MITRE ATT&CK is a knowledge base of real-world adversary behaviour. Tactics describe the attacker's goal (why); techniques describe how they achieve it. Mapping your detections to ATT&CK shows where you have coverage and where you're blind.
Initial Access TA0001
T1566: Phishing
Malicious emails, links or attachments.
Detect: Email gateway logs, user reports, URL click telemetry.
Prevent: Phishing-resistant MFA, attachment sandboxing, user reporting.
T1190: Exploit Public-Facing Application
Exploiting internet-facing apps or edge devices.
Detect: WAF and web server logs, EDR on servers, new child processes of web services.
Prevent: Patch KEV items fast, WAF, minimise exposure.
T1133: External Remote Services
Abusing VPN, RDP or Citrix with valid credentials.
Detect: VPN logs, impossible travel, new device sign-ins.
Prevent: MFA, geo/IP restrictions, ZTNA.
T1078: Valid Accounts
Using stolen legitimate credentials.
Detect: Anomalous sign-ins, unusual hours or locations.
Prevent: MFA, leaver deprovisioning, credential monitoring.
T1195: Supply Chain Compromise
Compromise via a trusted vendor, package or update.
Detect: Unexpected update behaviour, new outbound connections.
Prevent: SBOM, signature verification, vendor access reviews.
Execution TA0002
T1059: Command and Scripting Interpreter
PowerShell, cmd, bash, Python used to run commands.
Detect: Script block logging (4104), process command lines (4688, Sysmon 1).
Prevent: Constrained Language Mode, ASR rules, allow-listing.
T1204: User Execution
User opens a malicious file or pastes a command.
Detect: Office spawning shells, explorer launching powershell.
Prevent: Awareness training, ASR rules, block macros from internet.
Persistence TA0003
T1053: Scheduled Task/Job
Creating tasks or cron jobs to run malware.
Detect: Event 4698, Sysmon 1 of schtasks, cron file changes.
Prevent: Restrict task creation, monitor task changes.
T1543: Create or Modify System Process
New services or daemons.
Detect: Event 7045, systemd unit file changes.
Prevent: Least privilege, allow-listing, alert on new services.
T1547: Boot or Logon Autostart
Run keys, startup folders.
Detect: Sysmon 13 registry Run key changes.
Prevent: EDR rules, restrict user write access to autostart locations.
T1136: Create Account
Adding new local, domain or cloud accounts.
Detect: Event 4720, cloud audit logs for user creation.
Prevent: Alert on account creation outside process; PIM approvals.
Privilege Escalation TA0004
T1068: Exploitation for Privilege Escalation
Using a local vulnerability to gain admin/root.
Detect: EDR exploit detections, unexpected SYSTEM processes.
Prevent: Patch, remove local admin rights, kernel protections.
Defense Evasion TA0005
T1562: Impair Defenses
Disabling AV, EDR or logging.
Detect: EDR tamper alerts, service stopped events, gaps in log flow.
Prevent: Tamper protection, alert on missing telemetry.
T1070: Indicator Removal
Clearing logs or deleting files.
Detect: Event 1102, 104; sudden log silence.
Prevent: Forward logs to SIEM in real time; immutable storage.
T1218: System Binary Proxy Execution
Abusing signed binaries (mshta, rundll32, regsvr32).
Detect: Unusual parent-child chains and network use by LOLBins.
Prevent: WDAC/ASR rules, block LOLBins not needed.
Credential Access TA0006
T1110: Brute Force
Guessing, spraying or stuffing passwords.
Detect: Many 4625s, lockouts, failed cloud sign-ins across accounts.
Prevent: MFA, smart lockout, banned password lists.
T1003: OS Credential Dumping
Extracting credentials from LSASS, SAM or NTDS.
Detect: Access to lsass.exe (Sysmon 10), ntds.dit copies.
Prevent: Credential Guard, LSA protection, tiered admin.
T1558: Steal or Forge Kerberos Tickets
Kerberoasting, golden/silver tickets.
Detect: Event 4769 with RC4 encryption, anomalous TGS volume.
Prevent: Long random service passwords, gMSA, AES only.
T1539: Steal Web Session Cookie
Infostealers or AiTM proxies stealing session tokens.
Detect: Session use from new IP/device right after login.
Prevent: Token binding, phishing-resistant MFA, short sessions.
Discovery TA0007
T1087: Account Discovery
Enumerating users and groups.
Detect: net user/group commands, LDAP query spikes.
Prevent: Detect bulk enumeration; limit directory read where possible.
T1046: Network Service Discovery
Scanning for open ports internally.
Detect: Internal connection spikes to many ports/hosts.
Prevent: Segmentation, internal IDS, honeypots.
Lateral Movement TA0008
T1021: Remote Services
RDP, SMB, WinRM, SSH between hosts.
Detect: Logon type 3/10 between workstations, new admin share use.
Prevent: Block workstation-to-workstation traffic, tiering, LAPS.
T1570: Lateral Tool Transfer
Copying tools between systems.
Detect: File writes to admin shares, PsExec service creation.
Prevent: EDR, restrict admin shares.
Collection TA0009
T1114: Email Collection
Reading or forwarding mailbox contents.
Detect: New inbox forwarding rules, mailbox audit logs.
Prevent: Alert on forwarding rules, block external auto-forward.
T1560: Archive Collected Data
Compressing data before exfiltration.
Detect: 7z/rar/zip of large volumes on servers.
Prevent: Alert on archiving tools on servers; DLP.
Command and Control TA0011
T1071: Application Layer Protocol
C2 over HTTPS, DNS or other common protocols.
Detect: Beaconing patterns, rare domains, long DNS queries.
Prevent: Egress filtering, DNS filtering, TLS inspection where allowed.
T1219: Remote Access Software
Abusing AnyDesk, ScreenConnect etc.
Detect: Installation of RMM tools not in your approved list.
Prevent: Allow-list approved RMM tools only.
Exfiltration TA0010
T1567: Exfiltration Over Web Service
Uploading to cloud storage or file sharing.
Detect: Large uploads to personal cloud services.
Prevent: CASB, DLP, block unsanctioned storage.
T1048: Exfiltration Over Alternative Protocol
Using FTP, DNS or other channels.
Detect: Unusual protocols leaving the network.
Prevent: Default-deny egress.
Impact TA0040
T1486: Data Encrypted for Impact
Ransomware encryption.
Detect: Mass file renames/writes, ransom notes, shadow copy deletion.
Prevent: Immutable backups, EDR block mode, segmentation.
T1490: Inhibit System Recovery
Deleting backups and shadow copies.
Detect: vssadmin/wbadmin delete commands.
Prevent: Protect backup consoles with separate credentials and MFA.
T1489: Service Stop
Stopping databases or security services before encryption.
Detect: Mass service stop events.
Prevent: Alert on bulk service stops; tamper protection.
Practise mapping incidents to ATT&CK in the free Threat Intelligence course.