MITRE ATT&CK Threat Intelligence

MITRE ATT&CK® is a free, global knowledge base of how real attackers operate, built by the non-profit MITRE Corporation from public reports of actual intrusions. It catalogs their goals (tactics), their methods (techniques), who uses them (threat groups), what they use (malware and tools), and how to stop them (mitigations). This site presents that knowledge base in one cross-linked, searchable place.

• Attackers repeat themselves. The same few hundred techniques appear in breach after breach. Know them, and defense stops being guesswork.
• One shared language. “T1566 Phishing” means the same thing to your analyst, your vendor and your auditor.
• Spend where it counts. See which techniques most groups use, and which defenses stop the most of them.

• Security analysts & threat hunters — turn an alert into “which technique, which group, what next.”
• IT & network engineers — find the controls (MFA, segmentation, patching) that block the most attacks.
• Managers, CISOs & business owners — understand who attacks organizations like yours, and why the basics matter.
• Auditors & compliance teams — tie controls to real adversary behavior in risk assessments.
• Students & certification candidates — CISSP, CCIE Security, Security+: study how real attacks work.

1. Got an alert? Open Techniques and type its ID (e.g. T1110).
2. Researching a threat actor? Open Groups and search any name or alias.
3. Planning defenses? Start with Defend First below, then Mitigations.