## MITRE ATT&CK Framework\n\n### What is ATT&CK?\n\n**Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK)** is a globally-accessible knowledge base of adversary behavior based on real-world observations.\n\n### Structure\n\n```\n┌─────────────────────────────────────────────────────────────┐\n│                       TACTICS (Why)                          │\n│  Reconnaissance → Initial Access → Execution → Persistence  │\n│    → Privilege Escalation → Defense Evasion → Credential    │\n│    Access → Discovery → Lateral Movement → Collection →     │\n│    Command & Control → Exfiltration → Impact                │\n└─────────────────────────────────────────────────────────────┘\n                              │\n                              ▼\n┌─────────────────────────────────────────────────────────────┐\n│                    TECHNIQUES (How)                          │\n│  Example: T1566 - Phishing                                   │\n│    └── Sub-techniques:                                       │\n│        T1566.001 - Spearphishing Attachment                 │\n│        T1566.002 - Spearphishing Link                       │\n│        T1566.003 - Spearphishing via Service                │\n└─────────────────────────────────────────────────────────────┘\n                              │\n                              ▼\n┌─────────────────────────────────────────────────────────────┐\n│                    PROCEDURES (What)                         │\n│  "APT28 sent spearphishing emails with macro-enabled Word   │\n│   documents to defense contractors in January 2024"         │\n└─────────────────────────────────────────────────────────────┘\n```\n\n### The 14 Tactics\n\n| # | Tactic | Goal |\n|---|--------|------|\n| 1 | Reconnaissance | Gather info about target |\n| 2 | Resource Development | Build attack infrastructure |\n| 3 | Initial Access | Get into the network |\n| 4 | Execution | Run malicious code |\n| 5 | Persistence | Maintain foothold |\n| 6 | Privilege Escalation | Gain higher permissions |\n| 7 | Defense Evasion | Avoid detection |\n| 8 | Credential Access | Steal credentials |\n| 9 | Discovery | Learn the environment |\n| 10 | Lateral Movement | Move through network |\n| 11 | Collection | Gather target data |\n| 12 | Command & Control | Communicate with implants |\n| 13 | Exfiltration | Steal data out |\n| 14 | Impact | Destroy/disrupt systems |