MITRE ATT&CK Tactics
ATT&CK organises what attackers do into tactics, which are goals, and techniques, which are the ways of reaching them. Exam questions give you an observed behaviour and ask which tactic it belongs to.
MITRE ATT&CK Tactics · firsttry.app/cheatsheets/mitre-attack-tactics · original reference written from published exam objectives. Not affiliated with any certification body.
Enterprise tactics, in rough order
| Tactic | The attacker's goal | Common techniques |
|---|---|---|
| Reconnaissance | Gather information before touching anything | Scanning, open source research, phishing for information |
| Resource Development | Build the infrastructure to attack from | Registering domains, buying servers, creating accounts |
| Initial Access | Get a first foothold | Phishing, exploiting a public application, valid accounts |
| Execution | Run attacker code | Command interpreters, scheduled tasks, WMI |
| Persistence | Survive a reboot or a password change | Registry run keys, services, scheduled tasks, new accounts |
| Privilege Escalation | Get higher permissions | Token manipulation, exploiting a vulnerability, bypassing UAC |
| Defense Evasion | Avoid being detected | Obfuscation, disabling tools, clearing logs, masquerading |
| Credential Access | Steal usernames and passwords | Dumping LSASS, keylogging, brute force, Kerberoasting |
| Discovery | Learn the environment from inside | Account, network and system enumeration |
| Lateral Movement | Reach other systems | Remote services, pass the hash, RDP |
| Collection | Gather the data of interest | Screen capture, clipboard, staging in an archive |
| Command and Control | Talk to compromised hosts | Web protocols, DNS tunnelling, encrypted channels |
| Exfiltration | Get the data out | Transfer over C2, over an alternative protocol, to cloud storage |
| Impact | Damage, disrupt or extort | Encryption for ransom, wiping data, service stop |
Cyber Kill Chain, and how it differs
| Kill Chain phase | What it covers | ATT&CK equivalent |
|---|---|---|
| Reconnaissance | Target research | Reconnaissance |
| Weaponisation | Building the payload | Resource Development |
| Delivery | Sending it | Initial Access |
| Exploitation | Triggering the vulnerability | Execution |
| Installation | Establishing a foothold | Persistence |
| Command and Control | Remote control channel | Command and Control |
| Actions on Objectives | Whatever they came for | Collection, Exfiltration, Impact |
Related models
| Model | What it is for |
|---|---|
| Diamond Model | Four features of an intrusion: adversary, capability, infrastructure, victim |
| Pyramid of Pain | Ranks indicators by how much it costs an attacker when you block them |
| ATT&CK Navigator | Layer tool for mapping coverage and gaps against the matrix |
| D3FEND | MITRE's defensive counterpart to ATT&CK |
| STIX / TAXII | Formats for describing and exchanging threat intelligence |
Exams covered
Now test yourself
Memorizing a table is a start. Practice questions are what make it stick, and every answer carries the full explanation.