MITRE ATT&CK Framework: A Practical Guide

What Is the MITRE ATT&CK Framework?

The MITRE ATT&CK framework is a globally accessible knowledge base that documents adversary tactics, techniques, and procedures (TTPs) observed in real-world cyberattacks. Created by MITRE Corporation—a federally funded research and development center—and first released in 2013, the framework was originally designed to answer a specific question: how well are defenders detecting documented adversary behavior?

ATT&CK stands for "Adversarial Tactics, Techniques, and Common Knowledge." It emerged from the Fort Meade Experiment (FMX) and has grown into the industry-standard taxonomy covering 14 tactical categories and 273+ specific attack techniques across enterprise, mobile, and industrial control system environments. The framework is maintained as a free, open-source resource at attack.mitre.org and receives regular updates from government agencies, security vendors, and incident response teams worldwide.

For small and medium-sized businesses, ATT&CK provides a practical roadmap for understanding exactly how attackers operate—from initial reconnaissance and social engineering through ransomware deployment. Unlike abstract security guidelines, ATT&CK maps specific attack methods to defensive controls, enabling businesses to implement targeted defenses at each attack stage without requiring enterprise-level budgets.

Whether you're a tax professional navigating IRS Publication 4557 cybersecurity requirements or a healthcare provider securing patient data under HIPAA's Security Rule, this framework provides the tactical intelligence needed to defend against modern cyber threats. This guide explains how small business owners can use MITRE ATT&CK to build effective, budget-conscious cybersecurity defenses starting at under $200 per month—with practical implementation steps and measurable security outcomes.

Why Small Businesses Need MITRE ATT&CK

Small and medium-sized businesses face the same sophisticated attack techniques as Fortune 500 companies, but typically lack enterprise-level security budgets and dedicated security teams. The MITRE ATT&CK framework levels the playing field by providing free, actionable intelligence about exactly how attackers operate—enabling SMBs to implement targeted defenses against the specific techniques threat actors use.

Unlike compliance frameworks that tell you what to protect, ATT&CK shows you how attackers will try to compromise your systems. This tactical knowledge allows you to prioritize security investments based on real-world threat intelligence rather than vendor marketing claims. Most small businesses using only traditional antivirus software cover fewer than 30% of ATT&CK techniques. Adding Endpoint Detection and Response (EDR), Managed Detection and Response (MDR), or Extended Detection and Response (XDR), email security, and multi-factor authentication (MFA) increases coverage to 60–70% of high-priority techniques.

The framework also strengthens regulatory compliance documentation. For tax professionals subject to IRS Written Information Security Plan (WISP) requirements, ATT&CK provides concrete evidence of risk assessment and documents which specific attack techniques your security controls address—satisfying the risk analysis component of a compliant WISP. For healthcare organizations, mapping HIPAA Security Rule §164.312 technical safeguards to ATT&CK techniques demonstrates that your controls address known attack vectors in a way auditors and regulators can evaluate objectively.

The framework's technique-specific mitigation guidance transforms abstract compliance requirements into measurable, implementable security controls—a shift that makes your security program defensible to regulators, insurers, and clients alike.

Understanding the MITRE ATT&CK Framework Structure

The MITRE ATT&CK framework organizes cyberattack methods into a matrix structure with two primary components: tactics (the adversary's tactical objectives) and techniques (the specific methods used to achieve those objectives). Each technique receives a unique identifier—such as T1566 for Phishing or T1059.001 for PowerShell execution—enabling precise communication between security teams, vendors, and threat intelligence sources.

Three Primary ATT&CK Matrices

MITRE maintains three matrices tailored to different technology environments. The Enterprise Matrix covers attacks against Windows, macOS, Linux, cloud platforms (AWS, Azure, GCP), and network infrastructure—containing 14 tactics and 273+ techniques as of version 15 (2026). The Mobile Matrix documents attacks against iOS and Android devices, with 14 tactics and 100+ mobile-specific techniques. The ICS Matrix addresses industrial control systems and operational technology environments with 11 tactics specific to manufacturing and critical infrastructure.

Small businesses typically focus on the Enterprise Matrix, though cloud-native organizations should understand that cloud attacks differ fundamentally from traditional malware-based approaches. Cloud adversaries typically use native platform features—Azure AD permissions, AWS IAM policies, Google Workspace tokens—rather than deploying malware, allowing them to access, escalate privileges, move laterally, and exfiltrate data while blending in with legitimate traffic.

MITRE Corporation, a not-for-profit organization founded in 1958, ensures the framework stays aligned with real-world attacker behavior. Each technique page includes detailed descriptions, real-world examples, detection guidance, and recommended mitigations. The framework applies to six major cybersecurity disciplines: intrusion detection, threat hunting, security engineering, threat intelligence, red teaming, and risk management.

The 14 MITRE ATT&CK Tactics Explained for Small Businesses

Each tactic represents a distinct phase in the attack lifecycle. Understanding these phases helps small businesses implement layered defenses that catch attackers at multiple points before damage occurs. Sophisticated adversaries often skip phases or revisit earlier ones during an operation—which is why defense-in-depth across all 14 tactics matters more than focusing on a single stage.

1. Reconnaissance (TA0043)

Attackers gather information about your business through publicly available sources. They scan your website, enumerate employee email addresses from LinkedIn, identify technologies you use through job postings, and map your network infrastructure using tools like Shodan. Reconnaissance precedes the vast majority of targeted attacks, and attackers use this phase to craft convincing phishing emails and identify vulnerable entry points. Limiting public exposure of employee information, implementing web application firewalls, and conducting regular external security assessments reduce your reconnaissance attack surface.

2. Resource Development (TA0042)

Adversaries establish infrastructure to support operations—purchasing domains that impersonate your company, setting up command-and-control servers, and developing or acquiring malware. While small businesses rarely detect this phase directly, monitoring for newly registered domains that spoof your brand is a practical early-warning capability that some DNS filtering services provide.

3. Initial Access (TA0001)

The adversary gains their first foothold through phishing emails, exploiting internet-facing vulnerabilities, or using stolen credentials. The 2025 Verizon Data Breach Investigations Report identifies phishing and credential theft as the dominant initial access vectors across all business sizes. Initial Access is the most defensible phase: email security with anti-phishing capabilities mitigates T1566 (Phishing), while MFA on all remote access blocks T1078 (Valid Accounts) and T1133 (External Remote Services) even when credentials are stolen.

4. Execution (TA0002)

Once inside, attackers run malicious code through scripting interpreters, scheduled tasks, or trusted system tools. T1059.001 (PowerShell) and T1059.003 (Windows Command Shell) are among the most commonly detected execution techniques. EDR solutions with behavioral detection are the primary control here—they identify suspicious script execution patterns that signature-based antivirus misses entirely.

5. Persistence (TA0003)

Adversaries establish footholds that survive system reboots and credential changes, ensuring continued access even if the initial entry vector is closed. Common persistence techniques include T1053 (Scheduled Task/Job), T1547 (Boot/Logon Autostart Execution), and T1543 (Create or Modify System Process). Monitoring for unauthorized scheduled tasks and startup entries, combined with regular audits of privileged accounts, addresses most persistence techniques at minimal cost.

6. Privilege Escalation (TA0004)

Attackers gain higher-level permissions than initially obtained—moving from a standard user account to administrator, or from local administrator to domain administrator. T1068 (Exploitation for Privilege Escalation) requires timely patching; T1548 (Abuse Elevation Control Mechanism) requires enforcing least-privilege access policies. Patch management and least-privilege access are the two highest-return controls for this tactic.

7. Defense Evasion (TA0005)

Adversaries work to avoid detection by disabling security tools, obfuscating malicious code, masquerading as legitimate processes, or deleting logs. T1562.001 (Impair Defenses: Disable or Modify Tools) specifically targets antivirus and EDR—which is why tamper-protected EDR solutions matter for SMBs. T1027 (Obfuscated Files or Information) is why behavioral detection outperforms signature-based detection for advanced threats.

8. Credential Access (TA0006)

Attackers steal account credentials through keylogging, memory-based credential dumping (T1003 — OS Credential Dumping), or brute-force attacks against authentication systems. According to the IBM Cost of Data Breach Report, compromised credentials represent the most common initial attack vector at 19% of breaches. Enforcing MFA universally is the single highest-impact control for this tactic—stolen passwords become useless when a second factor is required. Pairing MFA with strong password policies and Windows Credential Guard closes most credential theft pathways for SMBs.

9. Discovery (TA0007)

Adversaries explore your environment to understand system configurations, network topology, user accounts, and valuable data locations. Discovery activity—unusual reconnaissance commands, unexpected network share enumeration, bulk account lookups—often generates detectable anomalies in system logs before attackers reach their final objectives. Network segmentation limits discovery scope, while honeypot accounts and files trigger alerts when accessed, providing early warning of active intrusions at minimal cost.

10. Lateral Movement (TA0008)

Attackers move through your network from the initially compromised system to other workstations and servers, seeking high-value targets like file servers, domain controllers, and financial systems. Lateral movement is what transforms a single compromised workstation into a network-wide ransomware event. VLANs, next-generation firewalls with internal traffic inspection, MFA on administrative access, and monitoring for unusual Remote Desktop Protocol (RDP) connections each reduce lateral movement opportunities significantly.

11. Collection (TA0009)

Adversaries gather financial records, customer information, intellectual property, or credentials for exfiltration or double-extortion ransomware—where attackers threaten to publish stolen data unless paid. Data Loss Prevention (DLP) tools, file access auditing on sensitive directories, and encryption of sensitive data at rest are the primary controls. Strict least-privilege access policies also limit how much data an attacker can collect from a single compromised account.

12. Command and Control (TA0011)

Attackers establish communication channels with compromised systems to send commands and receive stolen data—often using encrypted channels or legitimate web services to blend with normal traffic. Command and Control (C2) traffic is typically the longest-running phase of an attack. DNS filtering blocks known malicious domains and delivers one of the highest returns on investment for SMBs, typically costing $3–5 per user per month while eliminating a large percentage of malware communications before they establish persistence.

13. Exfiltration (TA0010)

Adversaries steal data through cloud storage, email, or direct network transfer. Data exfiltration creates regulatory exposure under IRS cybersecurity requirements, HIPAA, and state breach notification laws. Monitoring outbound data transfers for volume anomalies, restricting cloud storage to approved platforms, and egress filtering rules all reduce exfiltration risk. Encrypting sensitive data at rest renders stolen data unusable even when exfiltration succeeds.

14. Impact (TA0040)

Attackers manipulate, interrupt, or destroy your systems and data—most commonly through ransomware encryption (T1486) or data destruction (T1485). Impact is the final attack stage and the most visible. Immutable, offline backup systems are the most important defense: T1490 (Inhibit System Recovery) specifically targets backup systems to prevent victims from recovering without paying. Testing disaster recovery procedures quarterly and maintaining ransomware-specific incident response playbooks determine how quickly your business can resume operations after an attack.

Mapping Your Current Security Controls to MITRE ATT&CK

Before implementing new defenses, a gap analysis identifies which ATT&CK techniques you can already detect or prevent and where vulnerabilities exist. Most small businesses discover the largest gaps in Credential Access, Lateral Movement, and Exfiltration tactics—the three areas where traditional antivirus provides the least coverage.

The process starts by inventorying every security control you currently have: antivirus software, firewalls, email filtering, backup systems, MFA implementations, patch management procedures, and employee security training. For each control, identify which ATT&CK techniques it addresses. Email filtering with anti-phishing capabilities mitigates T1566 (Phishing); EDR detects T1059.001 (PowerShell), T1003 (Credential Dumping), and T1055 (Process Injection).

Then compare what you cover against the techniques most commonly used against businesses in your industry. The ATT&CK Navigator provides a free, browser-based tool for visualizing your defensive coverage across the entire framework—export the gap analysis results to share with security vendors or managed service providers when evaluating solutions. Find it at attack.mitre.org.

For tax and accounting firms, prioritize T1566 (Phishing), T1078 (Valid Accounts), T1486 (Data Encrypted for Impact), and T1490 (Inhibit System Recovery). Healthcare organizations should emphasize T1133 (External Remote Services) and T1005 (Data from Local System) given HIPAA's focus on electronic Protected Health Information (ePHI) access controls. The HIPAA risk assessment process maps directly to this technique-prioritization methodology.

Budget-Friendly MITRE ATT&CK Implementation for Small Businesses

Effective ATT&CK-based defenses don't require enterprise budgets. The key is prioritizing controls that address the most common attack techniques in your industry while building detection and response capabilities incrementally. The three tiers below reflect realistic spending for SMBs at different sizes and risk profiles.

Essential Tier: $200–500/Month (5–25 Employees)

This tier provides foundational coverage for approximately 40–50% of high-priority ATT&CK techniques. Email security with anti-phishing capabilities ($5–8/user/month) mitigates T1566 (Phishing) and T1598 (Phishing for Information). EDR ($6–12/endpoint/month) detects and blocks 50+ techniques including T1059.001 (PowerShell), T1003 (Credential Dumping), and T1486 (Ransomware). MFA ($3–6/user/month) prevents credential-based attacks including T1078 (Valid Accounts) and T1110 (Brute Force). Cloud backup with immutable storage ($50–100/month) protects against T1490 (Inhibit System Recovery) and T1485 (Data Destruction). Together, these controls address Initial Access, Execution, Credential Access, and Impact tactics with genuine detection capability.

Enhanced Tier: $500–1,200/Month (25–100 Employees)

Adding Managed Detection and Response ($150–300/month) brings 24/7 monitoring, threat hunting, and professional incident investigation to your Essential Tier controls. DNS filtering ($3–5/user/month) blocks C2 communications (T1071), malware downloads (T1105), and drive-by compromises (T1189). Patch management automation ($100–200/month) eliminates exploitable vulnerabilities targeted by T1068 and T1190. Security awareness training ($3–5/user/year) measurably reduces phishing success rates. This tier increases total ATT&CK coverage to 65–75% of techniques, adding strong defenses for Defense Evasion, Command and Control, and Discovery tactics.

Advanced Tier: $1,200–2,500/Month (100+ Employees or High-Risk Industries)

Extended Detection and Response ($400–800/month) unifies threat detection across endpoints, network, cloud, and email into a single correlated view—eliminating the blind spots attackers exploit when moving between environments. Privileged Access Management (PAM) ($200–400/month) prevents lateral movement and credential theft by enforcing just-in-time access. Network segmentation with internal firewall rules ($300–600/month) contains breaches and limits lateral movement scope. Periodic vulnerability scanning and penetration testing ($200–400/month) validates that controls work as expected. This tier achieves 85–95% coverage of ATT&CK techniques, with advanced capabilities specifically for Lateral Movement, Collection, and Exfiltration detection—the tactics most relevant to double-extortion ransomware and regulatory data breach liability.

For a detailed breakdown of how EDR, MDR, and XDR differ in ATT&CK coverage, see our guide on EDR vs. MDR vs. XDR for small businesses. For distributed teams, our remote work security guide covers additional ATT&CK technique controls for distributed environments.

Free MITRE ATT&CK Tools and Resources

MITRE and the security community provide extensive free resources to help small businesses implement ATT&CK-based defenses without needing a dedicated security team.

Official MITRE Resources

The ATT&CK website provides the complete technique catalog with detailed descriptions, detection methods, and mitigation strategies for every entry. ATT&CK Navigator is a browser-based tool for visualizing technique coverage, building heatmaps, and documenting gap analyses—exportable for sharing with vendors or auditors. ATT&CK Workbench is a desktop application for customizing the framework to your specific environment, useful for organizations that want to track local threat intelligence alongside the public knowledge base. The Cyber Analytics Repository (CAR) provides detection analytics mapped to ATT&CK techniques in pseudocode, helping security engineers implement specific detections in SIEM platforms.

Community and Open-Source Tools

Atomic Red Team provides a collection of simple automated tests for validating detection coverage, with test cases for 350+ techniques that security teams can safely execute to verify that EDR and SIEM detections actually fire. Caldera is an adversary emulation platform for running complete attack scenarios—useful for purple team exercises and testing incident response procedures before a real incident. Sigma Rules offers a generic signature format for SIEM systems, with 2,000+ detection rules mapped to ATT&CK techniques available as open source. VECTR is a purple team management platform for tracking red team exercises, blue team detections, and coverage improvements over time.

Evaluating Vendors Using ATT&CK

When evaluating security vendors, ask specifically about their ATT&CK coverage map. Request documentation showing which techniques their solution detects, prevents, or mitigates. Modern EDR platforms—including CrowdStrike, SentinelOne, and Microsoft Defender for Endpoint—tag alerts with ATT&CK technique IDs natively. SIEM systems like Splunk, Microsoft Sentinel, and Elastic Security include ATT&CK-mapped detection rules and dashboards. Leading MDR providers organize detection analytics and incident reports using ATT&CK taxonomy. This evaluation approach enables objective comparison of security tools based on actual defensive coverage rather than marketing claims. Instead of asking vendors "Do you protect against ransomware?" ask "Which specific techniques from T1486 (Data Encrypted for Impact) and T1490 (Inhibit System Recovery) does your solution address, and can you demonstrate detection capability?"

Integrating MITRE ATT&CK with NIST CSF and Compliance Frameworks

MITRE ATT&CK complements—rather than replaces—other security frameworks. The two most relevant integrations for small businesses are NIST CSF 2.0 and compliance-specific frameworks like IRS Publication 4557 and HIPAA.

The NIST Cybersecurity Framework (CSF) 2.0 provides high-level functions—Govern, Identify, Protect, Detect, Respond, Recover—while ATT&CK offers tactical implementation details for each. In the Identify function, use ATT&CK to pinpoint which techniques threaten your specific assets and business processes. In the Protect function, implement mitigations documented on ATT&CK technique pages. In the Detect function, build detection analytics using ATT&CK technique IDs as anchors. This mapping satisfies NIST SP 800-171 requirements for organizations handling Controlled Unclassified Information (CUI) and provides documented evidence of systematic risk management.

For tax professionals, ATT&CK provides the technical backbone for IRS Publication 4557's risk assessment requirement—each technique ID corresponds to a documented threat that your controls must address. The WISP creation process becomes more defensible when security controls are referenced by ATT&CK technique ID rather than described in general terms. Healthcare organizations can map HIPAA Security Rule §164.312 technical safeguard requirements to specific ATT&CK techniques. PCI DSS 4.0 Requirement 6.3 specifically calls for protection against known vulnerabilities, which ATT&CK technique coverage directly supports.

Businesses that document their security controls using ATT&CK technique IDs have a ready-made response to auditor questions about risk assessment methodology, threat modeling, and control effectiveness. This documentation also strengthens cyber insurance applications and incident response retainer negotiations by demonstrating a structured, intelligence-driven security program. See our HIPAA cybersecurity requirements guide for a detailed look at how ATT&CK mapping supports HIPAA compliance.

ATT&CK for Tax, Healthcare, and Professional Services

While the Enterprise Matrix applies across industries, threat actors prioritize techniques differently based on their targets. Understanding which technique clusters are most active in your sector allows you to focus your first 90 days on the highest-probability threats rather than spreading defenses evenly across 273+ techniques.

Tax and Accounting Firms

Tax professionals are high-value targets because they hold Social Security numbers, employer identification numbers, financial account data, and direct access to IRS e-filing systems. The dominant attack patterns are: T1566 (Phishing) impersonating the IRS or tax software vendors; T1078 (Valid Accounts) using credentials stolen from previous breaches; T1486 (Data Encrypted for Impact) targeting client files during filing season; and T1005 (Data from Local System) focusing on tax return databases. The FTC Safeguards Rule and IRS WISP requirements both demand documented risk assessment—ATT&CK technique coverage maps directly to those requirements. A compliant WISP template that references ATT&CK technique IDs satisfies the risk assessment requirement with technical specificity auditors expect.

Healthcare and Dental Practices

Healthcare attackers target electronic Protected Health Information (ePHI) through T1133 (External Remote Services) exploiting unsecured remote access, T1005 (Data from Local System) targeting patient databases, T1041 (Exfiltration Over C2 Channel) stealing medical records for black-market sale, and T1486 (Data Encrypted for Impact) disrupting patient care for maximum ransom pressure. Healthcare-specific ATT&CK implementation emphasizes network segmentation isolating medical devices, endpoint protection on all systems handling ePHI, encrypted backup of patient databases, and 24/7 monitoring during peak hours. Dental practices face the same threat profile as larger healthcare organizations—see our HIPAA guide for dental offices for practice-specific implementation steps and our healthcare risk assessment service for professional gap analysis.

Professional Services and Financial Firms

Law firms, financial advisors, and insurance agencies hold sensitive client data that commands premium prices on dark web markets. Attackers targeting professional services favor T1566.002 (Spearphishing Link) with highly personalized lures, T1199 (Trusted Relationship) attacks exploiting software vendor access, and T1486 (Ransomware) during high-stakes periods like mergers and year-end filings. Implementing asset management and security assessments as the starting point for ATT&CK mapping helps professional services firms identify which systems hold the most sensitive data—and therefore which techniques pose the greatest business risk.