Enterprise ATT&CK is MITRE’s knowledge-base domain for describing adversary behavior in enterprise IT environments, including endpoints, identity systems, servers, and cloud services. It organizes behavior into tactics-the goals an adversary pursues-and techniques, which describe how those goals may be achieved.
Security teams use Enterprise ATT&CK to map observed activity, assess detection coverage, build threat models, and communicate gaps. In real attacks, defenders may map behaviors such as credential theft or remote service use to relevant techniques, then check whether their logs and alerts can identify them. ATT&CK is a framework for describing behavior, not proof that a particular attack occurred; teams should also record the framework version used because entries and mappings can change over time.