MITRE ATT&CK Mapper
A searchable reference of real ATT&CK tactics and techniques, tied back to where this course covers each one.
MITRE ATT&CK is the shared map of how intrusions actually unfold — tactics describing what an attacker is trying to achieve, and techniques describing how. It is the vocabulary detection engineers, threat hunters and red teams use to talk to each other precisely.
How to use it
- Search by technique name, tactic, or ATT&CK ID.
- Read the matching entries and the tactic each belongs to.
What to take away
Tactic is the why, technique is the how
Credential Access is a tactic. Kerberoasting is a technique serving it. Reports that name only the technique leave out the intent.
IDs are the stable reference
Names get revised; T-numbers do not. Cite the ID in detections and reports so they survive renaming.
Coverage maps expose blind spots
Plotting your detections onto the matrix shows which tactics you cannot see at all — usually a more useful exercise than counting how many rules you have.
Frequently asked questions
What is the difference between ATT&CK and the Cyber Kill Chain?
The Kill Chain is a short linear model of an intrusion. ATT&CK is a far more granular catalogue of observed behaviours, and it does not assume attackers move in a straight line — because they do not.
How is ATT&CK actually used day to day?
To tag detections, to structure red team plans and reports, to compare tooling coverage, and to communicate threat intel in terms everyone reads the same way.
Do I need to memorise technique IDs?
No. You will absorb the ones in your area naturally. Understanding the tactic structure is what matters.
Where this fits in the course
This security tool pairs with Path 16 — Advanced Topics — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Simplified YARA Rule Tester — Test a small set of required strings against sample content and see whether your rule matches.
- Log Analysis / IR Lab — A messy auth.log dump from a compromised box. Reconstruct the timeline and find the breach — blue-team skills, not exploitation.
- STRIDE Threat-Model Worksheet — A guided Spoofing/Tampering/Repudiation/Info-Disclosure/DoS/Elevation worksheet, exportable as Markdown.
- Compliance Control Mapper — Look up how one control area maps across SOC 2, ISO 27001, NIST 800-53, and PCI-DSS.