MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a publicly available knowledge base of how attackers behave, built from real-world observations. It gives defenders a shared vocabulary for describing intrusions and is used to build threat models, detections and assessments.

How it is organized

• Tactics describe the attacker’s goal at a given step, such as initial access, persistence, credential access or exfiltration.
• Techniques and sub-techniques describe how that goal is reached, each with an ID such as T1110 for brute force.
• Groups and software pages link known threat actors and malware to the techniques they use.
• Mitigations and data sources show how each technique can be prevented or detected.

Separate matrices cover enterprise IT, mobile and industrial control systems.

Why it matters for dark web monitoring

ATT&CK links underground findings to defensive action. Stolen credentials offered for sale map to techniques such as valid accounts; a phishing kit maps to phishing for initial access; a stealer log maps to credentials from web browsers. Mapping intelligence this way shows which controls and detections should be checked first. It also helps teams describe TTPs consistently across reports, tools and partners.

Sources: MITRE ATT&CK, MITRE ATT&CK: FAQ