MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is the de facto industry framework cataloguing real-world adversary behaviour observed in cyberattacks. Created by MITRE Corporation in 2013, ATT&CK has become a common language for the security community: every modern threat report maps activities to ATT&CK techniques, every SOC writes detection rules per technique, every red team uses adversary emulation aligned to ATT&CK. The framework is freely available at attack.mitre.org and covers Enterprise (Windows, macOS, Linux, Cloud, Containers, Network), Mobile (Android, iOS), and ICS (industrial control systems) matrices.

Three levels of granularity: (1) **Tactics** (14 in Enterprise) — the *why* of an attack: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact, (2) **Techniques** (200+) — the *how* of achieving each tactic; e.g., T1566 'Phishing' under Initial Access, (3) **Sub-techniques** — more specific implementations; e.g., T1566.001 'Spearphishing Attachment', T1566.002 'Spearphishing Link'. Each technique includes: description, examples (which threat actors used it), data sources for detection, mitigations, and detection logic. The ATT&CK Navigator (free tool) visualises coverage and lets teams overlay multiple data sources.

Five practical applications: (1) **Detection coverage mapping** — overlay your detection rules against the ATT&CK matrix; identify gaps, prioritise by what matters for your threat model, (2) **Threat-informed defense** — use threat intel about specific actors (FIN6, APT29, Lazarus) and their TTPs to prioritise defences for techniques those actors use, (3) **Adversary emulation** — Atomic Red Team, Caldera, MITRE Engenuity tests run real ATT&CK techniques to validate detection, (4) **Investigation and reporting** — every alert and incident mapped to ATT&CK technique for consistent communication, (5) **Maturity benchmarking** — compare detection coverage and response capabilities across teams or with industry peers (CISA SOC Visibility Triad, MITRE D3FEND complements ATT&CK with defensive techniques).

MITRE Engenuity ATT&CK Evaluations are independent assessments of cybersecurity products' detection capabilities against specific threat actor TTPs. Each round emulates a real adversary (e.g., APT29, FIN7, Wizard Spider, Turla) using their actual techniques against vendor products. Vendors don't pass/fail — instead, results show which detection types (Telemetry, General, Tactic, Technique, Block) each product produces for each step. Major vendors (CrowdStrike, Microsoft, SentinelOne, Palo Alto, Trellix, Cybereason, Sophos) participate. Use cases: (1) vendor evaluation — visibility into actual product performance, not marketing claims, (2) gap analysis — identify what your existing tools miss, (3) procurement input — alongside Gartner/Forrester reports. Latest results at attackevals.mitre-engenuity.org.

Different abstraction levels: **Lockheed Martin Cyber Kill Chain** (2011) — 7 sequential phases (Reconnaissance, Weaponisation, Delivery, Exploitation, Installation, Command & Control, Actions on Objectives); high-level, simple, but limited for modern attacks (e.g., insider threat, cloud compromise). **MITRE ATT&CK** (2013) — non-sequential matrix of 14 tactics; far more granular techniques; describes *how* not just *what*; covers post-compromise behaviour in detail. Most modern programmes use ATT&CK as primary framework; Kill Chain still useful for executive communication and high-level reports. Some organisations also use **Unified Kill Chain** (Paul Pols, 2017) which extends Kill Chain to 18 phases inspired by ATT&CK.

MITRE D3FEND (DEFense ENDuring) is the defensive complement to ATT&CK — a knowledge graph of cybersecurity countermeasures. While ATT&CK catalogues *what attackers do*, D3FEND catalogues *what defenders can do*: hardening, detection, isolation, deception, eviction techniques. Each D3FEND technique maps to specific ATT&CK techniques it counters. Use cases: (1) **Defensive coverage mapping** — for each ATT&CK technique you care about, what D3FEND techniques address it? (2) **Architecture decisions** — D3FEND helps justify specific control investments, (3) **Vendor product evaluation** — map vendor capabilities to D3FEND techniques. Combined with ATT&CK, D3FEND creates the complete offensive-defensive picture. Tools: D3FEND Knowledge Base (d3fend.mitre.org), CTID Center for Threat-Informed Defense projects.

Six-step adoption: (1) **Map current detections** — for each existing SIEM/EDR rule, identify which ATT&CK technique(s) it detects; document in ATT&CK Navigator, (2) **Identify priority techniques** — based on threat intel for your industry/region (use ENISA Threat Landscape, vendor threat reports), (3) **Add adversary emulation** — Atomic Red Team is free, easy starting point; Caldera for more advanced; tests show what's actually detected vs theoretically covered, (4) **Close gaps** — write new detection rules for high-priority uncovered techniques, (5) **Integrate into incident response** — every incident report includes ATT&CK technique mapping, (6) **Measure and report** — quarterly coverage report to leadership; track improvement over time. Free training: SANS courses, MITRE ATT&CK 101 on YouTube, Cybrary courses.