MITRE ATT&CK for Detection Coverage

MITRE ATT&CK

MITRE ATT&CK is a public knowledge base of how real adversaries behave once they target an organization — the tactics they pursue (gaining initial access, persisting, escalating privileges, moving laterally, exfiltrating data) and the specific techniques they use to achieve each one, documented from observed intrusions. It gives defenders a shared vocabulary: instead of "we detect bad PowerShell", a team can say "we detect technique T1059.001, Command and Scripting Interpreter: PowerShell, on Windows endpoints, and validated it last month".

That vocabulary makes ATT&CK useful for detection engineering, threat intelligence, red and purple teaming, and security tool evaluation. Its main danger is misuse: a colorful matrix showing "coverage" can hide detections that have never fired against a real attack.

TL;DR

Tactics are adversary goals; techniques and sub-techniques are how they achieve them, each with an ID such as T1078 or T1059.001.
Matrices cover Enterprise (Windows, macOS, Linux, cloud, identity providers, SaaS, containers, network), Mobile, and ICS.
ATT&CK also documents groups, software, mitigations, and detection guidance.
Map each detection and control to techniques and visualize coverage with ATT&CK Navigator layers.
Prioritize techniques used by threats relevant to your sector and environment, not the whole matrix.
Validate coverage with adversary emulation (such as Atomic Red Team or Caldera) and record evidence.

Quick Example

A Sigma detection rule tagged with the ATT&CK tactic and technique it covers:

Validating it with an emulation test, then recording the result:

Core Concepts

Tactics, Techniques, and Sub-Techniques

Sub-techniques add precision — T1059.001 (PowerShell) and T1059.004 (Unix shell) under T1059.

Matrices and Platforms

The Enterprise matrix spans Windows, macOS, Linux, cloud infrastructure, SaaS, office suites, identity providers, containers, and network devices; Mobile and ICS matrices cover those domains. Filter to the platforms you actually run.

Groups, Software, Mitigations, and Detection Guidance

ATT&CK profiles threat groups and software with the techniques they have been observed using, lists mitigations that reduce each technique's effectiveness, and documents the telemetry and analytic approaches useful for detecting it. MITRE's companion D3FEND catalogs defensive techniques.

Using ATT&CK for Coverage

Map Detections and Controls

For each detection rule, record the techniques it addresses, the data sources it needs, the platforms it covers, and its validation status. Map preventive controls (application allowlisting, MFA, hardening) as mitigations. See Security Detection Engineering.

Visualize With ATT&CK Navigator

ATT&CK Navigator displays layers over the matrix — coloring techniques by detection coverage, validation status, threat relevance, or data source availability. Comparing a threat layer (techniques used by relevant groups) with a coverage layer shows where to invest.

Prioritize With Threat Intelligence

No organization covers every technique well. Prioritize those used by threats targeting your sector, those exploitable in your architecture (cloud-heavy organizations care more about identity and cloud techniques), and those that appear early in attacks, where detection limits damage. See Threat Modeling.

Validate With Adversary Emulation

Coverage claims need tests. Atomic Red Team provides small, technique-specific tests; MITRE Caldera automates multi-step adversary emulation; red and purple team exercises test detections against realistic chains. Record whether each detection fired, how quickly, and with what fidelity.

Best Practices

Measure Coverage Honestly

Grade coverage by evidence — none, partial, detected in testing, validated in production — rather than marking a technique "covered" because one rule mentions it.

Map Data Sources First

Many gaps are telemetry gaps. Before writing detections, confirm you collect the data sources a technique requires on the platforms that matter.

Keep Mappings in Detection-as-Code

Store ATT&CK tags with rules in version control so coverage reports are generated automatically. See Security Information and Event Management.

Use ATT&CK in Incident Reviews

Map each incident's observed techniques to ATT&CK and check which detections fired; gaps become backlog items. See Security Incident Response.

Common Mistakes

Coverage Theater

Trying to Cover Everything

Treating ATT&CK as a Checklist of Controls

FAQ

What is MITRE ATT&CK?

A publicly available knowledge base of adversary tactics, techniques, and procedures based on real-world observations, used to describe attacker behavior and to plan and measure defenses.

What is the difference between a tactic and a technique?

A tactic is the adversary's objective, such as Credential Access. A technique is a way to achieve it, such as OS Credential Dumping, and sub-techniques describe more specific variants.

How do I measure detection coverage with ATT&CK?

Map detections to the techniques they address, record data source availability and validation results, visualize coverage in ATT&CK Navigator, and compare it with the techniques used by threats relevant to you.

What is ATT&CK Navigator?

A web-based tool for annotating and visualizing the ATT&CK matrices with layers — for example, detection coverage, threat group usage, or priority — and comparing those layers.

How can I test whether my detections work?

Run adversary emulation: technique-level tests such as Atomic Red Team, automated campaigns with tools like Caldera, or purple team exercises, and record whether alerts fire with useful detail.