MITRE ATT&CK
A knowledge base of adversary tactics and techniques observed in real intrusions, such as T1078 Valid Accounts and T1195 Supply Chain Compromise, used to plan detections, describe incidents and test defenses.
- Also called
- ATT&CK
- Defined in
- MITRE ATT&CK
Covered in
Guide
Turn runtime events into a tested investigation and containment path
Collect evidence that answers a concrete security question and rehearse the response without destroying the facts needed to investigate.
Case study
Case study: the Shai-Hulud npm worm (2025-2026)
How a self-replicating npm worm turned stolen tokens into hundreds of infected packages in 2025, how its 2026 successors hijacked release pipelines and trusted publishing, what npm and GitHub changed in response, and the publishing, install and response practices that stop it.