Sub-Technique
Definition
A finer-grained variation of a technique, identified with a decimal suffix such as T1059.001 for PowerShell under the Command and Scripting Interpreter technique. Sub-techniques allow analysts to be precise about which specific method was used.
- Framework
- MITRE ATT&CK
- Notation
- Decimal suffix, e.g. T1059.001
- Parent example
- T1059 Command and Scripting Interpreter
- Example value
- T1059.001 identifies PowerShell specifically
Common questions
Why did MITRE add sub-techniques instead of just more techniques?+
Early ATT&CK techniques were broad and sometimes forced analysts to guess at the specific method behind an observed behaviour. Sub-techniques let analysts record the exact tool or mechanism, such as which scripting interpreter was used, while still rolling up to the parent technique for higher-level reporting.
Does a sub-technique replace its parent technique in an incident report?+
No, it supplements it. Analysts typically cite both the parent technique and the sub-technique, since some detection and reporting tools track behaviour at the parent level while threat-hunting playbooks often need the finer sub-technique detail.
Related terms
- ATT&CK Navigator
- A free, browser-based visualisation tool from MITRE that renders the ATT&CK matrix as an interactive heat map. Teams use it to annotate...
- Tactic
- The adversary's high-level objective at a given stage of the attack: for example, Initial Access, Execution, Persistence, Privilege Escalation, or Exfiltration. ATT&CK...
- Technique
- A specific method an adversary uses to achieve a tactic. Each technique has a unique identifier such as T1059 (Command and Scripting...
- Threat Group Profile
- An ATT&CK entry for a named threat actor, listing the techniques attributed to that group based on public reporting. Analysts use group...
- TTP (Tactics, Techniques, and Procedures)
- The three levels of specificity used to describe attacker behaviour. Tactics are the goal (e.g., persistence). Techniques are the method (e.g., scheduled...