What Is MITRE ATT&CK? A Beginner's Guide for SOC and Red Teams

MITRE ATT&CK is a free, public knowledge base of how real attackers behave, built from observed incidents. It gives defenders and testers a shared language: instead of "something suspicious with PowerShell", you say "T1059.001". You will meet it in SOC job descriptions, detection rules and penetration test reports.

Tactics: The Attacker's Goals

Tactics are the "why" of each step in an attack. In the Enterprise matrix they include Reconnaissance, Initial Access, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration and Impact, among others. Each column of the matrix is one tactic.

Techniques and Sub-Techniques: The "How"

Under each tactic are techniques: the ways attackers achieve that goal. Each has an ID. For example, Phishing is T1566, Brute Force is T1110 and Command and Scripting Interpreter is T1059. Sub-techniques add detail: T1059.001 is PowerShell. Each entry describes the behavior, real groups that use it, how to detect it and how to mitigate it.

How SOC Analysts Use It

• Tag alerts and detection rules with technique IDs, so everyone knows what each rule covers
• Map which techniques your detections cover, and find the gaps
• Describe an incident as a sequence of techniques in the report
• Plan threat hunts around techniques you cannot yet detect well; see what is threat hunting

How Red Teams and Testers Use It

Red teams plan exercises that emulate the techniques of a specific threat group, so the blue team can test its defenses against realistic behavior. Penetration testers can map findings to techniques, which helps defenders connect a report to detections.

Tools Around ATT&CK

• ATT&CK Navigator: a free web tool to color the matrix, for example by detection coverage
• Sigma rules: shared detection rules, usually tagged with ATT&CK IDs
• Atomic Red Team: small, safe tests for individual techniques, for use in your own lab

How to Start Learning It

Pick five common techniques, such as phishing, PowerShell, brute force, credential dumping and remote services. For each, read the entry, run a safe version in your home lab, and find the evidence in your logs. That loop teaches more than reading the whole matrix.

ATT&CK in Our SOC Course

In our SOC analyst, Splunk, Wazuh and DFIR course you write detections mapped to MITRE ATT&CK and hunt for the techniques you practiced in the earlier penetration testing courses.