What Are MITRE ATT&CK and MITRE D3FEND?

MITRE ATT&CK and MITRE D3FEND are two free frameworks that give security teams a shared language. ATT&CK catalogs what attackers do, based on real-world observations. D3FEND catalogs what defenders can do about it. Both changed in the past two years. ATT&CK rebuilt its detection guidance in October 2025, and ATT&CK v19 added a 15th tactic in April 2026. D3FEND reached version 1.0 in January 2025 and now sorts its countermeasures into seven tactics.

This guide covers what each framework contains, what changed, and how SOC teams use the two together. The animated explainer below covers the basics in under two minutes.

What Is MITRE ATT&CK?

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a knowledge base of attacker behavior built from real-world observations. Each entry describes a behavior adversaries use, the platforms it affects, the groups known to use it, and how defenders can detect and mitigate it. MITRE publishes major releases twice a year.

Who Is MITRE?

MITRE is a not-for-profit organization that supports U.S. government agencies at the federal, state, and local level and works with academia and industry. It works in many domains, with a focus on technology.

The name MITRE looks like an acronym, but it isn’t one. As the story goes, a board member chose it in 1958 because it sounded good and had no existing meaning.

The History of MITRE ATT&CK and D3FEND

ATT&CK began in 2013 as a MITRE research project on post-compromise detection in enterprise networks. The researchers needed a way to document adversary tactics, techniques, and procedures (TTPs) that:

• Drew from real-world incidents
• Went beyond conventional indicators of compromise (IOCs)
• Was more actionable than existing kill chain and life cycle models

MITRE built ATT&CK for internal use and released it publicly in 2015. It is now a standard reference for threat intelligence, detection engineering, and incident response. Its success led to the ATT&CK Evaluations program, which tests security products against emulated real-world attacks.

ATT&CK now spans three domains: Enterprise, Mobile, and Industrial Control Systems (ICS). Three recent releases changed how teams use it:

• October 2025 (v18). MITRE replaced the short detection notes on each technique with Detection Strategies and platform-specific analytics, and retired the old Data Sources objects.
• April 2026 (v19). MITRE split Defense Evasion into two tactics, Stealth and Defense Impairment, which brought the Enterprise matrix to 15 tactics. The release also added sub-techniques to ICS for the first time.
• August 2026 (v19.2). ATT&CK published its first Agile release, a narrower update that adds Groups, Software, and Campaigns between the twice-yearly releases when new threat activity emerges.

MITRE released D3FEND as a beta in June 2021, with funding from the NSA, to catalog the defensive side. It reached version 1.0 in January 2025.

What Are the Different ATT&CK Frameworks?

MITRE ATT&CK for Enterprise

The Enterprise matrix is the original and the one most people mean when they say “MITRE ATT&CK.” It covers Windows, macOS, Linux, cloud platforms (Office Suite, Identity Provider, SaaS, and IaaS), network devices, containers, and ESXi. Its PRE platform covers the preparation attackers do before an intrusion, such as reconnaissance and building infrastructure.

MITRE ATT&CK for Mobile

The Mobile matrix covers Android and iOS. It describes techniques specific to mobile devices, such as abusing app installation and discovering device details. In v19, MITRE began adding Detection Strategies to the Mobile domain.

MITRE ATT&CK for ICS

The ICS matrix covers attacks on industrial control systems and operational technology, such as manipulating process control, abusing industrial protocols, and tampering with controller firmware. Defenders of critical infrastructure use it to recognize and stop threats to the systems that run physical processes. v19 added sub-techniques to ICS for the first time.

How Many Tactics and Techniques Are in MITRE ATT&CK?

As of ATT&CK v19 (April 2026), the Enterprise matrix has 15 tactics, 222 techniques, and 475 sub-techniques.

ATT&CK Tactics

Tactics describe what an adversary is trying to achieve at a given stage of an intrusion. Their order follows the path an attack often takes, which makes ATT&CK a more detailed version of the cyber kill chain, the attack-sequence model Lockheed Martin created. Knowing the sequence helps a security team anticipate the attacker’s next step and break the chain.

In v19, MITRE split Defense Evasion into two tactics. Stealth covers the ways attackers avoid being noticed. Defense Impairment covers the ways they break the defenses themselves, such as disabling security tools or clearing logs.

The 15 tactics in MITRE ATT&CK are:

1. Reconnaissance. Adversaries gather information about target systems, networks, and people to find weaknesses and plan later steps.
2. Resource Development. Adversaries create or acquire what they need for the operation, such as malware, accounts, credentials, and infrastructure.
3. Initial Access. Adversaries gain a first foothold in a system, network, or device.
4. Execution. Adversaries run malicious code.
5. Persistence. Adversaries set up ways to keep access through reboots, credential changes, and other interruptions.
6. Privilege Escalation. Adversaries gain higher levels of access and control.
7. Stealth. Adversaries avoid being noticed, for example by hiding artifacts, obfuscating files, or running code inside legitimate processes.
8. Defense Impairment. Adversaries disable or modify security tools, logs, and firewalls so defenses stop working.
9. Credential Access. Adversaries steal, collect, or crack passwords, tokens, and other credentials.
10. Discovery. Adversaries learn about the environment to plan their next moves.
11. Lateral Movement. Adversaries move from system to system inside the network.
12. Collection. Adversaries gather the data they are after.
13. Command and Control. Adversaries set up channels to manage compromised systems remotely.
14. Exfiltration. Adversaries move stolen data out of the environment.
15. Impact. Adversaries disrupt, destroy, or manipulate systems, data, or operations.

ATT&CK Techniques

Techniques describe how an adversary reaches a tactic’s goal. The Enterprise matrix has 222 techniques, and many serve more than one tactic. Scheduled Task/Job (T1053), for example, appears under Execution, Persistence, and Privilege Escalation.

Sub-techniques, added in 2020, describe specific variants of a technique. v19 has 475 of them. Scheduled Task/Job has five: At, Cron, Scheduled Task, Systemd Timers, and Container Orchestration Job.

What Does MITRE ATT&CK Include Other than Tactics and Techniques?

Each technique page links to related objects that help defenders act on it.

Platforms

Platforms are the operating systems and environments where a technique can occur. You can filter the Enterprise matrix by platform, and each technique page lists the platforms it affects.

Mitigations

Mitigations are security controls that stop a technique from succeeding, such as multi-factor authentication, network segmentation, or patching. Enterprise ATT&CK lists 44 mitigations, each mapped to the techniques it counters.

Detection Strategies

Detection strategies describe how to spot a technique in your environment. Since v18, each technique links to one or more detection strategies, and each strategy points to analytics written for specific platforms. Each analytic names the data components and log sources it needs.

For T1053, detection strategy DET0094 looks for new or modified scheduled tasks, cron jobs, and launch agents followed by unusual process execution. Its analytics use data components such as Scheduled Job Creation, Process Creation, and File Modification.

Groups

ATT&CK profiles more than 170 threat groups by the techniques, targets, and motivations seen in public reporting. Those profiles let you anticipate the behavior of the groups most likely to target your industry.

Campaigns

Campaigns are sets of related activity tied to one actor with one goal, such as the SolarWinds Compromise of 2020. MITRE maps each campaign’s known techniques to the matrix, so teams can see which controls would have stopped a similar attack.

Software

Software covers the malware and tools adversaries use, from custom implants to legitimate utilities they abuse. v19 tracks more than 900 entries across its three domains.

What Are the Most Common ATT&CK Techniques?

The Center for Threat-Informed Defense, a nonprofit research organization at MITRE, runs the Sightings Ecosystem. It collects anonymized reports of ATT&CK techniques seen in real attacks. Its latest analysis covers sightings from August 2021 to September 2023. Fifteen techniques made up more than 80% of events. In order, they were:

1. Command and Scripting Interpreter (T1059)
2. Obfuscated Files or Information (T1027)
3. Ingress Tool Transfer (T1105)
4. Modify Registry (T1112)
5. Indicator Removal (T1070)
6. User Execution (T1204)
7. Hide Artifacts (T1564)
8. Process Injection (T1055)
9. OS Credential Dumping (T1003)
10. Remote Services (T1021)
11. Data Encrypted for Impact (T1486)
12. Replication Through Removable Media (T1091)
13. System Information Discovery (T1082)
14. Windows Management Instrumentation (T1047)
15. Impair Defenses (T1562)

Most of these techniques abuse legitimate system tools, so the report recommends strong baselines and restricted permissions. One entry has changed since publication: ATT&CK v19 revoked Impair Defenses (T1562) and replaced it with Disable or Modify Tools (T1685).

MITRE’s first Sightings report, which covered 2019 to 2021, ranked Scheduled Task/Job (T1053) as the most observed technique.

What Is MITRE D3FEND?

MITRE D3FEND is a knowledge graph of cybersecurity countermeasures. ATT&CK describes attacker behavior. D3FEND describes defensive techniques and links each one to the attacker techniques it counters. The NSA Cybersecurity Directorate funds the project, and version 1.6 is current as of September 2026.

D3FEND also models the digital artifacts that defenses act on, such as processes, files, credentials, and network traffic. Those artifacts connect each defense to the attacks it applies to. D3FEND 1.0 added D3FEND CAD, a drag-and-drop tool for diagramming how attacks and defenses interact in a specific system.

What Does D3FEND Stand For?

According to MITRE, D3FEND stands for Detection, Denial, and Disruption Framework Empowering Network Defense.

What Are the Stages of MITRE D3FEND?

The D3FEND matrix organizes defensive techniques into seven tactics:

1. Model
2. Harden
3. Detect
4. Isolate
5. Deceive
6. Evict
7. Restore

The Model tactic covers building a complete picture of your systems, assets, networks, and how they depend on each other.

The Harden tactic covers strengthening systems before an attack: reducing vulnerabilities, shrinking the attack surface, and making each system harder to compromise.

The Detect tactic covers identifying suspicious or malicious activity in your networks and systems quickly.

The Isolate tactic covers containing compromised systems, devices, or network segments so an attack cannot spread.

The Deceive tactic covers decoys and controlled environments that mislead attackers and let defenders observe them.

The Evict tactic covers removing attackers from a network, system, or environment once they have been detected.

The Restore tactic covers returning systems to a known good state after an attacker is removed. Its techniques include restoring files, configurations, databases, and user account access.

How Is ATT&CK Used in Security Operations?

Where to Begin with MITRE ATT&CK

Many organizations say they want to “implement MITRE ATT&CK,” but the knowledge base is large enough to be overwhelming. These use cases are a practical place to start.

Assessing Coverage

Start by checking which techniques your current tools and processes can detect. Mapping the whole matrix at once is out of scope for most teams, so assess one high-priority technique at a time.

Each technique page lists its detection strategies. Open the analytics for the platforms you run and note the data components each one needs. If you already collect that data, compare MITRE’s analytics to the rules running in your security information and event management (SIEM) or endpoint detection and response (EDR) tools.

Take Scheduled Task/Job (T1053). Attackers who are living off the land often use Windows Task Scheduler, schtasks, or cron to run malicious programs and keep access. The analytics for T1053 rely on data components such as Scheduled Job Creation, which maps to Windows Security event 4698, and Process Creation, which maps to Sysmon event 1. If you collect those events and alert on them, you have coverage, even if you never labeled it T1053. If you don’t collect them, you have found a gap to close. If you collect them but have no rule, write one or adapt an open-source analytic.

Mapping Coverage

As you assess more techniques, a coverage map starts to form. Some data components, such as Process Creation, Command Execution, and File Modification, support detections for many techniques, so collecting them first improves coverage across the matrix. Track your results in ATT&CK Navigator, MITRE’s free web app for annotating the matrix, building heat maps, and comparing layers.

Evaluating Tools

ATT&CK also helps you evaluate new tools. A tool is worth buying when it closes gaps against the techniques most relevant to you. Imagine an oil and gas company with operations in the Middle East weighing security investments. ATT&CK lists groups such as MuddyWater (G0069) and APT33 (G0064) as active in the region, with a history of targeting oil and gas companies.

Those groups use phishing emails with malicious Microsoft Word documents or HTML applications (T1204), PowerShell to run malicious payloads (T1059.001), and tools like LaZagne and Mimikatz to harvest credentials from browser caches and files (T1003). Neither group is associated with distributed denial of service (DDoS) attacks.

Based on this analysis, DDoS protection is a lower priority. A web application firewall would address some attack vectors but does little against malicious email payloads. The most relevant tools detect malicious activity on compromised endpoints or deliver threat intelligence on the activity of known advanced persistent threat (APT) groups.

Modeling Threats

ATT&CK catalogs APT groups with the industries they are known to target. Look up the major threats to your industry and the techniques those groups use most. For example, the Carbanak group relies heavily on Remote Access Tools (T1219) such as AmmyAdmin and TeamViewer to control infected systems.

Map those techniques in ATT&CK Navigator. If you have already mapped your coverage, add it as a second layer and compare. The overlap shows your high-risk gaps in detection and response.

How to Use the MITRE ATT&CK Navigator

ATT&CK Navigator is a free, customizable interface for the ATT&CK matrix. Security teams use it for:

1. Visualizing ATT&CK data. Filter the matrix to the tactics, techniques, and platforms that matter to your organization, industry, or threat landscape.
2. Mapping and tracking. Map known adversary behaviors and incidents to specific techniques and track them over time.
3. Strategic planning. Align your defenses and detection coverage with the adversary techniques you are most likely to face.
4. Incident response. Track adversary techniques as you discover them during an incident.
5. Threat intelligence. Layer threat intelligence data onto the matrix to follow the latest adversary behavior.
6. Reporting. Export layers and visuals to communicate findings and plans to stakeholders and leadership.

How to Increase MITRE ATT&CK Coverage

The goal of using ATT&CK is to improve your defenses against known adversary techniques. These methods help close coverage gaps.

Developing Analytics

Analytics are detection queries you run against collected logs, usually in a SIEM. Since v18, ATT&CK publishes platform-specific analytics for each technique, and MITRE’s Cyber Analytics Repository (CAR) offers more. If a rule is written for a different SIEM than yours, the Sigma rule format can translate it. Tune each analytic to filter out false positives before you use it to trigger alerts in your SIEM or SOC platform.

Mitigations

Each technique also lists mitigations: policies, tools, or controls such as Multi-Factor Authentication (M1032), Network Segmentation (M1030), and SSL/TLS Inspection (M1020). Check your coverage by reviewing the mitigations on each technique page, or start from a mitigation you already have and see every technique it counters.

Testing Coverage

Test your defenses with adversary emulation, where a red team replicates the behavior of a known adversary. Without a red team, you can start with open-source scripts such as Atomic Red Team, which replicate individual ATT&CK techniques:

1. Pick an APT group, list its known techniques, and compare them to your map of detections and mitigations.
2. Run an Atomic Red Team test for each technique, and compare what your tools actually detect and block to what your coverage map predicted.

Correlating Events with ATT&CK

Many security vendors build ATT&CK into their products. Some EDR tools tag events with ATT&CK techniques when they match MITRE’s criteria, and some publish maps of the techniques they cover, which saves you from assessing those techniques by hand.

How to Use D3FEND in Security Operations

Where to Begin with MITRE D3FEND

D3FEND is younger than ATT&CK, and many teams are still working out how to use it. These three uses are a good start.

Visualize Your Coverage

The D3FEND matrix shows which defensive techniques you can carry out today. Mapping your coverage reveals imbalances, for example heavy investment in Detect and Evict with little in Model, Harden, or Restore. It also helps you judge a new tool: if it doesn’t add coverage, it may not be the right investment.

Set Benchmarks for Improvement

D3FEND gives security teams a way to measure improvements in their defensive posture and set benchmarks over time. MSSPs can use the same benchmarks to show clients how their defenses have improved.

Using D3FEND Best Practices in Playbooks

D3FEND countermeasures are a solid basis for detection and response playbooks in agentic SOC platforms, SOAR, and XDR tools. Start with the ATT&CK techniques you see most often, then build each playbook from the D3FEND countermeasures that apply.

A D3FEND-based playbook for Scheduled Task/Job (T1053) could run in this order:

1. Detect. Scheduled Job Analysis (D3-SJA) inspects new or changed scheduled tasks, and Process Spawn Analysis (D3-PSA) checks what each task launches.
2. Isolate. Executable Allowlisting (D3-EAL) blocks the task’s payload from running again.
3. Evict. Process Termination (D3-PT) stops the malicious process, and the task itself is removed.
4. Restore. Restore Configuration (D3-RC) returns the scheduler and affected settings to a known good state.

How Are ATT&CK and D3FEND Used Together?

ATT&CK and D3FEND describe two sides of the same activity: what attackers do and what defenders do in response. D3FEND links its techniques to ATT&CK techniques, so you can look up an attacker technique in D3FEND and see the countermeasures that apply. For T1053, those include Scheduled Job Analysis (D3-SJA), a Detect technique that inspects scheduled jobs for malicious changes.

Use ATT&CK to find the techniques that matter most to you, whether from MITRE’s group profiles, Sightings data, or trends in your own detections. Then build response plans and playbooks for those techniques from D3FEND’s countermeasures.

How Morpheus Operationalizes ATT&CK and D3FEND

Morpheus is the agentic SOC platform that triages, investigates, and orchestrates governed response on every alert. ATT&CK and D3FEND run through each of those steps.

Investigation Mapped to ATT&CK

Attack Path Discovery (APD), D3’s investigation engine, traces every alert across identities, endpoints, cloud, and email infrastructure. It maps blast radius, validates IOCs, identifies the chain of techniques mapped to MITRE ATT&CK, and drafts remediation before an analyst opens the case.

When an EDR tool tags an alert with a suspected ATT&CK technique, Morpheus checks that tag against data from your SIEM, network tools, and cloud platforms. APD is read-only by design. The investigation produces context, and your chosen autonomy mode governs the action layer.

Verified Verdicts on Every Finding

Every Morpheus finding is graded by evidence quality. Confirmed means the source telemetry is attached. Inferred means the reasoning is shown and the evidence is circumstantial. Gap means Morpheus looked, found nothing, and says so rather than filling the gap.

For a technique like T1053, the grade tells the analyst whether the malicious scheduled task was observed in telemetry or inferred from surrounding activity. The reasoning behind each grade is readable and correctable, and a correction persists across future investigations. When Morpheus can’t confirm a finding, it grades it Gap and hands the alert to an analyst.

Governed Response Built on D3FEND

Morpheus builds response for common ATT&CK techniques, such as Scheduled Task/Job and OS Credential Dumping, from D3FEND countermeasures and tailors it to your stack. It runs on one engine: a deterministic playbook engine with approval gates, with the agentic layer on the same engine.

You pick how much Morpheus does on its own. The four autonomy modes are settings on one engine, chosen per use case and changed by configuration:

• Deterministic. Rule-based playbooks run end to end. No AI in the chain.
• AI-Assisted. Morpheus investigates and recommends. Your analyst approves every step.
• AI-Led. Morpheus investigates and drafts the response. You sign off, and the response runs.
• Autonomous. Investigation and response run at AI speed, with gates set at design time. You can roll back any action.

Triage, investigation, response, and case notes land on one audit trail per incident.

To measure what an agentic SOC changes in your own operation, read Turn Agentic SOC Into Measurable Results. It covers seven measurements, each with a baseline method and a 90-day target.

MITRE ATT&CK and D3FEND Resources

Research and guides:

• Turn Agentic SOC Into Measurable Results
• The Agentic SOC That Refuses to Guess: A Large US-Based MSSP Tried to Break APD 2.0 and Couldn’t
• How to Catch an AI SOC Analyst Bluffing

Blogs:

• MITRE ATT&CK v19: What Defense Impairment (TA0112) Means for Your SOC
• MITRE ATT&CK is Deprecating a Tactic: 3 Takeaways from the Defense Evasion Break-up
• The Agentic SOC That Refuses to Guess

From MITRE:

• ATT&CK v19 release notes (April 2026)
• ATT&CK v18 release notes (October 2025)
• MITRE D3FEND matrix
• ATT&CK Navigator
• Sightings Ecosystem: Top 15 Techniques