I85PREP
⌘ K
CTDC study materials
CTDC study resources

CTDC: Adversary Tactics, Techniques, and Procedures (MITRE ATT&CK)

CTDC · Work through your exam, one topic at a time.

All guide sections

Adversary Tactics, Techniques, and Procedures (MITRE ATT&CK)

The MITRE ATT&CK domain tests whether you can use the framework as an engineering tool rather than a poster. Items ask you to place behavior at the right tactic, cite the right technique identifier, and convert coverage claims into honest gap analysis.

Structure you must hold straight

  • Enterprise has fourteen tactics in kill-chain-ish order: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact. Mobile and ICS matrices use different tactic sets.
  • Tactic is the why, technique is the how, procedure is the specific implementation. Sub-techniques add necessary granularity: T1059.001 PowerShell, T1003.001 LSASS Memory, T1547.001 Registry Run Keys, T1071.001 Web Protocols, T1566.001 Spearphishing Attachment, T1218.011 Rundll32, T1021.002 SMB/Windows Admin Shares, T1558.003 Kerberoasting, T1486 Data Encrypted for Impact.
  • Objects beyond techniques: software (S####), groups (G####), mitigations (M####), detections (D####), and data sources that tell you which telemetry a detection actually requires.
  • Operational use: Navigator layers for heat maps, coverage gap analysis against your own sensor inventory, purple-team validation with Atomic Red Team or CALDERA, and mapping every detection rule to at least one technique.

Worked example

You have a rule alerting on powershell.exe with -enc and a Base64 payload spawned by an Office process. Reasoning: execution of interpreter code maps to T1059.001; the Office parent pushes initial access toward T1566.001; obfuscation via encoded commands belongs to T1027. Recording all three is correct because one alert can satisfy multiple techniques - but the detection should be tagged primarily to the technique whose data source it consumes, which is process creation. That tag then tells an analyst exactly where to pivot when the rule fires.

Traps that cost marks

Swapping tactic and technique labels. Mapping a multi-stage intrusion to one technique and declaring coverage complete. Quoting a coverage percentage derived from rule counts rather than validated tests. Treating ATT&CK as a linear checklist - real intrusions skip tactics and revisit them.