May 11, 2024
Updated November 14, 2026
4 minute read
The MITRE ATT&CK Framework is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, government, and the cybersecurity research community.
What is the MITRE ATT&CK Framework?
The MITRE ATT&CK Framework is a structured way to describe the tactics, techniques, and procedures (TTPs) that adversaries use to attack computer systems. It is based on real-world observations of how adversaries operate, and it is constantly updated with new information about the latest threats. The framework is organized into 11 different categories, each of which represents a different stage in the attack lifecycle.
The ATT&CK Framework is a valuable tool for security professionals because it provides a common language for discussing and analyzing threats. It can be used to develop threat models, create detection and response plans, and train security analysts. The framework is also used by researchers to develop new security technologies.
k2wn28|
Find a path to becoming a MITRE ATT&CK Framework. Learn more at:
OpenCourser.com/topic/k2wn28/mitre
Reading list
We've selected 15 books
that we think will supplement your
learning. Use these to
develop background knowledge, enrich your coursework, and gain a
deeper understanding of the topics covered in
MITRE ATT&CK Framework.
Blair and coauthors deliver a dedicated, end-to-end practitioner guide to operationalizing the MITRE ATT&CK Enterprise matrix across SOC workflows. Readers learn how to map log data sources using ATT&CK Navigator, prioritize detection gaps, and align incident response playbooks with adversary TTPs.
Costa-Gazcón places the MITRE ATT&CK framework at the center of a hands-on laboratory, teaching analysts how to tag threat intelligence in MISP with ATT&CK IDs, map Sysmon event logs via OSSEM, and hunt for persistence and credential-access techniques.
Nadhem Alfardan's 2025 handbook pairs hypothesis-driven threat hunting with MITRE ATT&CK technique profiling, guiding defenders through telemetry engineering, adversary emulation, and building repeatable detection logic.
Roberts and Brown explain how the MITRE ATT&CK framework complements the Lockheed Martin Cyber Kill Chain and the Diamond Model by zooming into post-compromise adversary behavior—covering lateral movement, privilege escalation, defense evasion, and exfiltration.
Simon Thoores and David Routin show red and blue teams how to use MITRE ATT&CK as a shared Rosetta Stone for purple-team exercises, co-designing adversary emulation plans, measuring telemetry visibility, and tuning detection rules.
Published by No Starch Press, Matt Hand dissects the exact Windows internals behind MITRE ATT&CK Defense Evasion (TA0005) and Execution (TA0002) techniques: ETW patching, direct system calls, process hollowing, parent PID spoofing, and kernel callbacks.
Megan Roddie and Jason Deyalsingh guide detection engineers through building ATT&CK-mapped analytics, translating adversary procedures into Sigma and SIEM rules, validating coverage with atomic tests, and reducing false positives.
Pease demonstrates how to build an ATT&CK-aligned detection and hunting platform using Elasticsearch, Kibana, Winlogbeat, and Sysmon, mapping endpoint and network telemetry directly to ATT&CK tactics and sub-techniques.
Vest and Tubberville show how professional adversary emulation teams build threat profiles from MITRE ATT&CK group matrices, design command-and-control (C2) malleable profiles, and structure post-engagement debriefs around technique-level defensive improvements.
Roccia provides clear visual diagrams illustrating how David Bianco's Pyramid of Pain culminates in TTPs (Tactics, Techniques, and Procedures) and how to translate unstructured malware analysis reports into structured MITRE ATT&CK Navigator heatmaps.
Murdoch organizes practical SIEM use cases and log source requirements around MITRE ATT&CK tactics, helping security operations analysts rapidly identify which Windows Security Event IDs and firewall logs detect specific lateral movement techniques.
Easttom's updated Fifth Edition introduces foundational reconnaissance, scanning, privilege escalation, malware persistence, and defense-in-depth concepts to students entering cybersecurity before they dive into full ATT&CK sub-technique matrices.
MITRE ATT&CK succeeded where abstract risk frameworks failed because it functions as a concrete, empirical taxonomy and verification checklist of finite adversary behaviors. Gawande explains why structured taxonomies prevent blind spots in high-stakes, complex environments.
Every tactical intrusion model—from the Cyber Kill Chain to MITRE ATT&CK—draws intellectual lineage from Colonel John Boyd's OODA Loop (Observe, Orient, Decide, Act). Coram's biography reveals how disrupting an adversary's orientation cycle is the essence of tactical defense.
David Pereira Quiceno provides a 2025 SOC field manual centered on ATT&CK TTP mapping, Sigma and YARA rule authoring, endpoint artifact triage, and intelligence-led containment against persistent adversaries.
For more information about how these books relate to this course, visit:
OpenCourser.com/topic/k2wn28/mitre
Save
