What is MITRE ATT&CK framework used for?

• A. A database of CVEs.
• B. A set of firewall rules.
• C. A malware packing technique.
• D. A knowledge base of adversary techniques; used to map detections, threats, and plan adversary emulation; informs security controls and assessments.

Answer: (D)

MITRE ATT&CK is a knowledge base of adversary techniques and procedures, organized by attacker goals and real-world behavior. It’s used to map what security detections and controls cover to the specific techniques attackers use, to understand the overall threat landscape, and to plan adversary emulation or red-team exercises. In practice, teams reference ATT&CK to identify gaps in coverage, align security monitoring to known techniques, and guide assessments and threat intelligence work. For example, you might map a detected PowerShell script to a technique in the execution or defense-evasion category, enabling you to see which areas of your environment are protected and which require additional controls. This framework is not about vulnerabilities (that would be CVEs), not about generic firewall configurations, and not about a single malware technique; it’s a comprehensive catalog of attacker behavior used to strengthen detection, response, and defensive planning.