Security advisories and threat reports are full of sentences like "the actors sent spearphishing emails with malicious attachments [T1566.001]", usually followed by a table packed with T-numbers. Those IDs come from MITRE ATT&CK, a globally accessible knowledge base of adversary tactics and techniques based on real-world observations, which any person or organization can use at no charge[1]. Many readers skip the table and only check the IOCs, but IOCs change quickly; the behaviors described in the table are the more durable lead.

This article is for IT and security staff who keep running into ATT&CK IDs in advisories and reports and want to put them to practical use. It explains how ATT&CK is structured and what the current version looks like, walks through a joint advisory on BlackTech to show how to read a mapping table, covers how to pick the techniques that matter, map detection coverage, check whether your logs are good enough and test for real, and ends with the rules for writing your own mappings and the most common mistakes.

What ATT&CK is: tactics, techniques, sub-techniques and procedures

The mapping guidance CISA produced together with the MITRE ATT&CK team describes the behaviors in ATT&CK at four levels, each more specific than the last[2]:

  • Tactic: *why* the adversary performs an action, that is, the goal at that point, such as obtaining credentials.
  • Technique: *how* the adversary achieves the goal, such as dumping credentials from the operating system.
  • Sub-technique: a more specific method under a technique, such as extracting credentials from LSASS memory; sub-techniques are often specific to an operating system or platform, and not every technique has them.
  • Procedure: what a particular adversary actually did, such as which tools it used and which commands it ran.

The guidance also stresses that ATT&CK is not a linear, left-to-right sequence: an adversary does not need every tactic, and may exfiltrate data and then go back to set up more persistence[2]. ATT&CK is organized into three matrices by technology domain: Enterprise, Mobile and Industrial Control Systems (ICS)[3]. A typical corporate IT environment maps to the Enterprise matrix, which covers Windows, Linux, macOS, network devices, containers and cloud services[2].

How to read the IDs

Take T1566.001. T1566 is the Phishing technique and .001 is its sub-technique Spearphishing Attachment, under the Initial Access tactic; the same technique has three other sub-techniques: spearphishing link, spearphishing via service and spearphishing voice[4]. A technique page also shows several other kinds of ID[4]:

  • TA IDs are tactics: for example, TA0001 is Initial Access.
  • Procedure Examples list uses observed in the wild, drawn from groups (G IDs, such as G0018 admin@338), software (S IDs, such as the malware S0331 Agent Tesla) and campaigns (C IDs, such as C0028, the 2015 Ukraine Electric Power Attack).
  • Mitigations (M IDs): for T1566.001 these include M1054 Software Configuration (validating sender domains with SPF, DKIM and DMARC) and M1017 User Training; for setup, see the SPF, DKIM and DMARC deployment guide.
  • Detection strategies (DET IDs) are broken down into platform-specific analytics (AN IDs), illustrated with an example later in this article.

In ATT&CK, a "Group" is an activity cluster tracked by a common name in the security community. Different organizations often track similar activity under different names and their definitions may only partly overlap, so ATT&CK lists known equivalents as "Associated Groups"[5].

The current version: v20, and three structural changes in the past two years

As of November 2026, the latest major release is ATT&CK v20, published on October 13, 2026, followed by a v20.1 correction release. The Enterprise matrix has 15 tactics, 227 techniques and 479 sub-techniques, and the knowledge base as a whole covers 182 groups, 971 pieces of software and 61 campaigns; this release also added AI-focused and AI-enabled techniques[3]. Three changes over the past two years directly affect how you read older advisories and use older tools:

  1. Detection is now modelled as detection strategies: v18 (October 2025) replaced the detection text on technique pages with Detection Strategies and Analytics, made major updates to Data Components and deprecated Data Sources[6]. In v20 the Enterprise matrix has 703 detection strategies and 1,770 analytics[3].
  2. Defense Evasion was split into two tactics: v19 (April 2026) split Defense Evasion in the Enterprise matrix into Stealth and Defense Impairment[7]. Watch the IDs: TA0005 is now named Stealth, and Defense Impairment is the new TA0112[8]. An older advisory's "TA0005 Defense Evasion" will show up as Stealth on today's site.
  3. Some techniques were replaced: also in v19, T1562 Impair Defenses and several related techniques were revoked in favor of Disable or Modify Tools[7]; opening T1562 on the ATT&CK website redirects you to the page for the new ID, T1685.

Reading an advisory's ATT&CK mapping: the BlackTech joint advisory

In September 2023, the U.S. NSA, FBI and CISA, together with Japan's National Police Agency and NISC, published joint advisory AA23-270A on BlackTech, with ATT&CK IDs in the text and a full mapping in the appendix[9]. MITRE ATT&CK records that this group has primarily targeted organizations in East Asia (particularly Taiwan, Japan and Hong Kong) and the U.S.[10], which makes it a good one to practice on. Work through tables like this in five steps:

  • Check the version first: the advisory states that it uses ATT&CK for Enterprise version 13.1[9]. The version determines tactic names and IDs, and 13.1 predates the v19 tactic split.
  • The bracketed IDs in the text: IDs are tagged directly in the narrative, for example the actors disabling logging [T1562] and abusing trusted domain relationships [T1199] to pivot between international subsidiaries and domestic headquarters' networks[9]. This is the style CISA recommends: the ID sits right next to the sentence describing the behavior, so readers see what was done and which technique it maps to at the same time[2].
  • The appendix tables: Tables 2 to 9 are eight tables, one per tactic, with columns for technique title, ID and use[9]. The Use column is what matters: it explains how the adversary actually used the technique in this operation; the T1542.004 row, for example, says the actors modify router firmware to maintain persistence. CISA also advises report authors to write this column so that readers can understand the rationale for each mapping[2].
  • Rows with only a tactic ID: some rows name only a tactic, for example "TA0001 Initial Access: the actors gain access to victim networks by exploiting routers"[9]. CISA's guidance says to stop at the tactic level only when there is not enough detail to identify a technique, and that a tactic-only mapping is not actionable enough for detection on its own[2]. When you see one, go back to the narrative for detail, and if there is none, treat it as an information gap.
  • Check against the current version: Table 6 is headed "Defense Evasion", and the T1562 it contains has since been replaced. Before building a detection list from an older advisory, open every ID on the ATT&CK website and confirm its current name, tactic, mitigations and detection strategy; if your own detection rules are tagged with ATT&CK IDs, review them after each new release too.

The same advisory shows why behaviors outlast IOCs: the authoring agencies note that it would be trivial for BlackTech to modify values in its backdoors and render specific signatures of this router backdoor obsolete, and that more robust detection comes from monitoring network devices for unauthorized downloads of bootloaders and firmware images and for reboots[9]. That is the difference between IOCs and TTPs (tactics, techniques and procedures): hashes, IPs and domains cost almost nothing to swap, but to give up the behavior of tampering with router firmware, an attacker has to rewrite tools or change approach. For how to check IOCs and the Pyramid of Pain, see How to Check Your Environment Against Advisory IOCs; for the tradecraft of BlackTech and other state-sponsored groups and what to defend first, see State-Sponsored Hackers (APT).

Applying ATT&CK to your own environment

Start with the groups and techniques that are relevant to you

The Enterprise matrix has hundreds of techniques and sub-techniques, far too many to tackle at once. A practical starting point is to pick the groups likely to target your region or industry. Examples whose ATT&CK group descriptions explicitly mention Taiwan include[5]:

  • BlackTech (G0098): has primarily targeted East Asia (particularly Taiwan, Japan and Hong Kong) and the U.S., including media, construction, engineering, electronics and financial companies[10].
  • Chimera (G0114): active since at least 2018, targeting the semiconductor industry in Taiwan as well as data from the airline industry.
  • Tropic Trooper (G0081): targets Taiwan, the Philippines and Hong Kong, focusing on government, healthcare, transportation and high-tech industries, and has been active since 2011.
  • Tonto Team (G0131): has primarily targeted South Korea, Japan, Taiwan and the U.S., including government, military, energy, mining, financial, education, healthcare and technology organizations.

Each group page lists the techniques the group has used and offers a Navigator layer to download or view[10]. Stack the layers for several relevant groups, and the techniques that recur are your first candidates. Then filter for your environment: a company with no macOS, for instance, can use Navigator's platform filter to drop techniques that apply only to macOS[11]. Finally, add techniques from recent advisories that apply to your environment; if the VPN or firewall brand you run is named, for example, move the matching initial access techniques up the list.

Map detection coverage with Navigator

ATT&CK Navigator is MITRE's tool for annotating the matrix. It can show defensive coverage, red and blue team planning or the frequency of detected techniques, and it is built around layers in which you can color, score and comment on each technique[11]. Layers can also be combined, for example by adding the scores of two group layers or by building a new layer from conditions using and, or and not; only layers of the same domain and the same ATT&CK version can be combined[11]. In practice, keep three layers:

  1. Threat layer: techniques used by relevant groups, plus techniques from recent advisories.
  2. Coverage layer: scored on what is really in place, for example 0 for no visibility, 1 for logs but no rule, 2 for a rule, and 3 for a rule that has been tested.
  3. Gap layer: computed from the other two to find techniques that are in the threat layer but low on coverage; this is your detection backlog. Together these layers amount to a list of your defensive gaps, so store and share them as confidential material.

Check whether your logs can support the detection

Detection strategies spell out the data a detection needs. Take DET0236, the detection strategy for T1566.001: it has three analytics, for Windows, Linux and macOS. The Windows analytic chains together "inbound email with an attachment from a suspicious or spoofed sender → attachment written to disk → abnormal process execution (for example Office spawning PowerShell or CMD) → outbound network activity", and needs Microsoft 365 mail send/receive records plus Sysmon file creation (event 11), process creation (event 1) and network connection (events 3 and 22) logs[12]. The page also lists parameters to tune for your environment, such as the high-risk attachment extensions to watch, suspicious parent-child process pairs and the time window for correlating events[12].

Hold that list up against your environment. Is mail logging on, and how long is it kept? Do endpoints run Sysmon or EDR, and do process logs reach the SIEM? If any piece is missing, the detection strategy cannot be fully implemented and that cell should not count in your coverage layer. For which logs to prioritize and how long to keep them, see What to Log and How Long to Keep It; for how detection tools and services divide the work, see EDR, XDR, SIEM, SOC and MDR. Other articles use the same mapping approach: Protecting Active Directory and Privileged Accounts cites the DCSync detection strategy, and Infostealers and Leaked Credentials covers T1539, stealing web session cookies.

Validate with purple-team testing

A rule that has been written is not a rule that fires. In purple-team testing, the attacking side actually emulates a technique while the defending side checks for alerts in real time, which makes it the most direct way to validate coverage. Atomic Red Team is an open-source, community-developed library of tests published on GitHub by Red Canary; each test is mapped to an ATT&CK technique so security teams can test their environments quickly, portably and reproducibly[13]. Tests are stored in folders named by ATT&CK technique ID and include prerequisites, attack commands and cleanup commands. The project's own guidance says to always ask the environment owner for permission before running a test, ideally to use a test machine that mimics your environment's build with your security tools active, and notes that some tests change the environment, so the cleanup commands should be run afterwards[14]. After a test, note what your security tools collected and use it to improve detection[14]; only an alert that has actually fired, with enough detail for the on-duty analyst to act on, should be marked as validated in the coverage layer.

Writing your own mappings: CISA's ATT&CK mapping best practices

When you tag incident reports, internal threat intelligence or exercise records with ATT&CK, CISA's Best Practices for MITRE ATT&CK Mapping is a useful reference. It was first published in June 2021 and revised as version 2.0 in January 2023, at which point it referred to ATT&CK v12, when the Enterprise matrix had 14 tactics[2]; the method still applies, but terms such as tactic names and data sources need to be checked against the current version. The recommended steps are[2]:

  1. Find and research the behavior: look not for IOCs but for how the adversary interacted with systems, how it got in, what it did afterwards and whether it abused built-in system functions; where information is thin, go back to the original reporting and other sources for context.
  2. Identify the tactic: ask *why* the adversary did it, whether to steal data, destroy data or escalate privileges.
  3. Identify the technique: compare the behavior with the descriptions of the techniques under that tactic. One behavior can map to several techniques at once; HTTP command-and-control traffic over port 8088, for example, maps to both Non-Standard Port (T1571) and Application Layer Protocol: Web Protocols (T1071.001).
  4. Identify the sub-technique: read the sub-technique descriptions carefully; if there is not enough information, stop at the parent technique rather than guess.

The guidance also lists three common mistakes[2]:

  • Leaping to conclusions: deciding without enough evidence, such as mapping malware that uses ports 80 or 443 to web protocols without confirming that it actually uses HTTP or HTTPS.
  • Missed opportunities: overlooking that one behavior may map to several techniques; accessing an environment through an external VPN maps to External Remote Services (T1133), but if there is information that legitimate credentials were abused, it may also map to Valid Accounts (T1078).
  • Miscategorization: misunderstanding the difference between similar techniques, such as mapping malware's ability to delete arbitrary files to Data Destruction (T1485) instead of Indicator Removal: File Deletion (T1070.004).

Common mistakes and related frameworks

Common mistakes

  • A colored cell is not protection: Navigator lets users decide what colors and scores mean[11]. A green cell may only mean "we bought a product" or "someone wrote a rule", not that the rule receives logs, works on every platform or actually fires. Record the basis for every score and let test results decide.
  • One technique often needs several detections: for the single sub-technique T1566.001, the detection strategy has analytics for three platforms, each correlating three or four types of records[12]; T1566 also has link, service and voice sub-techniques[4], so blocking attachments does not block links. Track coverage at the sub-technique and platform level.
  • Vendor coverage claims need testing: when you hear that a product "covers N ATT&CK techniques", ask which ATT&CK version, whether coverage goes down to sub-techniques, which platforms are supported and which log sources are required, then confirm during a proof of concept that alerts actually appear in your own environment.
  • Not every technique matters equally: CISA's guidance warns that the public reporting behind mappings carries biases: novel techniques get reported more often, each publisher sees only some techniques, certain kinds of victims are more likely to be reported on, and not every adversary behavior is documented in ATT&CK[2]. Prioritize by your industry, platforms and the incidents you have actually seen, rather than trying to color in the whole matrix.

Related frameworks: D3FEND and ATLAS

  • MITRE D3FEND: a knowledge graph of cybersecurity countermeasures that groups defensive techniques into categories such as Model, Harden, Detect, Isolate, Deceive, Evict and Restore, and lets you look up related defensive techniques from an ATT&CK technique. The site currently shows version 1.6.0, and its ATT&CK technique list already uses the post-v19 IDs, such as T1685[15].
  • MITRE ATLAS: catalogs attacks on AI systems and models in a tactics, techniques and case studies format; data release v2026.10, published on October 28, 2026, contains 16 tactics, 129 techniques and 77 case studies[16]. For the risks of adopting generative AI, see Generative AI security.

Action checklist

  • When reading an advisory, first note which ATT&CK version it uses, then open each ID in its table on attack.mitre.org to confirm the current name, the tactic, and whether it has been replaced.
  • Pick three to five groups from ATT&CK's group pages that target Taiwan or your industry, download their Navigator layers and stack them into a priority technique list.
  • Build a coverage layer that scores each technique as "no visibility / logs / rule / tested", and record the basis for each score and the ATT&CK version used.
  • For priority techniques, open the detection strategy pages, list the log sources required and compare them with what you actually collect and how long you keep it; fill the key gaps first (such as endpoint process creation and mail logs), then write or tune detection rules.
  • Run purple-team tests on a few priority techniques each quarter: get authorization, run them on a test machine, run the cleanup commands afterwards, and feed the results back into the layer.
  • When evaluating EDR, SIEM or MDR, ask vendors which sub-techniques and platforms they cover and which logs they need, and test it during the proof of concept.
  • Tag internal incident reports and exercise records with ATT&CK IDs following CISA's guidance, so future advisory checks and trend analysis share a common language.
  • Subscribe to advisories and use the same process to update your threat layer when new ones come out; if you want outside help assessing your detection capability, see our security health check service.