What is MITRE ATT&CK ?
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is an open knowledge base describing the tactics and techniques used by attackers in the real world. Organized in matrices (Enterprise, Mobile, ICS), it covers 14 tactics from initial reconnaissance to exfiltration and impact. Each technique is documented with usage examples by known threat groups, detection procedures, and mitigation measures. ATT&CK has become the common language for describing adversary behaviors and evaluating SOC detection capabilities.
Key Points
- 14 Enterprise tactics: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact
- Over 200 techniques and 400 sub-techniques documented with real-world examples
- Documented threat groups (APTs) with their TTPs (Tactics, Techniques, Procedures)
- Dedicated ICS matrix for industrial control systems
- Data sources and detection components for each technique, facilitating detection rule creation
Why Zaxyr
Zaxyr enables mapping your existing security controls to the MITRE ATT&CK matrix to identify detection gaps. The platform analyzes your SIEM rule coverage against ATT&CK techniques, generates prioritized detection recommendations, and provides an ATT&CK coverage dashboard aligned with your compliance frameworks (ISO 27001, NIS2, NIST CSF).