MITRE ATT&CK: The Attacker's Playbook, Published for Defenders

The 30-second explanation

It is a big, shared map of the moves attackers make, from getting in to stealing data, so defenders everywhere can describe an attack the same way.

How it works

1. 1

   1. Tactic

   The attacker's goal at this stage.

2. 2

   2. Technique

   One method of reaching that goal.

3. 3

   3. Map

   Match observed activity to techniques.

4. 4

   4. Cover

   Check which techniques you can detect.

Each column of the framework is a tactic, the attacker's goal at that stage. Each item beneath it is a technique, one way to reach the goal. Defenders use it to describe incidents ('this used a phishing attachment, then scheduled tasks'), to check which techniques their detections cover, and to plan what to test next. It does not tell you what to do first, but it gives everyone the same vocabulary.

Real-world example

How to spot it

• Coverage counted, not tested

  A technique marked as covered but never validated.

• Checklist thinking

  Treating the framework as a to-do list rather than a map.

• Ignoring frequently used techniques

  Spending effort on rare ones first.

• No link to real incidents

  A matrix that is never compared with what actually happens.

What to do

1. 1Map your last few incidents to techniques and look for repeated patterns.
2. 2Test a detection for a technique before marking it as covered.
3. 3Use the shared vocabulary in reports so other teams understand at a glance.