FIG_001 · enterprise matrix · v17 · reference · free

MITRE ATT&CK in kill-chain order

Fourteen tactics, 245 techniques, 629 sub-techniques, and for every single one, the log source that actually catches it. Not a taxonomy exercise — a reference you keep open in the second monitor while a queue fills up.

Every tactic opens into what the adversary is trying to do, why it matters on shift, and a technique-by-technique detection note.

Open the matrix →How to read it

How to read the matrix

A tactic is the adversary's goal — the why. A technique is how they achieve it, and carries an ID like T1059. The matrix reads left to right as a rough kill chain, but real intrusions loop: an adversary discovers, moves laterally, discovers again, escalates, and returns to credential access half a dozen times before impact.

Use it three ways. As a triage vocabulary, so your alert notes say "T1003 OS credential dumping" instead of "weird lsass thing". As a coverage map, colouring in the techniques your detections actually cover and staring at the gaps. And as a hunting backlog — pick one uncovered technique per week and go looking.

What the matrix will not tell you is priority. Fourteen tactics are not equally likely. Initial access, execution, credential access, and lateral movement account for most of what a Tier 1 analyst sees in a year.

Enterprise · 14 tactics · 245 techniques · 629 sub-techniques

The matrix

Each column is a tactic, listed in the order an intrusion typically progresses. Open one to read its full write-up and the detection notes for every technique inside it.

Mapping an alert on shift

Four questions turn a raw alert into an ATT&CK-mapped ticket that the next analyst can actually pick up.

01
What was the adversary trying to achieve?
That answer is the tactic. If lsass.exe was accessed, the goal was credentials — TA0006, regardless of which tool did it.
02
What specific method did they use?
That is the technique. Credential access via comsvcs.dll minidump is T1003.001, LSASS Memory. Record the sub-technique when you can prove it.
03
What came before it?
Pivot backwards a tactic. Credential access implies execution implies initial access. Go find those events — they are almost always in your telemetry already.
04
What comes next if I am wrong about scope?
Pivot forwards. After credential access comes lateral movement. Search for Type 3 logons from that host in the following hour before you close the ticket.

MITRE ATT&CK in kill-chain order

How to read the matrix

The matrix

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Mapping an alert on shift

What was the adversary trying to achieve?

What specific method did they use?

What came before it?

What comes next if I am wrong about scope?