A Map of Attacker Moves (MITRE ATT&CK)

Why this matters

ATT&CK's Enterprise matrix maps the post-initial-access actions: Discovery, Privilege Escalation, Defense Evasion, Lateral Movement, Persistence, Exfiltration, Impact. Each technique has IDs, detections, and real-world examples. Mapping your EDR rules and audit logs to ATT&CK is how you measure detection coverage objectively.

Demo

A typical Linux post-exploitation chain in ATT&CK IDs: T1078 (Valid Accounts), T1059.004 (Unix Shell), T1003.008 (/etc/passwd dump), T1543.002 (systemd persistence), T1071 (C2 over HTTPS), T1567 (Exfil over Web).

Try it yourself

1. Browse attack.mitre.org/matrices/enterprise. Pick five techniques relevant to your fleet and document which you can detect today.
2. Use ATT&CK Navigator to colour your coverage. The white space is your roadmap.
3. Read one APT group's profile (e.g. APT29). Notice the technique pattern; design detections for it.

References

• MITRE ATT&CK — Enterprise
• ATT&CK Navigator