Reading an ATT&CK tactic page

MITRE ATT&CK organizes the Enterprise matrix into 15 tactics as of version 19.2. Each tactic has its own page at attack.mitre.org. The pages follow the same layout, so once you can read one you can read them all.

The header

At the top you will find the tactic name, its ID (for example TA0006 for Credential Access) and a short description of the adversary's goal. The page also shows when the tactic was created and last modified. That date matters: Defense Impairment (TA0112) shows a creation date of 14 April 2026, which tells you any material written before then will not use it.

The technique list

The main table lists techniques under the tactic, each with an ID beginning with T and a one-line description. Some techniques have sub-techniques, shown with a dot and a number after the technique ID. Hunters should scan the whole list, not only the familiar names: the less common techniques are where coverage gaps tend to sit.

Technique pages

Clicking a technique opens its own page. The sections most useful for hunting are the description of how the technique works, procedure examples showing how named groups have used it, and the detection guidance, which points to the data that would reveal the behavior. The detection guidance is the bridge to a hypothesis: it tells you which data source to check.

Turning the page into a hunt

1. Pick a tactic that matches a risk you care about.
2. From its technique list, choose one technique that your data could show.
3. Read the technique's detection guidance and confirm you can reach that data.
4. Write a hypothesis using the four parts from the hypothesis lesson.
5. Tag the hunt with the tactic and technique IDs.

A note on versions

ATT&CK changes. Version 19 split Defense Evasion into Stealth (TA0005) and Defense Impairment (TA0112). When a vendor or an old document cites a tactic, check which version it used. Our post what MITRE ATT&CK v19 changes for threat hunters covers the update, and the ATT&CK coverage field note lists all 15 tactics.

Sources

• MITRE ATT&CK, Enterprise tactics
• MITRE ATT&CK, TA0112 Defense Impairment