MITRE ATT&CK

MITRE ATT&CK is a globally used knowledge base of real-world adversary tactics and techniques, used to describe how attackers operate and to map defensive coverage.

ATT&CK catalogs the tactics (the 'why') and techniques (the 'how') attackers use across the intrusion lifecycle, each with a stable identifier (e.g., T1078, Valid Accounts). Defenders use it to reason about coverage and detection gaps.

Where relevant, Vigil ties findings to the ATT&CK technique an attacker would use to exploit them, connecting a misconfiguration to concrete adversary behavior.