Lesson 26 — Explaining MITRE ATT&CK Techniques
MITRE ATT&CK gives analysts a common language for describing adversary goals, behaviours and observed procedures.
Security Copilot can explain tactics and techniques, map script-analysis and threat-detection findings, and help analysts identify related hunting and detection opportunities.
This lesson explains how to use ATT&CK precisely—starting with evidence, avoiding over-mapping and validating every proposed technique against current MITRE definitions and source telemetry.
What you will learn
This lesson develops an evidence-first ATT&CK interpretation and coverage workflow.
ATT&CK interpretation workflow
↓
Confirm user, device, resource, process and timestamp context
↓
Ask Security Copilot for possible ATT&CK mappings
↓
Open the current MITRE technique and sub-technique definitions
↓
Compare the required behaviour with the source evidence
↓
Reject plausible but unsupported mappings
↓
Assign confirmed, probable, possible or unsupported confidence
↓
Record source attribution and mapping rationale
↓
Identify relevant hunting, detection and coverage opportunities
↓
Validate telemetry and analytics through testing
↓
Approve the final analyst-reviewed mapping
ATT&CK knowledge model
| Component | Meaning | Analyst question |
|---|---|---|
| Tactic | The adversary’s tactical goal or reason for acting. | Why might the behaviour occur? |
| Technique | A general method used to achieve the tactic. | How might the goal be achieved? |
| Sub-technique | A more specific implementation of the technique. | Which precise method matches the evidence? |
| Procedure | The observed implementation by a threat, tool or incident. | What exactly happened in this case? |
| Evidence | Events, entities, commands, files and relationships. | What supports the mapping? |
| Coverage | Telemetry, analytics, hunts, controls and validation. | Can the organisation detect or investigate it? |
Learning objectives
- Explain ATT&CK tactics, techniques and sub-techniques.
- Map behaviours using source evidence.
- Distinguish procedures from generic technique descriptions.
- Use Security Copilot and Microsoft threat analytics.
- Validate technique confidence and alternatives.
- Review Navigator and Sentinel coverage.
- Avoid unsupported and inflated mappings.
What is MITRE ATT&CK?
MITRE ATT&CK is a knowledge base of adversary tactics and techniques based on real-world observations.
ATT&CK is a model
ATT&CK provides a common language for behaviour, investigation, detection and defensive coverage.
ATT&CK is not a verdict
A mapped technique does not prove compromise, attribution or attacker intent.
Tactics describe why
A tactic represents the adversary’s tactical goal, such as credential access, persistence or discovery.
Techniques describe how
A technique describes a general method an adversary may use to achieve a tactical goal.
Sub-techniques add detail
Sub-techniques describe more specific ways a technique can be carried out.
Procedures describe observed use
A procedure is the concrete implementation observed in a campaign, actor, malware sample or incident.
Platforms matter
ATT&CK techniques apply to different platforms such as Windows, Linux, macOS, SaaS, identity providers, IaaS, containers and network devices.
Enterprise Matrix
The Enterprise Matrix organises tactics and techniques for enterprise environments.
Cloud platforms
Cloud ATT&CK content includes Office Suite, identity provider, SaaS and infrastructure-as-a-service behaviours.
Technique IDs
Stable identifiers such as T1059 help analysts reference techniques consistently.
Sub-technique IDs
Sub-techniques use a dotted identifier such as T1059.001 for PowerShell.
Technique names can change
Descriptions, mappings and platform coverage can evolve between ATT&CK versions.
Use the live source
Validate technique details against the current MITRE ATT&CK website or approved organisational version.
Start with observed behaviour
Map what the evidence shows rather than guessing from an alert title.
Separate evidence and mapping
Record the raw event first, then explain why it may support a technique.
One event can support several techniques
A command or process may relate to multiple ATT&CK techniques depending on context.
One technique can use many data sources
A technique may be detected through process, identity, network, email, cloud or audit evidence.
Do not over-map
Adding every plausible technique makes the investigation less precise and less defensible.
Do not map tools alone
The presence of PowerShell, PsExec or another dual-use tool does not prove malicious technique use.
Context decides the mapping
Parent process, user, command line, target, timing and surrounding activity determine relevance.
Evidence strength
Classify mappings as confirmed, probable, possible or unsupported.
Source attribution
Record the product, table, event ID, timestamp and entity that support the mapping.
Tactic sequence
A chronological sequence can help explain how mapped behaviours fit into the attack story.
Sequence is not mandatory
Attackers do not always follow the matrix from left to right or use every tactic.
Initial Access
Initial Access describes how an adversary may gain a foothold.
Execution
Execution describes adversary-controlled code or commands running in the environment.
Persistence
Persistence describes methods used to maintain access across interruptions or changes.
Privilege Escalation
Privilege Escalation describes methods used to gain higher permissions.
Defense Evasion
Defense Evasion describes methods used to avoid or weaken security controls.
Credential Access
Credential Access describes methods used to obtain account names, passwords, tokens or secrets.
Discovery
Discovery describes methods used to learn about systems, accounts, networks and resources.
Lateral Movement
Lateral Movement describes methods used to move through the environment.
Collection
Collection describes methods used to gather data before exfiltration or impact.
Command and Control
Command and Control describes communication with adversary-controlled infrastructure.
Exfiltration
Exfiltration describes methods used to remove data from the environment.
Impact
Impact describes methods used to disrupt, destroy, manipulate or deny access.
Reconnaissance
Reconnaissance describes information gathering before or during targeting.
Resource Development
Resource Development describes infrastructure, accounts and capabilities prepared for operations.
Use Security Copilot
Security Copilot can explain ATT&CK concepts, summarise technique context and relate findings to mapped behaviours.
Copilot in Defender
Copilot in Microsoft Defender can map script-analysis and threat-detection findings to ATT&CK techniques.
Threat analytics
Microsoft threat-analytics reports often describe attack chains with ATT&CK mappings and hunting guidance.
Threat intelligence profiles
Actor and campaign profiles can provide ATT&CK context, but internal evidence still determines relevance.
Ask for the official definition
Request the tactic, technique ID, name, platform and current MITRE description.
Ask for evidence requirements
Request the specific events needed to support the technique in the current environment.
Ask for alternatives
Require Copilot to list legitimate or different ATT&CK explanations.
Ask for confidence
Request a confidence rating for each proposed mapping.
Ask for source rows
Require representative telemetry rather than only a narrative explanation.
Ask for missing evidence
Identify which expected data sources are unavailable.
Ask for detection opportunities
Request relevant Defender or Sentinel tables, fields and behaviours.
Ask for hunting pivots
Request related processes, users, devices, domains, files and cloud activity.
Ask for mitigation context
Request defensive controls while keeping product recommendations separate from technique proof.
Endpoint evidence
Process, file, registry, network and logon events can support many endpoint technique mappings.
Identity evidence
Sign-ins, audit logs, role changes, authentication methods and token activity can support identity mappings.
Email evidence
Delivery, URLs, attachments, clicks and mailbox changes can support initial-access and persistence mappings.
Cloud evidence
Resource changes, permissions, secrets, API activity and data access can support cloud technique mappings.
Network evidence
DNS, proxy, VPN, firewall and connection telemetry can support command-and-control and movement mappings.
Script analysis
Script content can reveal commands, obfuscation, downloads, persistence and discovery behaviours.
Obfuscated files or information
Obfuscation can support T1027 only when the evidence shows deliberate concealment of code or information.
Command and scripting interpreter
T1059 covers command and scripting interpreters, with sub-techniques for specific interpreters.
PowerShell mapping
PowerShell activity maps more precisely to T1059.001 when the behaviour is relevant and evidenced.
Scheduled task mapping
Scheduled tasks or jobs may support T1053 and an appropriate platform-specific sub-technique.
Valid accounts mapping
Use T1078 when evidence shows legitimate credentials or accounts used for adversary activity.
Remote services mapping
Remote service activity can support T1021 and a specific protocol sub-technique.
Ingress tool transfer
Tool or file transfer into the environment can support T1105 when the evidence shows the transfer.
Impair defenses mapping
Security-control changes can support T1562 only when the action and intent are sufficiently evidenced.
Archive collected data
Archive creation may support T1560 when it is connected to data collection rather than routine compression.
Exfiltration mapping
Large transfers alone do not prove exfiltration; destination, ownership, content and sequence matter.
Use ATT&CK Navigator
ATT&CK Navigator visualises techniques for coverage, exercises, investigations and defensive planning.
Navigator layers
Layers can show observed behaviours, detection coverage, confidence or priority.
Do not confuse coverage with prevention
A mapped detection does not guarantee complete detection or prevention of the technique.
Microsoft Sentinel MITRE coverage
Sentinel can visualise active and available analytics coverage against ATT&CK tactics and techniques.
Coverage depends on data
An analytics rule cannot provide useful coverage if required telemetry is missing or unhealthy.
Detection quality matters
One broad rule mapped to a technique may provide weaker coverage than several tested behavioural detections.
Technique-level gaps
Use ATT&CK maps to identify techniques with little or no effective detection.
Data-source gaps
A mapping gap can reflect missing telemetry rather than missing analytics logic.
False coverage
Incorrect or overly broad mappings can create the appearance of coverage without useful detection.
Purple-team validation
Controlled testing can confirm whether telemetry, analytics and response workflows detect the mapped behaviour.
Version control
Record the ATT&CK version or review date used in formal assessments.
Document the rationale
Every mapping should explain the behaviour, evidence, technique and confidence.
Final analyst judgement
Security Copilot can explain and propose mappings, but the analyst approves the final ATT&CK interpretation.
Example ATT&CK explanation prompt
Microsoft Word launched PowerShell with an encoded command. PowerShell downloaded a script from an uncommon domain, created a scheduled task and added a Microsoft Defender exclusion.
Include:
1. Relevant tactic, technique and sub-technique IDs
2. Current MITRE technique names and platform scope
3. The exact observed evidence supporting each mapping
4. Alternative legitimate explanations
5. Mappings that are plausible but not yet supported
6. Confidence for every mapping
7. Required Defender XDR and Sentinel telemetry
8. Hunting pivots for related users, devices, files and infrastructure
9. Detection opportunities and coverage gaps
10. Source links or references used for the explanation
Do not map a technique solely because a dual-use tool appeared.
Agent Foskett investigation: “PowerShell was not the technique…”
↓
Security Copilot initially suggested several ATT&CK techniques
↓
Command and Scripting Interpreter
↓
Obfuscated Files or Information
↓
Ingress Tool Transfer
↓
Scheduled Task or Job
↓
Impair Defenses
↓
The first report copied every suggestion into the attack map
↓
Agent Foskett opened the evidence
↓
PowerShell execution was confirmed
↓
The Base64 content decoded to an ordinary inventory command
↓
No external download occurred
↓
The scheduled task belonged to approved management software
↓
The Defender exclusion had been created weeks earlier by policy
↓
Only the scripting-interpreter behaviour was directly observed
↓
Even that behaviour was legitimate administration
↓
The ATT&CK mapping described the mechanism
↓
It did not prove malicious use
ATT&CK mapping validation checklist
| Area | Question | Validation action |
|---|---|---|
| Behaviour | What was directly observed? | Review original events and entities. |
| Definition | Does the current MITRE definition match? | Open the official technique page. |
| Specificity | Is a sub-technique more accurate? | Select the most precise supported mapping. |
| Context | Could legitimate activity explain the behaviour? | Review user, parent process and change records. |
| Evidence | Can every mapping cite a source event? | Record product, table, timestamp and ID. |
| Confidence | Is the mapping confirmed, probable, possible or unsupported? | Classify each mapping separately. |
| Sequence | Does the technique fit the verified timeline? | Check technical and chronological feasibility. |
| Coverage | Is the mapped technique actually detectable? | Confirm telemetry, rule logic and health. |
| Testing | Has coverage been validated? | Use approved simulation or purple-team testing. |
| Version | Is the ATT&CK content current? | Record review date or version reference. |
Key takeaways
- MITRE ATT&CK is a knowledge base of adversary tactics and techniques based on real-world observations.
- Tactics describe why an adversary acts, while techniques and sub-techniques describe how.
- A mapped technique does not prove compromise, attribution or intent.
- Security Copilot in Defender can map script-analysis and threat-detection findings to ATT&CK techniques.
- Microsoft threat-analytics reports often include ATT&CK mappings and hunting guidance.
- Mappings should begin with source evidence and use the most specific supported technique.
- Dual-use tools and commands require user, process, timing and business context.
- ATT&CK Navigator and Sentinel coverage views can support detection-gap analysis.
- Mapped analytics do not guarantee complete or effective coverage.
- The final ATT&CK interpretation remains a human analyst decision.
What Agent Foskett checked
- PowerShell process
- Decoded command
- Parent process
- Network evidence
- Scheduled task owner
- Defender policy
- Event timestamps
- Technique definitions
- Mapping confidence
- Final incident verdict
Best practices
- Start with evidence.
- Use current definitions.
- Map precisely.
- Prefer sub-techniques.
- Record source events.
- Seek alternatives.
- Assign confidence.
- Validate coverage.
- Test detections.
- Keep judgement human.
Related Agent Foskett resources
Continue the Microsoft Security Copilot Academy
How does Microsoft Security Copilot explain MITRE ATT&CK techniques?
Security Copilot can explain tactics and techniques, relate script-analysis and threat-detection findings to ATT&CK and suggest supporting hunting and detection evidence.
MITRE ATT&CK tactics, techniques and sub-techniques
ATT&CK tactics describe adversary goals, techniques describe methods and sub-techniques provide more specific implementations based on observed behaviour.
Microsoft Sentinel ATT&CK coverage
Microsoft Sentinel can visualise active and available analytics coverage against ATT&CK tactics and techniques, although effective coverage still depends on healthy telemetry and validated rule logic.
