What is the MITRE ATT&CK framework?
Short answer
MITRE ATT&CK is a free, public knowledge base of adversary tactics and techniques based on real-world observations, such as phishing for initial access or credential dumping. Defenders use it to plan detections, map coverage gaps and structure investigations.
The details
Each technique has an ID, description, examples and detection ideas. MITRE ATLAS extends the same idea to attacks on AI systems.
Useful next reads and tools
Terms explained
- MITRE ATT&CK
- MITRE ATT&CK is a free knowledge base of real-world adversary tactics and techniques used to plan detections and structure investigations.
- MITRE ATLAS
- MITRE ATLAS is a public knowledge base of adversary tactics and techniques against AI-enabled systems, modeled on MITRE ATT&CK.
- Phishing
- Phishing is a fraudulent message, usually email, that impersonates a trusted sender to trick people into revealing credentials, paying money or running malware.
Sources
Related questions
Related Guides
GuideSOC
9 Quick-Win AI Agent Use Cases for Security Operations
Nine high-impact, low-effort SOC tasks to hand to AI agents first, what each agent does and the metric that proves it, plus the tasks to keep human.
Read more GuideSOC
How I Investigate a Suspicious PowerShell Alert in a SOC Lab
A walkthrough of the exact triage workflow, event correlation steps, and command-line decoding techniques used to analyze suspicious PowerShell execution.
Read more GuideSOC
How to Build an Agentic SOC: A 4-Phase Roadmap for AI Security Operations
A practical roadmap for moving a SOC to AI agents: build the data foundation, start with quick wins, customize and orchestrate agents, and keep humans in command.
Read more GuideSOC
6 SOC Functions to Automate With AI Agents (and What to Keep Human)
Which SOC tasks should AI agents handle and which need a human? A function-by-function guide to automation potential, the AI role, the human role and the outcome.
Read more