Learn MITRE ATT&CK | Interactive Field Guide by Avijit Roy

01 / Guided walkthrough

From a clue to the right ATT&CK entry

Select each step. The official link changes as you move from the broad goal to a specific behavior.

Case note · hypothetical

An employee receives a targeted email containing a malicious link intended to gain access to the organization. The email alone does not show whether anyone clicked it or whether access succeeded.

Tactic · whyTechnique · howSubtechnique · more specific howProcedure · observed use

Use the behavior, not the headline

“Phishing” can mean different things. If the goal is gathering information before an intrusion, compare T1598, Phishing for Information. In this case the goal is initial access, so follow T1566. Read the description and tactic before choosing an ID.

Next, learn how to read the entry you found.Read an ATT&CK page →

02 / Page anatomy

Know where to look on a technique page

This map follows the current Enterprise page for T1566.002, Spearphishing Link. Choose a section to see the question it answers.

TA…Tactic ID: the goal.

T…Technique ID: the behavior.

T….002Subtechnique ID: a specific variant.

DET… / AN…Detection strategy / analytic. These are separate defensive entries.

Procedure ≠ subtechnique

A subtechnique is a named category of behavior. A procedure example describes a reported implementation by a group or software. Its row may link to a group (G…) or software (S…).

Now use these cues on a new case.Find a technique →

03 / Navigate on MITRE

Find a new behavior without knowing its ID

Open the official site alongside this guide. Choose the route that matches the clue you have; both routes end with checking the entry itself.

You know the adversary's goal

Open the Enterprise Matrix ↗ and find the tactic column that describes the goal.
Open that tactic, then scan its listed techniques. Select a candidate based on the observed action.
On the technique page, check its description and any listed subtechniques. Follow a subtechnique only when the evidence supports that narrower behavior.

You know the observed behavior

Use the search control on MITRE ATT&CK ↗. Search for the action in plain words, such as operating system version.
Look for a technique or subtechnique result in the correct domain. Open it; a matching title alone is not enough.
Read the description, tactic, platforms, and nearby entries. If the match is weak, revise your search words or browse the matrix.

Tactic cheat sheet: match the goal

Every Enterprise tactic answers “The adversary is trying to…”. Finish that sentence from your evidence, then open the matching column. Columns are listed left to right as they appear on the matrix, but real intrusions do not have to follow this order.

Notice the IDs are not in column order (TA0011 sits before TA0010). An ID is a stable name, not a position.

Before you record an ID

The tactic explains the goal; the technique describes the action. A procedure example illustrates reported use. A group or software name in that section does not identify who caused your event. Record what you observed separately from what you infer.

Try it yourself: a different behavior

Hypothetical clue: After gaining access to a Windows computer, an adversary checks its operating system version and hardware details. Find the closest Enterprise ATT&CK technique using either route above.

Write down before revealing the answer:

The tactic and technique IDs, names, and official URL.
The words in the clue that match the technique description.
Whether MITRE lists a more specific subtechnique.
One thing the clue does not establish.

Show a worked answer

TA0007, Discovery ↗ is the goal. T1082, System Information Discovery ↗ describes learning about the operating system and hardware. The page lists no subtechniques. The clue does not identify an adversary group, or prove what the adversary did next. If the evidence instead concerns locating files and folders, compare T1083, File and Directory Discovery ↗.

Record your mapping

A mapping is only as good as the note behind it. Keep what you saw separate from what you concluded, so someone else can check your work.

Observed evidence:  (what the log, alert, or report actually shows)
Tactic:             TA____ · ________  (the goal)
Technique:          T____ · ________   (the action)
Subtechnique:       T____.___ or "none / not supported by evidence"
Official URL:       https://attack.mitre.org/...
ATT&CK version:     v__ (from the page's Version Permalink)
Confidence:         high / medium / low, and why
Not established:    (e.g. who did it, whether it succeeded, what happened next)

Have an ATT&CK ID from a report?Try the ID lookup →

04 / Find an ID

Jump to an official entry

Saw an ID in a report or a procedure row? Paste it here. The tool reads the prefix to tell you what kind of entry it is and builds a link to MITRE. MITRE's page is the source of truth for whether an entry exists or has changed.

Enter an ID above. The letters tell you the entry type; the number gives you an exact way to find it.

Read the prefix first
Prefix	Entry type	Answers
`TA`	Tactic	What goal?
`T` / `T….nnn`	Technique / subtechnique	What action?
`M`	Mitigation	How could it be prevented or limited?
`G`	Group	Which tracked threat group reportedly used it?
`S`	Software	Which malware or tool reportedly used it?
`C`	Campaign	Which set of intrusions over a period of time?

No ID yet?

Start at the Enterprise Matrix if you know the goal, or use the official ATT&CK search if you know a behavior. Read the candidate's description, platforms, and tactic before assigning it to evidence.

Finish by checking what you learned.Start the practice questions →

05 / Practice

Can you find the right part of the page?

Seven short questions: some ask where to look on a page, others give you a new clue to map. After each answer, open the linked MITRE entry and check it yourself.

A reliable reading order

Choose the domain → name the goal → identify the behavior → check the most specific subtechnique → read procedure examples and detection strategy → record the ID and official URL. A technique may belong to more than one tactic, so verify the context.

Where to go next

Groups ↗: open one group and read which techniques it is reported to use, and the evidence cited for each.
ATT&CK Navigator ↗: color techniques on the matrix to compare a group's behavior against your detection coverage.
MITRE's resources ↗: official getting-started material and training.