Log in

Security Validation with MITRE ATT&CK®

MITRE ATT&CK® Framework

MITRE ATT&CK® Framework is a knowledge base of real-world adversary tactics and techniques.

 

Picus uses the MITRE ATT&CK® Framework to simulate real-world techniques, validate your security controls, and reveal the gaps in your detection and prevention capabilities.

Get a demo Download the datasheet
The MITRE ATT&CK matrix drawn as columns of technique cells under the tactics, in Pink fading to Dark Navy

How to Operationalize MITRE ATT&CK® with Picus

  1. Save time

    Simulate MITRE ATT&CK® Techniques

    Simulate ATT&CK techniques in just a few clicks—no advanced setup or red team needed.

  2. Work smarter, not harder

    Assess ATT&CK Coverage

    By continuously running attack simulations, Picus provides a clear and comprehensive view of MITRE ATT&CK® coverage.

  3. Make faster decisions

    Unified MITRE ATT&CK® heat map

    Our customized heat map helps visualize ATT&CK coverage to demonstrate the prevention and detection efficacy of your controls.

  4. Cut manual work

    AI-powered Detection Rule Mapping

    Effortlessly map your detection content to MITRE ATT&CK® using AI-driven analysis to assess your detection coverage.

  5. Focus on real risks

    Create custom threats with ATT&CK

    Build tailored threat scenarios to validate your controls against relevant risks.

  6. Risk-free assessment

    Real-world attacks, without the risk

    Picus prioritizes operational stability and business continuity, bringing peace of mind without risking unintended disruptions.

ATT&CK Framework: Tactics Overview

The 14 MITRE ATT&CK® Tactics Explained

Understand the core of the MITRE ATT&CK® Framework with its 14 tactics that represent the stages of an adversary’s attack lifecycle. Learn how each tactic reveals different attacker goals and helps security teams strengthen their defenses.

MITRE ATT&CK tactics
TacticDescriptionKey TechniquesWhy It Matters

Reconnaissance (TA0043)

Passive or active techniques used to collect information before an attack begins.

Phishing for Information, Search Open Websites/Domains

Reconnaissance helps attackers identify entry points, vulnerabilities, and potential targets.

Resource Development (TA0042)

Adversaries create or acquire tools, infrastructure, and capabilities before launching an attack.

Obtain Capabilities, Compromise Accounts

These preparations lay the groundwork for successful and scalable operations.

Initial Access (TA0001)

Adversaries attempt to gain a foothold in your network by exploiting external-facing systems or targeting users directly.

Phishing, Drive-by Compromise, Exploit Public-Facing Application

This is where most attacks begin. Preventing initial access drastically reduces the chance of a breach.

Execution (TA0002)

The attacker runs malicious code on a local or remote system after gaining access.

Command and Scripting Interpreter, Malicious File Execution

Execution enables adversaries to deploy payloads and advance further into your network.

Persistence (TA0003)

Tactics that allow attackers to maintain access across reboots, credential resets, or system upgrades.

Boot or Logon Autostart, Scheduled Task/Job

Persistence mechanisms ensure that an attacker can return even after detection or a system reboot.

Privilege Escalation (TA0004)

Attackers attempt to gain higher-level permissions on a system or domain.

Exploitation for Privilege Escalation, Access Token Manipulation, Process Injection

Elevated privileges allow attackers to access sensitive data and critical systems.

Defense Evasion (TA0005)

Techniques used to avoid detection by security tools and analysts.

Obfuscated Files or Information, Deactivation of Security Tools, Impair Defenses

Successful defense evasion allows attackers to operate undetected for longer periods.

Credential Access (TA0006)

Adversaries steal credentials to gain access to systems and services.

Brute Force, Credential Dumping, Credentials from Password Stores

Compromised credentials can give attackers legitimate access, making them harder to detect.

Discovery (TA0007)

Activities that help attackers map out the environment and identify targets.

System Information Discovery, Account Discovery

Discovery enables lateral movement and targeting of high-value systems.

Lateral Movement (TA0008)

Attackers move through the network to access additional systems or data.

Remote Services, Pass the Hash

Lateral movement expands an attacker’s reach across your organization.

Collection (TA0009)

Adversaries gather information from systems, such as files, credentials, or logs.

Screen Capture, Data Staged, Input Capture, Data From Local System

Data collection is a key step before exfiltration or impact actions.

Command and Control (TA0011)

Adversaries establish communication channels with compromised systems.

Application Layer Protocol, Encrypted Channel

Without C2, attackers cannot remotely control systems or receive stolen data.

Exfiltration (TA0010)

Stolen data is transferred out of the network to an attacker-controlled location.

Exfiltration Over Web Service, Exfiltration Over C2 Channel

This is when sensitive data leaves your environment—often triggering major impact or compliance risk.

Impact (TA0040)

Attackers attempt to disrupt, destroy, or manipulate systems and data.

Data Destruction, Service Stop, Data Encrypted for Impact

Impact techniques lead to business disruption, financial losses, and reputational damage.

Red Report 2026

Red Report 2026 connects the dots between MITRE ATT&CK® tactics, techniques, and actual adversary activity.

 

See which techniques appear most often in real-world campaigns and use this knowledge to strengthen your posture across all 14 tactics.

Get the report
The Picus Red Report 2026, open at its MITRE ATT&CK technique pages

Picus Platform Products and Modules

Validate Your Security with MITRE ATT&CK® Mapping

Picus emulates real-world threats mapped to the MITRE ATT&CK® Framework to validate the effectiveness of your security controls across every tactic. By testing against real adversary behaviors—not just theoretical risks—Picus helps you identify control gaps, measure coverage, and strengthen defenses. Use the table below to explore how each Picus product contributes to validating your security posture at every stage of the attack lifecycle.

Picus products and modules mapped to the MITRE ATT&CK tactics
Picus Attack Surface Validation (ASV) Picus Security Control Validation (SCV) Picus Attack Path Validation (APV) Picus Cloud Security Validation (CSV)
Attack Surface Validation Endpoint Attacks Network Infiltration Attacks Web Application Attacks E-mail Infiltration Attacks (Phishing Attachment/Link) Data Exfiltration Attacks URL Filtering Attack Path Validation Cloud Security Validation
Vulnerability Exploitation Malware Download

Reconnaissance

 Yes No No No No No No No No No

Resource Development

 Yes No No No No No No No No No

Initial Access

 No Yes Yes Yes Yes Yes No No No No

Execution

 No Yes No No Yes No No No Yes Yes

Persistence

 No Yes No No Yes No No No Yes Yes

Privilege Escalation

 No Yes No No Yes No No No Yes Yes

Defense Evasion

 No Yes No No Yes No No No Yes Yes

Credential Access

 No Yes No No Yes No No No Yes Yes

Discovery

 Yes Yes No No Yes No No No Yes Yes

Lateral Movement

 No Yes No No No No No No Yes Yes

Collection

 No Yes No No Yes No No No Yes No

Command and Control

 No Yes No No No No No Yes Yes No

Exfiltration

 No Yes No No No No Yes Yes Yes No

Impact

 No Yes No No Yes No No No No Yes

MITRE ATT&CK® Techniques

Active Directory Focused Resources

Active Directory is a critical component of many enterprise networks, managing authentication and authorization for users and resources. Due to its central role, it is a prime target for attackers seeking to gain extensive control over network environments. The blog posts below explained adversary techniques used in Active Directory attacks in great detail.

  • Kerberoasting attack

    What Is a Kerberoasting Attack?

    Read more
  • AS-REP roasting attack

    AS-REP Roasting Attack Explained - MITRE ATT&CK T1558.004

    Read more
  • DCShadow attack

    DCShadow Attack Explained - MITRE ATT&CK T1207

    Read more
  • Golden ticket attack

    Golden Ticket Attack Explained - MITRE ATT&CK T1558.001

    Read more
  • Pass the ticket attack

    Pass the Ticket Attack Explained - MITRE ATT&CK T1550.003

    Read more
  • Pass the hash attack

    T1550.002 Pass the Hash: Adversary Use of Alternate Authentication

    Read more

FAQ

Frequently Asked Questions

About MITRE ATT&CK®

What Is the MITRE ATT&CK® Framework?

The MITRE ATT&CK® framework is a globally accessible and free knowledge base of adversary tactics and techniques.

These techniques are based on real-world observations of adversary behaviors and are created by analyzing actual cyberattacks. MITRE ATT&CK® is a community-driven framework, continuously enriched by contributions from cybersecurity experts around the world. The power of the framework lies in its open nature—anyone can access, use, and contribute to it to improve collective defense.

How can organizations implement the MITRE ATT&CK® framework?

Organizations can implement the MITRE ATT&CK® framework by validating their security posture against tactics and techniques listed in the ATT&CK framework.

The MITRE ATT&CK® framework helps security teams identify gaps, prioritize defenses, and simulate adversary behaviors based on real-world threat intelligence.

What are the key tactics and techniques in MITRE ATT&CK®?

MITRE ATT&CK® outlines adversary behavior through tactics, which represent an attacker’s objectives, and techniques, which describe the methods used to achieve those objectives.

By leveraging open-source threat intelligence reports like the Picus Red Report, security teams can gain deep insights into how attackers may employ these techniques against their organizations.

How does MITRE ATT&CK® differ from the Cyber Kill Chain?

While both models describe stages of a cyberattack, the MITRE ATT&CK® framework provides a more granular and real-world view of attacker behavior. The Cyber Kill Chain is more linear and high-level, often used for threat detection planning.

Is the MITRE ATT&CK® framework free to use?

Yes, the MITRE ATT&CK® framework is freely available to the public. Maintained by MITRE Corporation, it is an open, globally accessible knowledge base of adversary tactics and techniques. Organizations of any size can use ATT&CK to enhance threat detection, incident response, and security assessments without any licensing cost.

How does MITRE ATT&CK® support threat intelligence?

MITRE ATT&CK® supports threat intelligence by mapping known adversary behaviors to specific techniques and tactics. This allows organizations to contextualize threats, understand attacker methods, and track threat actor groups over time. Integrating ATT&CK into threat intelligence workflows enhances the visibility of how security teams can develop prevention, detection, and response strategies against mapped techniques.