MITRE ATT&CK for systems

Why this matters

ATT&CK's Enterprise matrix maps the post-initial-access actions: Discovery, Privilege Escalation, Defense Evasion, Lateral Movement, Persistence, Exfiltration, Impact. Each technique has IDs, detections, and real-world examples. Mapping your EDR rules and audit logs to ATT&CK is how you measure detection coverage objectively.

Demo

A typical Linux post-exploitation chain in ATT&CK IDs: T1078 (Valid Accounts), T1059.004 (Unix Shell), T1003.008 (/etc/passwd dump), T1543.002 (systemd persistence), T1071 (C2 over HTTPS), T1567 (Exfil over Web).

Try it yourself

1. Browse attack.mitre.org/matrices/enterprise. Pick five techniques relevant to your fleet and document which you can detect today.
2. Use ATT&CK Navigator to colour your coverage. The white space is your roadmap.
3. Read one APT group's profile (e.g. APT29). Notice the technique pattern; design detections for it.

Prompt your AI

Use these three in order. Each builds on the one before.

1. Basics & terminology

In one paragraph, explain how ATT&CK structures post-exploitation knowledge.

2. Why it works (the mechanism)

Walk me through using ATT&CK to score detection coverage.

3. Advanced — application & what's next

What does ATT&CK miss as a framework, and what complements it?

References

• MITRE ATT&CK — Enterprise
• ATT&CK Navigator