1.4.1. MITRE ATT&CK Tactics and Techniques

💡 First Principle: Attackers have a limited set of goals and a much larger set of methods for reaching each one. ATT&CK organizes knowledge exactly that way: tactics are the why (the goal at a stage of an attack), techniques are the how (a method for achieving that goal), and sub-techniques refine a method. Organizing by behavior rather than by tool means the model stays useful when attackers change their malware.

The Enterprise ATT&CK matrix has 14 tactics, which roughly follow an intrusion from preparation to impact: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact. Each tactic contains techniques with IDs such as T1566 (Phishing, under Initial Access) or T1003 (OS Credential Dumping, under Credential Access).

Microsoft's tools speak this language throughout. Alerts carry tactic and technique tags. Sentinel analytics rules and hunting queries are mapped to techniques, and Sentinel's MITRE ATT&CK page shows how many active rules and queries cover each technique (2.5.3). Defender XDR incidents display the tactics involved in their attack story, and threat analytics reports describe threat actors in ATT&CK terms.

Coverage analysis is the most testable use. Overlay your enabled rules on the matrix, then look for clusters of empty cells in tactics that matter to your threat model. A SOC with strong Initial Access coverage but nothing in Lateral Movement will catch the phish and miss the spread. The fix is usually a combination of new data sources, new or enabled rules, and hunting queries targeting the gap.

⚠️ Exam Trap: Tactic and technique are not interchangeable. "Credential Access" is a tactic; "OS Credential Dumping" is a technique within it. Hotspot and drag-drop items that ask you to place behaviors at the correct level of the matrix are testing exactly this distinction.

Reflection Question: Why does organizing detections by technique rather than by malware family make a SOC more resilient when an attacker switches to a new tool?