RR CYBERLAB • MITRE ATT&CK

MITRE ATT&CK Fundamentals

Learn how ATT&CK tactics and techniques help analysts describe adversary behavior and organize detections.

QUICK READ

ATT&CK is a knowledge base of adversary tactics and techniques. It provides a common language for describing observed behavior and can support detection, hunting and coverage analysis.

Use this page after the daily quiz: learn the concept first, then follow the investigation workflow and examples.

Tactics vs techniques

Tactics describe the adversary’s goal or phase, while techniques describe how the behavior is performed. Sub-techniques provide more specific behavior.

How analysts use it

Describe observed behavior.
Map supported techniques.
Identify detection opportunities.
Compare telemetry coverage.
Use technique names consistently in reports.

Example

If telemetry clearly shows PowerShell execution, the analyst can consider T1059.001. If DNS is being abused for command and control, T1071.004 may be relevant. Do not map unrelated techniques without evidence.

Mapping discipline

Use the current ATT&CK version available to your organization.
Map what the evidence supports.
Record the evidence that justified the mapping.
Avoid mapping based solely on a tool name or alert label.

Common mistakes

Confusing tactics with techniques.
Mapping every possible technique.
Using old IDs without checking current ATT&CK.

MITRE ATT&CK context

CISA describes ATT&CK as a common language for adversary behavior and recommends using it to identify defensive gaps, organize detections and support threat hunting. citeturn0search2

Map only behavior supported by the evidence; do not assign a technique merely because it is possible.

Daily quiz hook

What is the difference between an ATT&CK tactic and a technique?

Quiz flow: introduce this topic briefly on social media, ask the question, reveal the answer, then send learners here for the detailed investigation.

← Back to RR CyberLabs Guides Contact RR CyberLabs

Analyst practice note

MITRE ATT&CK is a knowledge base for describing observed adversary behaviors, not a severity scale or proof that an intrusion occurred. Map only the behavior supported by evidence and record the data source that led to the mapping.

For a simulated process or authentication event, identify the behavior first and then consult the relevant technique description. A technique match helps organize analysis and detection ideas; it does not establish actor identity or intent.

Continue practicing: open a fictional mission and test your reasoning against the simulated evidence.