MITRE ATT&CK for detection
ATT&CK is the shared catalog of how real adversaries operate. Map each detection rule to a technique and your coverage stops being a feeling and becomes a grid — one that names exactly which attacker moves you would never see.
A board member asks your security lead one question: “are we covered?” The honest answer used to be a shrug — 600 detection rules, a vendor dashboard glowing green, and no way to say what they actually catch. Then someone laid the rules over a grid of known adversary techniques and the green turned patchy: solid columns for credential attacks and brute force, near-empty columns for the steps that come after a foothold — discovery, lateral movement, the quiet living-off-the-land commands that look exactly like a busy admin. Six hundred rules, and a real intruder could walk three full stages of an attack without tripping one. The grid didn’t add a single rule. It just made the holes impossible to keep ignoring.
By the end of this lesson you’ll know how to map your detections onto MITRE ATT&CK so coverage becomes a measurable grid, and how to read that grid to find the gaps an attacker would exploit first.
What ATT&CK actually is
The previous lesson named two ATT&CK technique IDs almost in passing — T1110 Brute Force, T1078 Valid Accounts — as targets for correlation rules. That casualness hides how much structure sits behind those IDs. MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a curated, public knowledge base of how real intrusions unfold, built from observed incidents rather than theory. It is the closest thing the field has to a shared vocabulary for attacker behavior — when one team says “we’re weak on T1021 Remote Services,” every other team knows exactly which move they mean.
The model has three nested levels, and the distinction is the whole point:
- Tactic — the why. The adversary’s objective at a step: Initial Access, Persistence, Privilege Escalation, Lateral Movement, Exfiltration. There are roughly fourteen tactics in the Enterprise matrix, and they read left-to-right as the rough order of an attack — the “kill chain” columns.
- Technique — the how. A specific way to achieve a tactic: under Credential Access,
T1110Brute Force orT1003OS Credential Dumping. Techniques (and their finer sub-techniques) are what you actually write detections against. - Procedure — the exact how. The concrete implementation a specific group used in the wild — this PowerShell one-liner, this tool. Procedures are the ground truth that makes a technique real.
This stack is the meaning of TTP — Tactics, Techniques, and Procedures, the term you’ll hear constantly. The reason TTPs matter for detection is durability: an attacker swaps an IP or a file hash in seconds, but the behavior — dumping LSASS to steal credentials, then using them to move laterally — is expensive to change because it’s tied to how the objective is actually accomplished.
▸Why this works
Why build detections on techniques instead of indicators? Because of the Pyramid of Pain — a model of how much it hurts an attacker when you block a given artifact. Hashes and IPs sit at the bottom: trivial for the adversary to rotate, so a detection built on them is dead the next campaign. TTPs sit at the apex: detecting the behavior forces the attacker to fundamentally rethink their operation, not just regenerate an indicator. Indicator feeds aren’t useless — they’re cheap, fast wins — but a detection program anchored only in hashes is permanently one step behind. ATT&CK is the field’s agreement to fight at the top of the pyramid.
Mapping detections to the matrix
Here’s the move that turns ATT&CK from a poster into an engineering tool. Take every detection rule you own and tag it with the technique IDs it covers. Now your detection inventory and the ATT&CK matrix share a key, and you can join them — exactly the way normalization let a SIEM join logs across sources. The result is a coverage grid: the matrix of tactics × techniques, with each cell colored by whether — and how well — you can detect that technique.
MITRE ships a free tool, ATT&CK Navigator, that renders this grid as a colored heatmap — green where you have layered detection, yellow where you have one fragile rule, red where you have nothing. The value isn’t the pretty picture; it’s that “are we covered?” stops being a vibe and becomes a number you can defend, prioritize, and track over time.
One discipline separates real mapping from theater: the tag must reflect what the rule genuinely detects, not what it’s named. A rule called “Brute Force Detector” that only fires on 100 failed logins from one IP covers a narrow slice of T1110 — it misses password spraying (T1110.003: a few attempts across many accounts, which never trips a per-IP threshold) entirely. Overclaiming coverage is worse than admitting a gap, because it paints a cell green that an attacker walks straight through.
| Tactic (the why) | Example technique | A detection that covers it | Typical real coverage |
|---|---|---|---|
| Credential Access | T1110 Brute Force | Failed-auth threshold + success correlation | Strong — everyone builds this |
| Credential Access | T1110.003 Password Spraying | Low-rate failures across many accounts | Often missed — per-IP rules don’t fire |
| Discovery | T1087 Account Discovery | Bursts of enumeration commands per host | Weak — looks like normal admin work |
| Lateral Movement | T1021 Remote Services | Unusual host-to-host auth (new pairs) | Thin — east-west traffic rarely logged |
| Exfiltration | T1048 Exfil over alt protocol | Outbound volume / DNS-tunnel anomaly | Patchy — needs egress visibility |
Read that “typical real coverage” column top to bottom and a pattern jumps out: teams are strong at the left of the matrix — the loud, early, well-understood steps like brute force — and thin toward the middle and right, where the attacker is already inside and the activity blends into legitimate operations. That left-heavy profile is the single most common detection-coverage shape in the industry, and it’s exactly the shape an intruder counts on.
Reading the grid: threat-informed defense
A naïve reading of the coverage grid is “color everything green.” That’s a trap — the Enterprise matrix has hundreds of techniques and sub-techniques, full coverage is neither achievable nor worth it, and chasing it spends your scarce detection-engineering budget on techniques no adversary who targets you will ever use. The senior move is threat-informed defense: prioritize coverage by the techniques the groups that actually target your sector are known to use.
ATT&CK supports this directly. It catalogs threat groups (e.g. APT29, FIN7) and maps each to the techniques it has been observed using. So you don’t color the whole matrix — you overlay the technique sets of the two or three groups relevant to your industry, and that overlay becomes your priority list. A fintech weights credential access and financial-fraud TTPs; a hospital weights ransomware-precursor techniques like T1486 Data Encrypted for Impact. Coverage becomes a question of expected value: detect the moves your real adversaries make, in the order they make them, before you spend a dollar on the exotic.
Your ATT&CK coverage grid is dense green on the left (Initial Access, Credential Access) and nearly empty in the middle (Discovery, Lateral Movement). You have budget for one quarter of detection engineering. Pick the best use of it.
Why are detections built on ATT&CK techniques (TTPs) more durable than detections built on IP addresses and file hashes?
A rule named 'Brute Force Detector' fires only on 100+ failed logins from a single IP. On the coverage grid, how should you tag T1110 Brute Force?
Order these ATT&CK tactics in the rough left-to-right sequence of an intrusion:
- 1 Initial Access — get a foothold
- 2 Credential Access — steal usernames and passwords
- 3 Discovery — map the environment from inside
- 4 Lateral Movement — pivot to other hosts
- 5 Exfiltration — get the data out
- 01Explain the tactic / technique / procedure hierarchy in ATT&CK and why detecting at the TTP level (not IPs and hashes) makes a detection durable.
- 02How does mapping detections to ATT&CK turn 'are we covered?' into a measurable grid, and how do you prioritize what to build with threat-informed defense?
MITRE ATT&CK is the field’s shared catalog of how real intrusions unfold, structured as tactics (the why — Initial Access, Lateral Movement, Exfiltration), techniques (the how — T1110 Brute Force, T1003 Credential Dumping), and procedures (the exact in-the-wild implementation) — together, TTPs. Detecting at the TTP level is durable because of the Pyramid of Pain: an attacker rotates an IP or hash in seconds, but the behavior is expensive to change. The engineering move is to tag each detection rule with the technique IDs it genuinely covers, join your rule inventory to the matrix on that key, and project it onto a coverage grid — MITRE’s ATT&CK Navigator renders the heatmap — so “are we covered?” becomes a number you can defend. Tag by behavior, not rule name: a per-IP brute-force rule is only partial coverage of T1110 because it misses password spraying. The usual shape is strong on the left and empty in the middle, where a real intruder operates. Don’t chase an all-green matrix; use threat-informed defense to prioritize the empty cells by the techniques the groups targeting your sector actually use. Next time someone shows you a green security dashboard, your first question is the senior one: which techniques does it cover — and which attacker moves would never appear on it at all?
Practice
Start at the top. Tasks go easiest → hardest: recall a fact, apply it to a case, then a senior-level stretch. Open one, attempt it, then reveal.
Something unclear?
Ask a question about this lesson. Questions are anonymous and go straight to the author to make the lesson better.