MITRE ATT&CK Framework: Everything You Need to Know
Updated July 2025 | Estimated read time: 8 minutes | Published by Firevault
What Is MITRE ATT&CK?
The MITRE ATT&CK Framework (Adversarial Tactics, Techniques & Common Knowledge) is a globally recognised matrix of real-world adversary behaviours — based not on hypothetical risks, but on observed attack patterns in enterprise, mobile, and industrial environments.
Rather than relying on indicators or signatures, ATT&CK focuses on how attackers operate — from initial access all the way to exfiltration and impact. Security teams use it to improve visibility, plug control gaps, and model threats using real-world context.
How the Framework Is Structured
ATT&CK is structured around two key layers:
- Tactics: The adversary’s goals (e.g. Initial Access, Persistence, Exfiltration)
- Techniques: The methods used to achieve those goals (e.g. Phishing, Credential Dumping)
Each technique may also include sub-techniques and detection/mitigation guidance. ATT&CK is available in multiple matrices — Enterprise, Mobile, and ICS (for industrial control systems).
Core Tactics & Techniques
| Tactic | Purpose | Example Technique |
|---|---|---|
| Initial Access | Gain entry to the environment | Phishing (T1566) |
| Execution | Run malicious code | Command & Script Interpreter (T1059) |
| Persistence | Maintain access over time | Modify Registry (T1112) |
| Privilege Escalation | Gain higher-level permissions | Exploiting Vulnerable Service (T1068) |
| Defense Evasion | Avoid being detected | Obfuscated Scripts (T1027) |
| Credential Access | Steal secrets | Brute Force (T1110) |
| Discovery | Learn about the environment | Network Service Discovery (T1046) |
| Lateral Movement | Move through the network | Remote Services (T1021) |
| Collection | Gather sensitive data | Screen Capture (T1113) |
| Exfiltration | Steal and remove data | Exfiltration Over Web Services (T1567) |
| Impact | Disrupt, destroy or encrypt | Data Encrypted for Impact (T1486) |
Practical Use Cases for Security Teams
- Detection Engineering: Map SIEM/SOC alerts to known techniques to close visibility gaps
- Threat Hunting: Proactively search for high-risk behaviour like Lateral Movement or Privilege Escalation
- Purple Teaming: Emulate attacker techniques to test controls and validate defences
- Risk Prioritisation: Align controls with techniques that target high-value systems or data
Where Firevault Fits into ATT&CK
Firevault doesn’t just help detect ATT&CK techniques — it removes the opportunity for many of them to work in the first place.
- No Exfiltration: Offline vaults eliminate paths for T1567 (Exfiltration Over Web Services) and similar techniques.
- Files in Firevault cannot be encrypted (T1486) because they are not reachable.
- Reduced Discovery Yield: Network reconnaissance yields no access to vaulted assets.
- Interrupts Collection: Data for Collection (T1113, T1056, T1005) is not exposed or network-accessible.
Firevault shifts the organisation’s exposure surface by physically removing its most valuable data from the attack lifecycle.
Integration, Compliance & Mapping
MITRE ATT&CK is widely integrated into tools and frameworks like:
- NIST Cybersecurity Framework (CSF)
- ISO/IEC 27001 and 27002
- CISA’s Shields Up and Critical Infrastructure Guidance
Firevault supports these by providing technical control evidence that mitigates risks tied to ATT&CK techniques — especially in areas of offline data protection, ransomware recovery, and breach impact reduction.
Frequently Asked Questions
- Is ATT&CK a threat-intelligence feed?
- No — it’s a static framework of known adversary behaviours, not a live indicator list.
- Do I need to address every technique?
- No — focus on those relevant to your architecture, systems, and data exposure.
- How does Firevault map to ATT&CK?
- It removes opportunities for techniques like exfiltration, encryption, and data theft by taking critical files fully offline.
Firevault’s Verdict
MITRE ATT&CK tells you what the enemy will try. Firevault ensures the most valuable targets are unreachable.
Detection and defence matter — but elimination is stronger. Firevault allows security teams to reduce exposure to entire tactic categories by removing data from network access, attacker reach, and ransomware blast zones.
Combine ATT&CK-informed response with Firevault’s offline strategy, and you’re not just reacting — you’re rewriting the threat model entirely.
