Free Tool

MITRE ATT&CK Explorer

MITRE ATT&CK is a public catalogue of how real attackers behave, organised into tactics — what an attacker is trying to do — and techniques — how they do it. Pick a tactic below and this explorer shows you the techniques inside it, in plain English, with the evidence a security team would look for. It is the beginner's map of a framework professionals use every day.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

What this tool does

Security teams need a shared language for attacker behaviour. Without one, every incident report describes the same attack in different words, and nobody can compare notes. MITRE ATT&CK — Adversarial Tactics, Techniques, and Common Knowledge — provides that language. It organises attacker behaviour into tactics, which are the attacker's goals, such as getting in, staying in, stealing data or causing damage; and techniques, which are the specific methods used to achieve each goal, such as phishing, stealing passwords, or running malicious code.

This explorer gives you the framework in a form a beginner can use. Pick one of the fourteen tactics and it shows you three or four of the most important techniques inside it, each with a plain-English explanation, a note on what evidence a SOC analyst would look for, and the technique's public ID — the code professionals use to refer to it, such as T1566 for phishing. The IDs matter, because they are how the framework is referenced in reports, detection rules and job descriptions, and learning them now makes the rest of the security world easier to read.

The explorer is a map, not a manual. It teaches you to recognise the shape of an attack — which goal it serves and which method it uses — and to ask the question a SOC analyst asks about every technique: what would we see in our logs if this happened here? That question is the bridge between knowing about ATT&CK and using it, and it is the habit the SOC simulator and the careers guides on this site build on.

Try it

Pick a tactic to see its techniques, explained in plain English, with the evidence a SOC would look for.

Tactic — what is the attacker trying to do?
Reconnaissance — gather information about the target Resource Development — build the tools for the attack Initial Access — get into the network Execution — run malicious code Persistence — stay in after a reboot Privilege Escalation — gain higher access Defense Evasion — avoid being detected Credential Access — steal passwords and keys Discovery — learn what is inside the network Lateral Movement — move to other computers Collection — gather the data to steal Exfiltration — steal the data out Impact — disrupt, destroy or extort

Show this tactic's techniques

How it works

The framework is organised as a matrix: tactics across the top, techniques underneath each one. An attack is rarely a single technique — it is a chain, moving across the matrix from left to right. An attacker might start with phishing (Initial Access), run a malicious script (Execution), steal a password (Credential Access), move to a server (Lateral Movement), collect files (Collection) and send them out (Exfiltration). Each step is a technique, and each technique leaves evidence — a log entry, a network connection, a new file — which is what a SOC looks for.

The explorer shows, for each technique, the evidence a SOC would look for. That is the practical half of ATT&CK: knowing that phishing exists is useful, but knowing that a SOC would look for a suspicious email attachment followed by a new process is what turns knowledge into detection. The technique IDs are included for the same reason: T1566 is phishing, T1078 is using a valid account, T1059 is a command and scripting interpreter, and those codes are how the techniques are named in detection rules, reports and interviews.

ATT&CK is a living framework, updated as attackers change their methods. The explorer uses a small, stable slice of it — the most common techniques in each tactic — rather than the full catalogue of hundreds, because the goal is to teach the shape of the framework, not to reproduce it. The full framework is free to read at the MITRE ATT&CK website, and the guide linked below explains how professionals use it day to day.

Limitations

This explorer is a beginner's map, not the framework itself. It covers thirteen tactics and three or four techniques each — a small slice of a catalogue that contains hundreds of techniques and sub-techniques. The explanations are simplifications, and the evidence notes are examples rather than detection rules. For real defensive work, use the full framework at the MITRE ATT&CK website, and treat this page as the introduction.

• The technique names and IDs are public framework data, used with attribution. This page is not affiliated with, sponsored by, or endorsed by MITRE.
• ATT&CK describes what attackers do; it does not teach how to do it. The techniques here are explained at the level of what they are and what evidence they leave, never as instructions.
• The explorer is a learning tool. It does not assess your network, detect attacks, or tell you whether you are under attack.

Examples

Example 1 — Initial Access, technique T1566 Phishing. The attacker sends an email with a malicious attachment or link. The SOC evidence: a mail log showing the message, a user clicking the link, and a new process starting on that user's computer within minutes. The defence is the same story this site tells everywhere: check the sender, do not click links in unexpected messages, and report phishing instead of opening it.

Example 2 — Credential Access, technique T1110 Brute Force. The attacker tries many passwords against an account. The SOC evidence: a burst of failed logins (Windows event 4625) followed, sometimes, by a success. The defence is a long, unique password and a second factor — which is why the password guides on this site insist on both, and why the SOC simulator practises reading exactly this alert.

Example 3 — Impact, technique T1486 Data Encrypted for Impact. The attacker encrypts the victim's files and demands payment — ransomware. The SOC evidence: a sudden wave of file modifications, a new process encrypting files, and a ransom note appearing on the desktop. The defence is the story the ransomware simulator on this site teaches: offline backups, a written plan, and never paying.

Frequently asked questions

What is MITRE ATT&CK?

A public catalogue of attacker behaviour, maintained by The MITRE Corporation. It organises attacks into tactics (the attacker's goals, such as getting in or stealing data) and techniques (the methods used, such as phishing or stealing passwords), each with a public ID.

What is the difference between a tactic and a technique?

A tactic is what the attacker is trying to achieve — for example, Initial Access, getting into the network. A technique is how they do it — for example, phishing, which is technique T1566 under Initial Access.

What is a technique ID like T1566?

The public code for a technique, used by security professionals to refer to it precisely. T1566 is phishing, T1078 is using a valid account, T1059 is a command and scripting interpreter. Learning the codes makes reports and detection rules easier to read.

Do I need to learn ATT&CK to work in cybersecurity?

For SOC and threat-intelligence roles, yes — it is the shared language of the field, and interviewers expect familiarity with it. For general awareness, the shape of the framework is enough: tactics, techniques, and the evidence each one leaves.

Is MITRE ATT&CK free to use?

Yes — ATT&CK is open and available to any person or organisation for use at no charge, under MITRE's terms of use. This page uses its tactic and technique names for education, with attribution, and is not affiliated with MITRE.