Typorithm · medium

MITRE ATT&CK

mitre-attacksecuritymitrettpdetection

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn MITRE ATT&CK

Blue Team & SOC

MITRE ATT&CK is a knowledge base of adversary tactics (the goal) and techniques (the method, like T1110 brute force). Mapping detections to TTPs gives threat-informed defense and reveals coverage gaps.

MITRE ATT&CK catalogs how real adversaries behave. A tactic is the goal — credential-access, persistence, exfiltration — and a technique is the method used to reach it, each with an ID such as T1110 for brute force.

When you map a detection rule to a tactic and technique, you express it in a shared language: this rule reads auth-logs, looks for many-failed-logins, and responds with lock-and-alert against T1110.

Mapping every detection to ATT&CK gives threat-informed defense — you defend against techniques attackers actually use. It also exposes coverage gaps: techniques with no detection stand out on an ATT&CK heatmap.

Tactic = the goal; technique = the method (e.g. T1110).

Map detections to TTPs for a shared, threat-informed language.

ATT&CK coverage maps reveal where you have detection gaps.

detection:
  tactic: credential-access
  technique: T1110-brute-force
  data_source: auth-logs
  indicator: many-failed-logins
  response: lock-and-alert

Read the implementation

Connect each part of the code to the concept before you type.

1. The goal

A tactic names the adversary's objective — here, gaining access to credentials.

tactic: credential-access

2. The method

A technique is how the goal is achieved; T1110 is ATT&CK's ID for brute force.

technique: T1110-brute-force

3. Where to look

The data source is the telemetry the detection reads — authentication logs reveal login attempts.

data_source: auth-logs

4. The signal

The indicator is the observable pattern that fires the rule — a burst of failed logins.

indicator: many-failed-logins

5. What to do

The response is the action taken on a match — lock the account and alert an analyst.

response: lock-and-alert

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.