Browse the MITRE ATT&CK Enterprise matrix, see what each technique looks like in logs and what stops it, mark your detection coverage, export it as a Navigator layer and walk through attack chains.
Level: All levelsSkills: Threat modelling, detection engineering
Runs locallyInvented data. Progress is kept only in this browser.
Each column is a tactic: the adversary's goal at that stage. Each cell is a technique: one way to reach that goal. Select a cell to see what the adversary achieves, how it shows up in your logs and which ATT&CK mitigations apply. A technique that serves several goals appears in every column it belongs to, as in ATT&CK itself.
Coverage score
0%
Detected counts 100, partial 50, not detected and not assessed 0. Not applicable techniques are left out.
By tactic
Reconnaissance0%
Resource Development0%
Initial Access0%
Execution0%
Persistence0%
Privilege Escalation0%
Stealth0%
Defense Impairment0%
Credential Access0%
Discovery0%
Lateral Movement0%
Collection0%
Command and Control0%
Exfiltration0%
Impact0%
Top 10 gaps
Priority = gap weight (not detected 2, not assessed 1.5, partial 1) × (1 + attack chains that use the technique), plus 0.5 if it links to a threat profile and 0.25 for each extra tactic.
Detected
Partial
Not detected
Not applicable
Not assessed
Each chain is an invented intrusion at Kuzey Lojistik A.Ş., built step by step from the techniques in the matrix. Pick one and walk through it: the cells light up in order, and each step says what the defender would see.
What the defender sees
Best place to break this chain
ReconnaissanceTA0043 · 4
The adversary gathers information about you before touching your systems.
No match in this tactic
Resource DevelopmentTA0042 · 4
The adversary sets up domains, accounts and tools for the operation.
No match in this tactic
Initial AccessTA0001 · 9
The adversary gets a first foothold inside your network or tenant.
No match in this tactic
ExecutionTA0002 · 9
The adversary runs their own code or commands on a system.
No match in this tactic
PersistenceTA0003 · 12
The adversary keeps access across reboots, password changes and clean-up.
No match in this tactic
Privilege EscalationTA0004 · 12
The adversary gains higher permissions, such as local administrator or domain admin.
No match in this tactic
StealthTA0005 · 10
The adversary hides their activity so it looks like normal behaviour.
No match in this tactic
Defense ImpairmentTA0112 · 8
The adversary breaks or blinds security tools and logging so defenders cannot see or trust what happens.
No match in this tactic
Credential AccessTA0006 · 14
The adversary steals account names, passwords, hashes, tickets and tokens.
No match in this tactic
DiscoveryTA0007 · 5
From inside, the adversary learns your accounts, hosts, services and trust paths.
No match in this tactic
Lateral MovementTA0008 · 9
The adversary moves from the first machine to others that matter more.
No match in this tactic
CollectionTA0009 · 7
The adversary gathers the data they came for: mail, files, databases, cloud storage.
No match in this tactic
Command and ControlTA0011 · 7
The adversary talks to compromised systems to steer them, usually disguised as normal traffic.
No match in this tactic
ExfiltrationTA0010 · 6
The adversary takes the collected data out of your environment.
No match in this tactic
ImpactTA0040 · 6
The adversary disrupts, destroys, encrypts or manipulates systems and data, or steals money.
No match in this tactic
How to use this map
1. Learn the language
ATT&CK names what adversaries do in a shared vocabulary. When an alert, a report or a vendor says T1003.001, everyone means the same thing: reading LSASS memory for credentials.
2. Mark what you can see
Go through the cells with the people who run your logging and EDR. For each technique ask: do we collect the data in “How it shows up in logs”, and does a rule or analyst look at it? Partial means the data exists but nobody watches it, or only some hosts send it.
3. Close the gaps that matter
The gap list puts techniques that real intrusion chains pass through first. Walk the chains to see where your coverage would first notice an attack, and invest where one control breaks several chains.
4. Take it with you
Export your marks as JSON to keep them, or as an ATT&CK Navigator layer to open in MITRE's Navigator and share with your team. Everything stays in this browser until you export it.
Technique names and IDs follow MITRE ATT&CK Enterprise v20. ATT&CK® is a registered trademark of The MITRE Corporation; this lab is an independent teaching tool. attack.mitre.org ↗ · ATT&CK Navigator ↗
Every lab uses invented data and simulates defence work only. Do not test systems you do not own or have written permission to test: unlawful access to an information system is an offence (Turkish Penal Code art. 243).
