The MITRE ATT&CK Framework and Threat-Informed Defense

MITRE ATT&CK — Adversarial Tactics, Techniques, and Common Knowledge — is a globally accessible knowledge base of adversary behavior derived from real-world observation. It has become the de facto common language of modern defense.

Behavior, not indicators

Traditional threat intelligence often centers on indicators of compromise — specific hashes, IPs, and domains — which adversaries change trivially. ATT&CK focuses instead on behavior: the techniques attackers must use to achieve their goals, which are far more durable. An attacker can swap malware in minutes but still needs to escalate privilege and move laterally somehow.

A structured taxonomy

ATT&CK organizes adversary behavior into a matrix and covers multiple technology domains — Enterprise (including cloud, Windows, Linux, and macOS), Mobile, and ICS. This structure lets defenders reason systematically about the full scope of attacker activity.

Grounded in evidence

What distinguishes ATT&CK is that its content is drawn from documented, observed intrusions and the tradecraft of tracked threat groups. It is not a theoretical model but a catalog of what adversaries have actually done.

The Pyramid of Pain captures the point: forcing an adversary to change their behavior (their techniques) hurts them far more than blocking an IP they can rotate in seconds.

To use ATT&CK effectively you must understand its core structure: the relationship between tactics, techniques, and procedures — collectively, TTPs.

Tactics: the adversary's goals

Tactics represent the why — the objective behind an action. The Enterprise matrix spans tactics such as Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact. Together they describe the arc of an intrusion.

Techniques: the how

Each tactic contains techniques describing how an adversary achieves that goal. Credential Access, for example, includes techniques like OS Credential Dumping and Brute Force. Many techniques break down further into sub-techniques that capture specific variations.

Procedures: the specific implementation

Procedures are the concrete, in-the-wild implementations of a technique by a particular actor or tool — the exact command, utility, or method observed. Procedures are what detection engineering ultimately targets.

Groups and software

ATT&CK also documents threat groups and the software they use, mapping each to the techniques they employ. This lets a defender ask a powerful question: which techniques does the actor most likely to target my sector actually use?

Detecting a tactic is too vague and detecting a single hash is too narrow. Techniques and procedures are the level at which durable, practical detection lives.

The most immediate value of ATT&CK is honest self-assessment. Coverage mapping replaces a comforting inventory of tools with an objective picture of which behaviors you can actually detect.

Build a coverage heatmap

Using the ATT&CK matrix — often visualized with the ATT&CK Navigator — rate your detection capability for each technique. Which do you reliably detect, which partially, and which not at all? The result is a heatmap that makes gaps visible at a glance.

Map data sources, not just tools

Detection depends on the right telemetry. For each technique, ask whether you collect the data source needed to see it — process creation, command-line logging, authentication events, network flows, cloud audit logs. Missing data sources are often the real root of coverage gaps.

Avoid the coverage illusion

A common trap is claiming coverage because a tool could theoretically detect a technique. True coverage means a tuned, tested detection that fires on the behavior with acceptable noise. Be rigorous and evidence-based when scoring.

From map to roadmap

The coverage map is not the deliverable — the prioritized improvement plan is. The gaps, weighted by relevance, become your detection-engineering backlog. GuardsArm uses ATT&CK-based coverage mapping in threat detection assessments to give clients an objective, behavior-based view of their true detection posture.

A tool you own is not a detection you have. Coverage mapping forces the honest distinction — and that honesty is where improvement starts.

ATT&CK is large. Attempting to detect every technique equally is neither feasible nor smart. Threat-informed defense means prioritizing the techniques that matter most to you.

Let the threat model drive priorities

Different adversaries favor different techniques, and different sectors face different adversaries. A financial firm, a hospital, and a manufacturer have distinct threat profiles. Use threat intelligence to identify the groups most likely to target your organization and the techniques they characteristically use.

Focus on high-impact, common techniques

Some techniques appear across a huge range of intrusions regardless of actor — credential dumping, phishing for initial access, command-and-line execution, lateral movement via valid accounts. These high-frequency techniques deserve strong coverage first because so many attack paths route through them.

Overlay intelligence on the coverage map

• Weight your coverage heatmap by technique prevalence and relevance to your sector.
• Prioritize gaps where a high-relevance technique meets weak or no detection.
• Revisit priorities as the threat landscape and your intelligence picture evolve.

Communicate risk in ATT&CK terms

Mapping your priorities to ATT&CK gives leadership a concrete, defensible narrative: here are the behaviors most likely to be used against us, and here is our coverage against them. That is far more compelling than a list of products.

You will never cover all of ATT&CK, and you do not need to. Cover the techniques your adversaries actually use, in the order they are most likely to use them.

ATT&CK turns coverage gaps into concrete work. Its structure directly fuels two disciplines: proactive threat hunting and the engineering of durable detections.

Hypothesis-driven threat hunting

ATT&CK gives hunters a ready supply of hypotheses. Rather than searching aimlessly, a hunter asks: "If an adversary were using technique X in our environment, what evidence would it leave, and can I find it?" Each technique becomes a structured hunt with clear success criteria, and each hunt either finds activity or reveals a detection gap to close.

Engineering durable detections

Detection engineering builds analytics that target adversary behavior rather than fragile indicators. ATT&CK helps by specifying the data sources and behaviors involved. Well-designed detections aim at the technique or procedure level, so they survive the attacker swapping tools or infrastructure.

Detection-as-code and testing

• Manage detections in version control, mapped to ATT&CK techniques, with documented data-source dependencies.
• Test each detection against realistic execution of the technique to confirm it fires.
• Tune for signal quality so analysts are not buried in false positives.

Close the loop with hunting

Findings from hunts should graduate into automated detections, converting one-time discoveries into permanent coverage. This is how a program steadily raises its floor.

A good hunt has two acceptable outcomes: you find the adversary, or you find the gap. Either way, the next detection you build makes the environment harder to attack.

Coverage maps and detections are hypotheses about what you can catch. Adversary emulation tests those hypotheses against reality, closing the threat-informed defense loop.

Emulate real adversary behavior

Rather than generic penetration testing, adversary emulation reproduces the specific TTPs of a relevant threat actor, following the ATT&CK techniques that actor is known to use. This answers the question that matters: if this group attacked us, would we see it?

Purple teaming

The most productive format is often a purple-team exercise, where an offensive team executes techniques while the defensive team observes in real time. Each technique is run, detection is verified or found lacking, and gaps are fixed immediately — a fast, collaborative feedback loop rather than an adversarial one.

Continuous validation

• Use emulation to confirm that mapped coverage is real, not assumed.
• Re-test after tuning to verify improvements actually work.
• Repeat periodically, since environments drift and new techniques emerge.

The complete loop

Assess coverage with ATT&CK, prioritize with intelligence, engineer detections and hunt, then validate through emulation — and feed the results back into the next assessment. GuardsArm delivers this cycle through penetration testing, threat detection, and managed defense engagements, giving clients measurable, behavior-based assurance rather than a false sense of coverage.

The only way to know a detection works is to make the behavior happen and watch. Adversary emulation replaces assumption with evidence — the essence of threat-informed defense.