CyberGuard dictionary / Threat Intelligence
MITRE ATT&CK
A public knowledge base describing observed adversary tactics and techniques.
In simple terms
ATT&CK gives security teams a common language for how attackers behave.
Technical explanation
Its matrices organize tactics, techniques, subtechniques, and procedures based on reported observations; mappings are analytical aids, not proof of attribution.
ATT&CK technique mappings describe behavior and support coverage analysis. A single event can fit several techniques, and a mapping does not identify the actor behind it.
Examples in practice
A detection engineer maps a suspicious credential-access pattern to an ATT&CK technique.
The team maps a suspicious scheduled task to persistence, then checks whether its alerts and response steps cover that behavior. It records the evidence supporting the mapping.
Why it matters
Common labels help compare coverage and communicate findings.
VERIFY & LEARN MORE
Sources and further reading
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.