A shared language for attacker behaviour
MITRE ATT&CK is a catalogue of attacker techniques, each with an ID like T1110. Mapping your findings to it lets any team understand the attack and check whether they can detect it. Here is this intrusion, mapped:
| Observed | Technique | ID |
|---|---|---|
| SSH brute force | Brute Force | T1110 |
| Reused a valid account | Valid Accounts | T1078 |
| Network/port scanning | Network Service Discovery | T1046 |
| Dropped a PHP web shell | Server Software Component: Web Shell | T1505.003 |
| Encoded PowerShell | Command & Scripting Interpreter: PowerShell | T1059.001 |
| Created a backdoor account | Create Account | T1136 |
Tip: You do not memorise these — you recognise the behaviour and look up the ID. The point is to describe the attack in terms a detection engineer can turn into coverage.