Frequently Asked Questions
General
What is ATT&CK?
Why did MITRE develop ATT&CK?
What are "tactics"?
What are "techniques"?
What are "sub-techniques"?
What are "procedures"?
What are the differences between sub-techniques and procedures?
What technologies does ATT&CK apply to?
How can I use ATT&CK?
Content
How often is ATT&CK updated?
Where does the info in ATT&CK come from?
How can I contribute content to ATT&CK?
Check out our contribute page!
Please contact us before spending a lot of time writing up a new technique/group/software since we always have things in the works and don’t want you to duplicate efforts. For any contributions we add, we'll run the final product by you and credit you as a contributor. In particular, we're looking for Mac/Linux contributions.
My "favorite" threat group isn't included in ATT&CK - why?
Resources
Are there APIs I can use to access the ATT&CK content?
Staying Informed
How do I stay up to date with what's happening with ATT&CK?
ATT&CK and Other Models
How does ATT&CK relate to other cyber frameworks and models?
What is the relationship between ATT&CK and the Diamond Model?
What is the relationship between ATT&CK and the Lockheed Martin Cyber Kill Chain®?
Legal
How should I reference the name ATT&CK?
Both MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation.
- Your first references in writing must include "MITRE" preceding "ATT&CK®" - but subsequently should just reference "ATT&CK" (no registered trademark symbol required).
- Example of a first reference: MITRE ATT&CK® is a curated knowledge base and model for cyber adversary behavior...
- Example of subsequent reference: ATT&CK is useful for understanding security risk against known adversary behavior...
- A headline should always reference "MITRE ATT&CK" together (never only "ATT&CK®").
- Always capitalize "ATT&CK" to distinguish it from the surrounding text.
- Do not modify the trademark, such as through hyphenation or abbreviation. For example, "ATT&CK'd!", "Plan-of-ATT&CK", "ATTK".
- You may not display the ATT&CK trademark in any manner that implies an affiliation with, sponsorship, or endorsement by MITRE, or in a manner that can be reasonably interpreted to suggest third party content represents the views and opinions of MITRE or MITRE personnel, unless those third parties receive express permission from MITRE.
- You may not use ATT&CK in your product names, service names, trademarks, logos, or company names.
Where can I download the MITRE ATT&CK logo?
You can find the MITRE ATT&CK logo here:
If you need a vector graphic of the MITRE ATT&CK logo, please contact us.
Can I use ATT&CK in my products and/or services?
Yes – ATT&CK is open and available to any person or organization for use at no charge. If you decide to use ATT&CK, then follow the terms of use. If you have further questions, then please reach out to us at attack@mitre.org.
Remember, you may never use MITRE ATT&CK, MITRE, or ATT&CK in a way that implies an endorsement of a product or service. MITRE does not endorse those organizations, individuals, etc. leveraging MITRE ATT&CK in their work. The inclusion of MITRE ATT&CK does not imply endorsement or support from MITRE.