The Catalog of Real Attacker Moves (MITRE ATT&CK)

Why this matters

ATT&CK is the canonical taxonomy of what attackers actually do — derived from observed incidents, organised into tactics (the 'why') and techniques (the 'how'). For web work the relevant matrices are Initial Access, Credential Access, Lateral Movement, and Exfiltration. Mapping your detection coverage to ATT&CK techniques is how mature security teams prove they're not just patching whatever's loudest.

Demo

A real attacker chain on a web app might be: T1190 (Exploit Public-Facing Application) → T1071 (Application Layer Protocol C2) → T1003 (OS Credential Dumping) → T1041 (Exfiltration over C2). Each ID has a description, real-world examples, and recommended detections.

Try it yourself

1. Browse attack.mitre.org and pick three techniques relevant to web apps. Read the detections section for each.
2. For each, ask: 'would my logging catch this today?'. The honest answer is your detection gap.
3. Write one Sigma-rule-style detection idea for one technique. Compare to attack.mitre.org's suggestions.

References

• MITRE ATT&CK
• ATT&CK Navigator