6.2 Navigating MITRE ATT&CK: Tactics, Techniques, Sub-techniques

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a publicly maintained knowledge base of adversary tactics, techniques, and procedures (TTPs). It is not a product you install, not a scoring engine, and not a promise that every intrusion follows a single path. SAL1 training content introduces ATT&CK so that an entry-level analyst can navigate it: name the adversary's goal, name the behavior, and map a real incident onto technique IDs. This independent study section teaches that navigation. It does not ask you to memorize every cell of the matrix.

What ATT&CK is—and what it is not

Think of ATT&CK as a shared language. When one SOC writes "the attacker dumped LSASS" and another writes "credential dumping from memory," they can both point at T1003. When a detection engineer asks whether PowerShell is covered, they can look up T1059.001 and read listed data sources instead of arguing from folklore.

ATT&CK is organized as a matrix:

• Tactics are the columns. A tactic is an adversary goal at a stage of the intrusion: get in, run code, stay, steal credentials, leave with data, and so on. Tactic IDs look like TA0002 (Execution).
• Techniques are the cells under a tactic. A technique is a reasonably technology-agnostic method for achieving that goal, with an ID like T1059 (Command and Scripting Interpreter).
• Sub-techniques split a technique into specific flavors, with IDs like T1059.001 (PowerShell), T1059.003 (Windows Command Shell), or T1059.004 (Unix Shell).
• Procedures are the concrete implementations: this malware family, this command line, this script. Procedures live in examples and threat reports more than in a single extra ID column.

ATT&CK is not a timeline you must walk left to right. An intrusion can skip columns, repeat a column, or use several techniques under one tactic in the same hour. That flexibility is a feature. It is also why ATT&CK and the Cyber Kill Chain are not the same model—the next chapter compares them. For navigation, remember: columns are goals, cells are methods.

Enterprise matrix versus lookup skill

The matrix people mean in a SOC is usually Enterprise ATT&CK (Windows, Linux, macOS, cloud, containers, and network-centric behaviors). MITRE also publishes Mobile and ICS matrices. Do not mix them blindly: a mobile-only technique ID will confuse a Windows case.

The Enterprise matrix is large on purpose. New techniques appear as tradecraft evolves. Trying to memorize every cell is a failing study strategy. What SAL1-style questions and SOC work actually require:

1. Know the difference among tactic, technique, and sub-technique.
2. Recognize a handful of high-frequency tactics by name.
3. Given a behavior ("phishing email," "scheduled task," "LSASS dump"), know that you can search ATT&CK and land on a stable ID.
4. Read a technique page for data sources, detections, and mitigations during triage—not from memory at 3 a.m.

If you can open a technique page and extract which logs would show the behavior, you are using ATT&CK the way an analyst uses it. Lookup is the skill. Trivia is not.

How a SOC analyst uses ATT&CK during triage

A practical loop you can run on almost any ticket:

1. Read the alert as a behavior, not as a vendor name. "EDR detected X" is not a mapping. "A scheduled task was created that launches PowerShell from a temp path" is.
2. Ask the tactic question first. What was the adversary trying to achieve in this step? Run code? Stay after reboot? Steal credentials? Talk to a server on the internet?
3. Pick a technique only when evidence supports it. Process creation plus an encoded PowerShell blob can support T1059. A single unsigned binary in Downloads does not, by itself, tell you the tactic.
4. Drop to a sub-technique when you know the flavor. PowerShell versus cmd versus Bash changes which logs you pull (script-block logging versus Sysmon versus auditd).
5. Use the technique page as a checklist of telemetry. If MITRE lists Windows event logs and process monitoring, and you have neither, say so in the ticket. That is a detection-coverage finding, not a personal failure.
6. Write IDs in the case. T1566 in the summary helps the next analyst, the detection engineer, and anyone correlating incidents next month.

ATT&CK does not replace evidence. It labels evidence. If you cannot yet name a technique, leave the field as still investigating and keep collecting logs.

High-frequency tactics you will actually type

Reconnaissance and Resource Development exist in Enterprise ATT&CK and matter to threat intel, but many SOC queues are dominated by the tactics below. Learn their goals and one example technique each. You can look up the rest.

Notice the pattern: the left column is a goal, the right column is one method. Phishing is not the only Initial Access technique (valid accounts and exploit public-facing application also exist). Scheduled tasks are not the only persistence technique. Your exam and your tickets reward choosing a defensible cell, not inventing a unique nickname.

Reading an ID on sight

• TA prefix: tactic (TA0003 Persistence).
• T plus four digits: technique (T1059).
• T plus four digits plus a dot and three digits: sub-technique (T1059.001).

If you see T1059.001, you should be able to say out loud: this is a sub-technique of Command and Scripting Interpreter, specifically PowerShell, under the Execution tactic—though PowerShell can also support other tactics depending on why it ran. That last clause matters. The same binary can map to Execution (run the payload), Defense Evasion (obfuscated encoded command), or Credential Access (invoking a dumper). The tactic follows the goal of that step, which you infer from context, not from the filename alone.

Navigation habits that prevent wasted time

• Search by behavior ("LSASS memory") rather than by malware family first.
• Filter by platform (Windows versus Linux versus cloud) so you do not apply a macOS technique to a domain controller.
• Read mitigations as recommendations for the case's suggested actions, not as orders you can implement from the SOC chair without change control.
• Treat procedure examples as illustrations. The presence of a named malware family on the page does not mean your alert is that family.
• When two columns could fit, ask which goal this step served. Creating a scheduled task to survive reboot is Persistence even if the task later performs Execution when it fires.

If you remember only one operational sentence from this section, remember this: tactics are goals, techniques are methods, sub-techniques are specific methods, and the matrix is a lookup table you use during triage—not a script you memorize.