MITRE ATT&CK for Red Teams: Mapping an Operation

MITRE ATT&CK is the shared vocabulary that lets a red team describe what it did in the same words a defender uses to catch it. It is a public knowledge base of adversary behavior, organized by the goals an attacker pursues and the methods used to reach them. Treated well, it stops being a poster on the wall and becomes the spine of an engagement: it shapes how you scope the work, how you plan a realistic campaign, how you track coverage during the operation, and how you write a report that a blue team can turn into detections the next morning. This piece is about that planning and reporting discipline, kept at a conceptual level, with the offense and defense sides always in view.

The goal here is not a catalog of attacks. It is a way of thinking. Read it as the framework layer that sits above whatever tools and tradecraft you already use, the layer that makes an assessment repeatable and comparable instead of a one-off story.

01What MITRE ATT&CK is

MITRE ATT&CK is a structured model of real adversary behavior, built from observed intrusions and kept current by MITRE and the wider community. It answers a simple question for every step of an attack: what was the attacker trying to achieve, and how did they do it. The model has four moving parts, and understanding the hierarchy is most of the battle.

A tactic is the adversary goal, the why. On the Enterprise matrix these run from reconnaissance through impact, fourteen in total, each with an identifier like TA0001 for Initial Access. A technique is a way to achieve a tactic, the how, carrying an identifier like T1566 for Phishing. A sub-technique is a more specific method under a parent, such as T1566.001 for a phishing attachment. Alongside these sit procedures, the concrete examples of how a named group or piece of software has used a technique in the wild.

The Enterprise matrix is the view most teams live in: columns are tactics, cells are the techniques that serve each tactic. There are parallel matrices for Mobile and for ICS, but Enterprise covers Windows, Linux, macOS, cloud, containers, and network devices, which is where most engagements happen. Reading the matrix left to right traces the arc of an intrusion, from getting in to achieving the mission.

02Why it is a shared language for offense and defense

The real value of ATT&CK is that it is a shared language, spoken by the people breaking in and the people defending. When a red team says it achieved persistence through T1053 Scheduled Task, a defender knows exactly which data sources to check and which detections should have fired. There is no translation loss between the two sides, and no argument about terminology.

That common reference turns vague outcomes into measurable ones. Instead of a report that reads "we got domain admin somehow," you get a chain of technique IDs that the blue team can replay, test, and close one by one. It also lets an organization compare this year's assessment with last year's, or one business unit with another, because both are scored against the same grid. Threat intelligence teams describe adversaries in ATT&CK terms, detection engineers write rules against it, and red teams plan with it, so a single model threads through the whole security program.

03Scoping and planning an engagement with ATT&CK

Scoping a red team engagement with ATT&CK starts by deciding which slice of the matrix is in play. A full-scope assessment might touch every tactic, while a targeted test of the identity stack might focus on Credential Access, Privilege Escalation, and Lateral Movement. Agreeing on that slice up front sets expectations with the customer and keeps the operation honest about what it did and did not cover.

From there, planning becomes an exercise in choosing a representative set of techniques per in-scope tactic, biased toward behaviors that match the threat the customer actually faces. A payments company plans differently from a hospital. The planning table below is the kind of artifact that comes out of a scoping session: a short, agreed list, with safe-stop notes attached to the loud or high-impact entries.

# 0xpriv.dev/red-team  -- engagement plan extract (conceptual)
Tactic                 Technique (ID)                     Notes
Initial Access         Phishing (T1566)                   simulated, pre-agreed inbox
Execution              Command/Scripting (T1059)          PowerShell + shell
Persistence            Scheduled Task/Job (T1053)         cleanup logged
Credential Access      OS Credential Dumping (T1003)      lab hosts only
Lateral Movement       Remote Services (T1021)            within 10.10.10.0/24
Impact                 Data Encrypted (T1486)             SIMULATED, no real encryption

Notice the discipline in that last row. Impact techniques get represented, not actually executed, on a live estate. The plan records the intent and the safe substitute, so the report can still speak to the risk without anyone running destructive code.

04Emulating a threat actor: ATT&CK groups and software

Adversary emulation is where ATT&CK stops being abstract. The knowledge base includes Groups, named clusters of activity such as G0016 (APT29) or G0046 (FIN7), each annotated with the techniques that group is known to use. It also includes Software, the tools and malware families those groups rely on, such as S0002 (Mimikatz) or S0154 (Cobalt Strike). Together they let a red team ask a sharper question than "can we get in," namely "can this specific adversary get in, the way they actually operate."

To build an emulation plan, pull the technique list for the chosen group, overlay the customer environment, and keep the techniques that are relevant. The result is a campaign that follows a believable path rather than a grab bag of tricks. The MITRE-affiliated Center for Threat-Informed Defense publishes full adversary emulation plans that do exactly this for several well-documented groups, and they are a good template for structure even when you adapt the content.

05Mapping an operation tactic by tactic

Mapping an operation tactic by tactic is the core reporting habit: as the campaign moves through the matrix, every action is tagged with the tactic it served and the technique that achieved it. Read left to right, the tags tell the story of the intrusion in a form both teams understand. The table below walks the operational tactics in order, from initial access to impact, with representative technique IDs. These are illustrative anchors for a report, not instructions for carrying anything out.

Two tactics sit before this list and are worth tagging too: Reconnaissance (TA0043) and Resource Development (TA0042), which cover target research and infrastructure setup. During an engagement, logging each action against its tactic as you go, rather than reconstructing it later, keeps the map accurate and makes the final report almost write itself. The diagram shows that left-to-right arc at a glance.

06Building an ATT&CK Navigator heatmap of coverage

An ATT&CK Navigator heatmap turns the technique tags into a picture anyone can read. Navigator is an open web tool that renders the matrix and lets you color cells, score them, and save the result as a layer file. A layer is just JSON: a list of techniques, each with a score, a color, and an optional comment. During an engagement you build a layer by marking every technique you exercised, which gives a coverage map of where you went and where you did not.

{
  "name": "Engagement coverage",
  "domain": "enterprise-attack",
  "description": "Techniques exercised during the lab assessment",
  "techniques": [
    { "techniqueID": "T1566", "score": 100, "comment": "Simulated phishing, initial foothold" },
    { "techniqueID": "T1059", "score": 100, "comment": "PowerShell execution on 10.10.10.5" },
    { "techniqueID": "T1003", "score": 100, "comment": "Credential access, lab hosts only" },
    { "techniqueID": "T1021", "score": 100, "comment": "Lateral movement within 10.10.10.0/24" }
  ],
  "gradient": { "colors": ["#ffffff", "#ff6666"], "minValue": 0, "maxValue": 100 }
}

Layers are composable, which is where the heatmap earns its keep. Export one layer for what the red team did and another for what the blue team detected, then combine them with Navigator's layer math to see the gap. A cell that is red on the attack layer but cold on the detection layer is a blind spot, stated in one glance. Scoring consistently (for instance, a fixed value per technique performed) keeps the colors meaningful across engagements.

$ layer: Engagement coverage (enterprise-attack)
$ techniques scored: 18 across 9 tactics
$ hottest column: Credential Access (4 techniques)
$ cold columns: Exfiltration, Impact (represented, not executed)

07Validating techniques with Atomic Red Team

Atomic Red Team, maintained by Red Canary, is a library of small, portable tests, each mapped to an ATT&CK technique. Where Navigator describes coverage, Atomic Red Team lets a purple team actually fire a single technique in a controlled way and watch whether the sensor catches it. Each atomic is a short, documented test keyed to a technique ID, which keeps the whole exercise aligned to the same grid as the plan and the report.

# atomic test metadata is keyed to a technique ID (conceptual shape)
attack_technique: T1059.001
display_name: "Command and Scripting Interpreter: PowerShell"
atomic_tests:
  - name: Benign PowerShell marker command
    supported_platforms: [windows]
    description: Fires a harmless, logged command to test detection coverage

PS> Invoke-AtomicTest T1059.001 -ShowDetailsBrief
T1059.001-1 Benign PowerShell marker command
T1059.001-2 PowerShell command logging check
PS> # run on a lab host, then confirm the SIEM alert fired

08Driving detection engineering and purple teaming from the map

Detection engineering is the payoff of all this mapping. Once the engagement is logged as technique IDs, the blue team has a prioritized worklist: for each technique the red team used, is there a data source that would see it, and a detection that would alert on it. A technique with coverage gets a validation test. A technique without coverage becomes a detection to build, ordered by how damaging the behavior is.

Purple teaming is the loop that closes the gap in real time. The red team fires a technique, the blue team checks whether it was seen, and if not the detection is written and the technique fired again to confirm the fix. Running this loop against an ATT&CK layer means progress is visible as cells turning from cold to covered. The sequence below is the hygiene that keeps that loop honest.

09Writing a report where every finding links to a technique

A report where every finding links to a technique is the deliverable that makes an ATT&CK-driven engagement worth more than a list of broken things. Each finding carries its tactic, its technique ID, the evidence, the business risk, and the MITRE-recommended mitigation (which has its own M-identifier). A defender reading it can click straight through to the technique page, see the data sources and detections MITRE suggests, and start work without a meeting.

# 0xpriv.dev/red-team  -- finding template (conceptual)
Finding:     LSASS credential access on 10.10.10.5
Tactic:      Credential Access (TA0006)
Technique:   OS Credential Dumping: LSASS Memory (T1003.001)
Evidence:    process access to lsass by non-standard parent (log excerpt)
Risk:        domain credential reuse enabled lateral movement
Detected?:   no alert fired (detection gap)
Mitigation:  M1040 Behavior Prevention, credential guard, LSASS protection

Structuring findings this way gives the whole report a backbone. The executive summary can show the Navigator heatmap, the technical section lists findings as technique-tagged entries, and the remediation plan is simply the mitigations, sorted by risk. Because every row points at a public technique page, nothing in the report depends on the reader trusting your jargon.

10Purple team hygiene and keeping the map honest

Purple team hygiene is what separates a mapping exercise that improves a program from one that just produces a colorful grid. The map is only as good as the discipline behind it, so a few habits matter more than any tool. The box below is the short version a team can pin up.

11Common pitfalls when adopting ATT&CK

Teams adopting ATT&CK tend to stumble in the same few places, and naming them up front saves a lot of rework. The first is treating coverage as a score to maximize, which pushes teams to chase every cell instead of the techniques that matter for their threat model. A smaller, threat-aligned map beats a fully painted one. The second is mapping too precisely too early, tagging a parent technique when the evidence does not justify a specific sub-technique, or the reverse. Map to the level the evidence supports.

A third pitfall is letting the framework drive the engagement instead of the other way around. ATT&CK is a description of behavior, not a checklist to complete. The operation should follow a realistic path for the chosen adversary, and the map should record that path faithfully, including the techniques you chose not to use and why. Kept in that order, the framework sharpens the work without boxing it in.

12FAQ

13Wrapping up

MITRE ATT&CK earns its place in a red team program by being the one thing the plan, the operation, and the report all agree on. Scope an engagement by choosing a slice of the matrix, emulate a real adversary with its groups and software, tag every action with a tactic and technique as you go, draw the coverage as a Navigator heatmap, and hand the blue team a report where each finding links straight to a technique and its mitigation. Do that and an assessment stops being a story told once and becomes a measurement a security program can improve against, release after release.