MITRE ATT&CK is best described as...

• A. A collection of digital forensics tools
• B. A framework for incident response playbooks
• C. A knowledge base of attacker techniques and tactics used to map observed activities to techniques for detection and hunting.
• D. A set of firewall rules for blocklists

Answer: (C)

MITRE ATT&CK is a knowledge base of attacker techniques and tactics used to map observed activities to techniques for detection and hunting. It catalogs adversary behaviors in a structured matrix of tactics and techniques, with descriptions and guidance that help security teams understand what to look for and how to detect it. This makes it a practical tool for threat modeling, detecting gaps in coverage, and building hunting scenarios, by translating real-world activity into known techniques analysts can search for. It isn’t a collection of digital forensics tools, nor a set of firewall rules, and it isn’t itself a framework of incident response playbooks—though teams often use ATT&CK to inform playbooks, detections, and response planning by providing a common language and mapping between observed behavior and defensive actions.