MITRE ATT&CK for CTI analysts
ATT&CK is a knowledge base of adversary behaviour organised by tactic and technique. Most candidates can recite that. Fewer can map an ambiguous artefact correctly, or explain what a heat map does not tell you.
ATT&CK is a curated knowledge base of adversary behaviour observed in real intrusions, maintained by MITRE. Its value to an intelligence analyst is that it gives a shared vocabulary at the level of behaviour — which is the level that is expensive for an adversary to change, and therefore the level worth writing about.
How it is structured
- Matrices — Enterprise, Mobile and ICS. Enterprise covers Windows, macOS, Linux, cloud, containers and network devices.
- Tactics — the adversary's objective, the "why". Enterprise has 14, running from Reconnaissance and Resource Development through Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, to Impact.
- Techniques and sub-techniques — the "how".
T1055is Process Injection;T1055.001is the DLL injection sub-technique. Sub-techniques exist because "process injection" was too coarse to drive detection. - Procedures — the specific implementation a given group or piece of software used. This is where the real detail lives, and it is what a technique ID alone throws away.
- Objects — Groups (tracked intrusion sets), Software, Campaigns, Mitigations, Data Sources and Detections, all cross-linked.
Techniques worth knowing cold
Not to memorise, but because they come up constantly in interviews and reporting:
| ID | Technique | Why it recurs |
|---|---|---|
| T1566 | Phishing | Still the dominant initial access vector |
| T1078 | Valid Accounts | The reason "malware-free" intrusions are hard to detect |
| T1059 | Command and Scripting Interpreter | PowerShell, cmd, bash — the execution workhorse |
| T1055 | Process Injection | The canonical defence-evasion example |
| T1003 | OS Credential Dumping | The hinge between initial access and lateral movement |
| T1021 | Remote Services | RDP and SMB lateral movement |
| T1071 | Application Layer Protocol | C2 hiding in HTTP/DNS traffic |
| T1486 | Data Encrypted for Impact | The ransomware endgame |
Mapping without over-claiming
The skill being tested is restraint. Given "a scheduled task was created that runs a PowerShell one-liner", a weak answer picks one ID and moves on. A strong answer says:
- The scheduled task maps to
T1053.005(Scheduled Task) under Persistence, and possibly Execution and Privilege Escalation — techniques sit under multiple tactics, and which one applies depends on the adversary's intent, which you may not know yet. - The PowerShell execution maps to
T1059.001. - What you have is an observation. Whether it is malicious depends on context you have not been given — plenty of legitimate software creates scheduled tasks that call PowerShell.
Being asked to map something ambiguous. The correct move is to state the candidate techniques, say what additional evidence would disambiguate them, and decline to commit further. Confidently naming a single ID from thin evidence is the wrong answer even when the ID happens to be right.
What ATT&CK is good for
- Common language between intelligence, detection engineering and red teams. This is the biggest practical win.
- Gap analysis — comparing techniques used by the groups that target your sector against what your telemetry can actually detect.
- Structuring adversary profiles so two analysts write comparable products.
- Prioritising detection work by technique frequency against your organisation, not by what is interesting.
What it is not good for
Interviewers like this question because it separates users from reciters.
- It is not exhaustive. It reflects publicly reported intrusions. Absence from ATT&CK is not evidence a technique is unused.
- Coverage heat maps mislead. "We detect 70% of techniques" is close to meaningless — techniques are not equally weighted, equally likely, or equally detectable, and a green square usually means one narrow detection rule, not real coverage.
- It flattens sequence. ATT&CK tells you what was done, not the order or the causal chain. Pair it with the kill chain or a timeline for that.
- Group pages are not attribution. MITRE's Groups are clusters built from public reporting, with all the naming inconsistency that implies. Two vendors' names for "the same" group rarely mean exactly the same set of activity. See attribution and its limits.
Tooling
ATT&CK Navigator for building and comparing layers; the STIX/TAXII representation of ATT&CK if you want it in a TIP; and Sigma or your EDR's own rule format for turning a technique into a detection. The ATT&CK Data Sources and Detections fields are the bridge from a technique to the telemetry that would reveal it — most analysts under-use them.
Practise ATT&CK questions or run a full mock interview.
Run a mock interview on this material. You get the question, a graded response against a vetted rubric, and the probing follow-up an interviewer would ask next.
Related reading
- The Diamond Model of intrusion analysis The Diamond Model exists to make pivoting explicit. Its four vertices are not a taxonomy to recite — they are the four places you can be standing when you ask "what else touches this?"
- The Cyber Kill Chain A 2011 model that is still the clearest way to talk about intrusion sequence and defensive coverage — provided you can also say where its linear assumption fails.
- The intelligence cycle and F3EAD Every intelligence failure in a CTI team traces back to the first step. If nobody can state the requirement, everything downstream is expensive noise.
- STIX, TAXII and TLP STIX is the data model, TAXII is the transport, TLP is the handling rule. Mixing these up is a common and very visible interview error.