1 Answers
Rebecca Kappel Staff answered 3 years ago As of ATT&CK v20, released by MITRE on October 13, 2026 (current version v20.1), the MITRE ATT&CK Enterprise matrix contains 15 tactics, 227 techniques and 479 sub-techniques. Tactics are the adversary’s goals (the “why”), techniques are how they achieve them, and sub-techniques are more specific variations of a technique. MITRE releases new ATT&CK versions roughly twice a year, in April and October, so the counts change; check the latest numbers in the ATT&CK release notes.
A technique can support more than one tactic, so the per-tactic technique counts on the matrix add up to more than 227. The 15 Enterprise tactics are:
- Reconnaissance (TA0043): The adversary is trying to gather information to plan future operations, such as scanning victim infrastructure or collecting details about staff and systems.
- Resource Development (TA0042): The adversary is trying to establish resources to support operations, such as acquiring infrastructure, accounts or tools.
- Initial Access (TA0001): Methods adversaries use to gain a first foothold in a target environment, such as phishing, exploiting vulnerabilities in external-facing services, or using stolen credentials.
- Execution (TA0002): Running malicious code or instructions on a target system, such as a malware payload, scripts, or commands run through exploited vulnerabilities.
- Persistence (TA0003): Maintaining access to a compromised system over time, for example by creating new accounts, installing backdoors, or modifying system configurations so access survives reboots.
- Privilege Escalation (TA0004): Gaining higher-level permissions, for example by exploiting vulnerabilities, abusing misconfigured permissions, or stealing credentials with higher privileges.
- Stealth (TA0005): Hiding and concealing actions so they look like normal behavior, such as obfuscating code or blending into legitimate activity. In earlier versions (for example v17), TA0005 was named Defense Evasion.
- Defense Impairment (TA0112): Breaking security mechanisms, pipelines and tooling so defenders cannot see or trust what is happening.
- Credential Access (TA0006): Stealing account names and passwords, for example through phishing, brute-force attacks, or weaknesses in authentication mechanisms.
- Discovery (TA0007): Learning about the environment to support further attacks, such as enumerating system configurations, network topology and user accounts.
- Lateral Movement (TA0008): Moving through the environment to other systems or network segments, for example with stolen credentials or by abusing trust relationships between systems.
- Collection (TA0009): Gathering data of interest from compromised systems, such as keylogging, screen capture, or extracting sensitive information from files and databases.
- Command and Control (TA0011): Communicating with compromised systems to control them, for example through remote access tools or external command-and-control servers.
- Exfiltration (TA0010): Stealing data from the target environment, for example over encrypted channels, hidden within legitimate network traffic, or copied to external storage.
- Impact (TA0040): Manipulating, interrupting or destroying systems and data, such as encrypting data for ransom or disrupting services.
Besides Enterprise, ATT&CK also has separate Mobile and ICS matrices with their own tactics and techniques. For how organizations use the framework, see our MITRE ATT&CK framework guide.
Please login or Register to submit your answer
