4: Threat Groups and Adversaries

ATT&CK doesn't just catalog techniques in the abstract — it ties them to the real-world actors who use them. Each documented group (APT29, Lazarus, FIN7, and 130-plus others) comes with a profile of its targets, tooling, and observed techniques, which is what makes threat-informed defense possible: you can prioritize the handful of techniques actually used by the adversaries who hunt your sector rather than boiling the whole matrix.

Component	Example	Description
Groups	`APT29 (G0016) - Cozy Bear` `APT28 (G0007) - Fancy Bear` `Lazarus Group (G0032)`	130+ documented adversary organizations with aliases, target sectors, observed techniques, and associated software they use.

The rest of this section is part of the full cheat sheet

Table 1: ATT&CK Tactics (Attack Lifecycle Stages)

Tactic	Example	Description
Reconnaissance (TA0043)	`Active Scanning (T1595)` `Gather Victim Identity (T1589)`	• Gathering information about the target to plan future operations • includes both active scanning and passive OSINT collection
Resource Development (TA0042)	`Acquire Infrastructure (T1583)` `Develop Capabilities (T1587)`	Establishing resources to support operations such as infrastructure, accounts, and capabilities before initial access.
Initial Access (TA0001)	`Phishing (T1566)` `Exploit Public-Facing Application (T1190)`	Techniques used to gain initial entry into a network, most commonly through user interaction or exposed vulnerabilities.
Execution (TA0002)	`Command and Scripting Interpreter (T1059)` `User Execution (T1204)`	Running malicious code on a target system to achieve tactical goals through interpreters, scheduled tasks, or user actions.
Persistence (TA0003)	`Scheduled Task/Job (T1053)` `Boot or Logon Autostart (T1547)`	Maintaining foothold across restarts, credential changes, and system modifications to ensure continued access.
Privilege Escalation (TA0004)	`Exploitation for Privilege Escalation (T1068)` `Access Token Manipulation (T1134)`	Gaining higher-level permissions to access restricted resources or elevate from user-level to administrator or system access.
Defense Evasion (TA0005)	`Obfuscated Files or Information (T1027)` `Process Injection (T1055)`	Avoiding detection by security tools through obfuscation, disabling defenses, hiding artifacts, and masquerading as legitimate processes.
Credential Access (TA0006)	`OS Credential Dumping (T1003)` `Brute Force (T1110)`	Stealing credentials such as passwords, hashes, or tokens to access systems and move laterally within the network.
Discovery (TA0007)	`System Information Discovery (T1082)` `Network Service Discovery (T1046)`	Exploring the environment to understand the system configuration, network topology, accounts, and available resources.
Lateral Movement (TA0008)	`Remote Services (T1021)` `Pass the Hash (T1550.002)`	Moving through the network from one system to another to reach high-value targets or expand access.
Collection (TA0009)	`Data from Local System (T1005)` `Input Capture (T1056)`	Gathering information of interest from target systems including files, credentials, screenshots, and keystrokes.
Command and Control (TA0011)	`Application Layer Protocol (T1071)` `Encrypted Channel (T1573)`	• Communicating with compromised systems to issue commands and receive data • often uses legitimate protocols to blend in
Exfiltration (TA0010)	`Exfiltration Over C2 Channel (T1041)` `Exfiltration Over Alternative Protocol (T1048)`	Stealing data from the target network by transmitting information to attacker-controlled infrastructure.
Impact (TA0040)	`Data Encrypted for Impact (T1486)` `Inhibit System Recovery (T1490)`	Disrupting availability or integrity of systems and data through destruction, encryption, manipulation, or denial of service.

Table 2: ATT&CK Matrices and Platforms

Matrix	Example	Description
Enterprise Matrix	`Covers Windows, macOS, Linux, Cloud (AWS, Azure, GCP), Network, Containers`	• Primary matrix covering traditional IT environments with 216 techniques and 475 sub-techniques • includes platform-specific behaviors

Table 3: Techniques and Sub-Techniques Structure

Concept	Example	Description
Technique	`T1059 - Command and Scripting Interpreter`	• High-level description of how adversaries achieve tactical objectives • numbered with T#### identifier

Table 4: Threat Groups and Adversaries

Component	Example	Description
Groups	`APT29 (G0016) - Cozy Bear` `APT28 (G0007) - Fancy Bear` `Lazarus Group (G0032)`	130+ documented adversary organizations with aliases, target sectors, observed techniques, and associated software they use.