MITRE ATT&CK: The Periodic Table of Hacking

Category: Threat Intel

Tags: mitre-attack, threat-intelligence, tactics, techniques, detection

Every few years, the cybersecurity industry produces a framework that transforms how practitioners think about threats. MITRE ATT&CK is the one that actually stuck. Not because it tells you anything you didn't already know about how attackers operate, but because it gave everyone a common language to describe it -- and a structured way to measure whether the defences actually detect any of it.

This article covers what ATT&CK is (and critically, what it is not), how to use it for detection mapping and gap analysis, and how to avoid the common mistakes that turn a useful framework into a very expensive wallpaper.

What ATT&CK Actually Is

ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge. It is a knowledge base of real-world adversary behaviour observed in actual incidents, maintained by MITRE Corporation since 2013. The framework organises attack behaviours into a hierarchy:

The enterprise matrix contains 14 tactics, covering the full attack lifecycle from reconnaissance through to impact. Each tactic contains multiple techniques, and each technique may have sub-techniques that describe specific implementation variations.

The 14 Enterprise Tactics

What ATT&CK Is Not

Before mapping your entire security stack to ATT&CK and presenting a green heatmap to the board, a few important clarifications:

It is not a risk framework. ATT&CK tells you how adversaries operate, not which threats matter most to your organisation. Technique T1059.001 (PowerShell) is not inherently "riskier" than T1542 (Pre-OS Boot) -- context determines priority.

It is not a compliance checklist. Covering all 201 techniques with detections does not mean you are secure. A detection that fires 400 times a day on legitimate activity is arguably worse than no detection at all.

It is not exhaustive. ATT&CK documents observed behaviour. Novel techniques, zero-days, and nation-state capabilities that nobody has reported yet are not in the matrix. Absence of evidence is not evidence of absence.

Coverage does not equal detection. Having a SIEM rule mapped to T1053 (Scheduled Task) does not mean you will detect every scheduled task-based persistence mechanism. The rule's quality, tuning, and the data sources feeding it determine actual effectiveness.

Using ATT&CK for Detection Mapping

The most practical use of ATT&CK is mapping existing detection capabilities to identify gaps. The process is straightforward in theory and painstaking in practice.

Step 1: Inventory Existing Detections

Catalogue every SIEM rule, EDR detection, IDS signature, and custom alert. For each one, determine which ATT&CK technique it detects. This is the tedious part. Most organisations discover they have fifteen rules for brute force detection (T1110) and precisely zero for WMI event subscriptions (T1546.003).

Step 2: Map Data Sources

ATT&CK documents which data sources can detect each technique. Compare what you're collecting against what's needed:

If you aren't collecting the data source, you cannot detect the technique. No amount of Sigma rules will compensate for disabled logging.

Step 3: Build the Gap Matrix

Overlay your detections against the techniques used by threat groups targeting your sector. The gaps between "what they use" and "what you detect" are your priorities.

ATT&CK Navigator

ATT&CK Navigator is a web-based tool for creating custom heatmaps of the ATT&CK matrix. It sounds like a gimmick until you use it, at which point it becomes indispensable.

Practical uses:

• Detection coverage visualisation -- green for detected, amber for partial, red for blind spots
• Threat group mapping -- overlay APT group techniques against your detection coverage
• Purple team tracking -- record which techniques were tested and the results
• Tool comparison -- compare coverage between EDR, SIEM, and NDR solutions

The Layer Overlay Technique

The real power comes from layering:

1. Create a layer for your detection coverage (colour-coded by confidence)
2. Create a layer for your highest-priority threat group (from ATT&CK Groups)
3. Overlay both layers -- the red zones where the threat group operates and you have no detection are your immediate priorities

This transforms a vague "we need better detection" conversation into "APT28 uses WinRM (T1021.006) for lateral movement and we have no detection for it -- here's the Sigma rule."

---

Hypothesis-Driven Hunting with ATT&CK

ATT&CK provides a structured starting point for threat hunts. Rather than staring at logs hoping something suspicious jumps out, start with a technique and build a hypothesis:

Template:

> An adversary may be using [Technique T####] to [achieve Tactic goal] by [specific procedure], visible in [data source] as [observable indicator].

Example:

> An adversary may be using Scheduled Task/Job (T1053.005) to maintain persistence by creating a scheduled task running a PowerShell download cradle, visible in Security Event Log as Event ID 4698 with PowerShell in the task XML.

Then build the query and hunt:

TECHNIQUE: T1059.001 (PowerShell)
TACTIC: Execution

DATA SOURCE: PowerShell ScriptBlock Logging (Event ID 4104)
HUNT FOR: ScriptBlockText containing:
  - 'IEX', 'Invoke-Expression'
  - 'Net.WebClient', 'DownloadString'
  - 'System.Reflection.Assembly'
  - '-enc ', '-encodedcommand'

ENRICHMENT: Cross-reference parent process (is PowerShell spawned from Office apps?)

Document results using technique IDs for consistent tracking:

Hunt ID	Technique	Hypothesis	Result	Action
H-001	T1059.001	PowerShell download cradle	3 suspicious findings	Investigate
H-002	T1053.005	Scheduled task persistence	Clean	Document baseline
H-003	T1003.001	LSASS credential access	1 confirmed Mimikatz	Incident response

---

Writing ATT&CK-Mapped Sigma Rules

When building detections, tag them with ATT&CK technique IDs. This enables automatic coverage tracking and makes gap analysis possible without manual mapping:

title: Suspicious PowerShell Download Cradle
id: e5c44b6a-5c64-4c38-9a62-1b4b3d5e8e1a
status: stable
description: Detects PowerShell commands commonly used to download and execute payloads
tags:
    - attack.execution
    - attack.t1059.001
    - attack.command_and_control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_cli:
        CommandLine|contains:
            - 'IEX'
            - 'Invoke-Expression'
            - 'DownloadString'
            - 'Net.WebClient'
    condition: selection_img and selection_cli
level: high

The attack.t1059.001 tag links this rule directly to the technique, making it possible to automatically calculate coverage.

---

Purple Team Exercises

ATT&CK provides the shared vocabulary that makes purple teaming actually work. The process:

1. Select techniques -- Choose 5-10 high-priority techniques (informed by your threat group overlay)
2. Red team executes -- Perform each technique in a controlled manner
3. Blue team detects -- Attempt to detect using existing tools and rules
4. Score and record -- Document what was detected, what was missed, and what was blocked

#	Technique	Red Team Action	Detection Result	Next Step
1	T1059.001	Encoded PowerShell download cradle	SIEM alert fired	Tune threshold
2	T1053.005	Remote scheduled task via schtasks /s	No detection	Write Sigma rule
3	T1003.001	Mimikatz sekurlsa::logonpasswords	EDR blocked execution	Test evasion variants
4	T1021.006	Lateral move via WinRM	No detection	Enable WinRM logging

The scored matrix, visualised in ATT&CK Navigator, becomes a living document of defensive capability that improves with each exercise.

---

Common Mistakes

The Green Heatmap Problem. Presenting a fully green ATT&CK matrix to leadership implies total coverage. No organisation has total coverage. Honesty about gaps is more valuable -- and more credible -- than a comforting heatmap.

Mapping at the Wrong Level. Mapping a firewall to "Initial Access" is not useful. Map detections to specific sub-techniques with documented detection logic, data sources, and confidence levels.

Ignoring Detection Quality. A noisy rule that generates 500 alerts per day and gets ignored by analysts provides zero effective coverage, regardless of what the heatmap shows. Quality over quantity.

One-and-Done Assessment. ATT&CK coverage changes when rules are modified, data sources are added, or infrastructure changes. Reassess quarterly at minimum.

---

What's Next in the Series

• Threat Hunting 101: Methodology -- the hunting process that uses ATT&CK hypotheses
• Threat Hunting 102: Detection Engineering -- writing the Sigma rules that fill your ATT&CK gaps
• Offensive Security 101: The Attack Lifecycle -- how the attacker's perspective maps to ATT&CK tactics
• Lateral Movement Detection -- deep-dive into the most commonly hunted ATT&CK tactic