## What is MITRE ATT&CK?

**MITRE ATT&CK** (Adversarial Tactics, Techniques, and Common Knowledge) is the periodic table of hacking. It is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations.

### Why was it created?
Before ATT&CK, we described threats vaguely: "The malware infects the computer."
ATT&CK forces us to be specific: "The malware achieves **Persistence** [TA0003] using **Registry Run Keys** [T1547.001]."

### The Structure
It is a Matrix (Grid).
1.  **Tactics (Columns)**: The goal. (Why are they doing this? e.g., "To steal passwords").
2.  **Techniques (Cells)**: The method. (How are they doing this? e.g., "OS Credential Dumping").
3.  **Procedures (Details)**: The specific implementation. (e.g., "Using Mimikatz.exe").
    *   This gives us the acronym **TTPs**.

### Why Analysts Need It
1.  **Standardized Language**: A distinct common language. "T1059.001" means the same thing to an analyst in Japan as it does to one in the USA.
2.  **Mapping Defenses**: You can map your EDR coverage to the matrix. "We cover 90% of Execution techniques, but only 10% of Exfiltration techniques. We need to buy a DLP tool."
3.  **Threat Intelligence**: Reports say "Group X uses T1053". You can instantly look up T1053 (Scheduled Task) and see if you can detect it.