Technique
Definition
A specific method an adversary uses to achieve a tactic. Each technique has a unique identifier such as T1059 (Command and Scripting Interpreter). Techniques answer the question of how an attacker achieves their goal.
- Field
- Cyber threat intelligence, MITRE ATT&CK
- Definition
- Specific method used to achieve a tactic
- Example ID
- T1059, Command and Scripting Interpreter
- Question answered
- How does the attacker achieve the goal?
Common questions
Why does each ATT&CK technique have a unique identifier like T1059?+
The identifier gives analysts and tools a common reference that does not depend on wording, so a detection rule, a threat report, and a SIEM alert can all point to the exact same method even when different vendors describe it in different language.
What is a sub-technique and how does it relate to a technique?+
A sub-technique is a more specific variant of a parent technique, for example a particular scripting interpreter used under Command and Scripting Interpreter. ATT&CK added sub-techniques to let analysts record detail without losing the broader technique-level grouping.
Related terms
- Tactic
- The adversary's high-level objective at a given stage of the attack: for example, Initial Access, Execution, Persistence, Privilege Escalation, or Exfiltration. ATT&CK...
- ATT&CK Navigator
- A free, browser-based visualisation tool from MITRE that renders the ATT&CK matrix as an interactive heat map. Teams use it to annotate...
- Credential Dumping
- Extraction of authentication credentials from operating system memory, the Windows SAM database, Active Directory, or credential stores. Tools such as Mimikatz target...
- Lateral Movement
- Attacker activity after initial compromise in which the threat actor traverses from one internal system to another, typically to escalate privileges, access...
- Living-Off-the-Land (LotL)
- An attack approach where the adversary uses tools and binaries already present on the target system, such as PowerShell, WMI, certutil, or...
- MITRE ATT&CK
- A publicly available knowledge base of adversary tactics, techniques, and procedures derived from real-world intrusion observations. Maintained by the MITRE Corporation. Techniques...
- Sub-Technique
- A finer-grained variation of a technique, identified with a decimal suffix such as T1059.001 for PowerShell under the Command and Scripting Interpreter...
- Threat Group Profile
- An ATT&CK entry for a named threat actor, listing the techniques attributed to that group based on public reporting. Analysts use group...
- TTP (Tactics, Techniques, and Procedures)
- The three levels of specificity used to describe attacker behaviour. Tactics are the goal (e.g., persistence). Techniques are the method (e.g., scheduled...
Explained in these topics
- Common Attack Techniques and Tactics, Techniques and ProceduresThe specific method used to achieve a tactic. For example, the tactic Credential Access can be achieved by the technique OS Credential Dumping (T1003). A singl...
- MITRE ATT&CK in Threat Hunting and Incident Response