MITRE ATT&CK: Tactics & Techniques
Executive Summary
MITRE ATT&CK is a structured, globally used framework describing how attackers actually behave. Tactics represent goals, and Techniques represent how those goals are achieved.
14 Tactics
- Reconnaissance: Collecting info before the attack.
- Resource Development: Preparing malware, domains, accounts.
- Initial Access: First entry point.
- Execution: Running commands/code.
- Persistence: Staying in the system long-term.
- Privilege Escalation: Becoming admin/root.
- Defense Evasion: Avoiding detection.
- Credential Access: Stealing passwords/hashes/tokens.
- Discovery: Exploring internal environment.
- Lateral Movement: Moving between systems.
- Collection: Gathering important data.
- Command and Control: Communicating with attacker infra.
- Exfiltration: Sending data out.
- Impact: Causing damage (ransomware, DoS).
Common Techniques
| Stage | Technique | Description |
|---|---|---|
| Initial Access | T1566 | Phishing |
| Initial Access | T1190 | Exploit public-facing application |
| Initial Access | T1133 | VPN/RDP login with stolen credentials |
| Execution | T1059 | Command/script execution (PowerShell, Bash, CMD) |
| Persistence | T1547 | Boot or logon autostart execution |
| Persistence | T1053 | Scheduled task / cron |
| Privilege Escalation | T1068 | Local privilege escalation exploit |
| Privilege Escalation | T1548 | UAC/sudo bypass |
| Defense Evasion | T1027 | Obfuscated or encoded scripts |
| Defense Evasion | T1562 | Disable security tools (AV/EDR) |
| Credential Access | T1003 | Credential dumping (LSASS) |
| Credential Access | T1110 | Password spraying / brute force |
| Credential Access | T1555 | Credentials stored in config files |
| Discovery | T1087 | Enumerate domain users/groups |
| Discovery | T1018 | Scan internal hosts |
| Lateral Movement | T1021 | SMB/RDP/SSH movement |
| Exfiltration | T1041 | Exfiltration over C2 channel |
| Exfiltration | T1048 | Exfiltration using DNS/ICMP tunneling |
| Impact | T1486 | Data encrypted for impact (ransomware) |
| Impact | T1499 | Endpoint denial-of-service |