I85PREP
⌘ K
MITRE ATT&CK Fundamentals study materials
MITRE ATT&CK Fundamentals study resources

MITRE ATT&CK Fundamentals: Adversary Tactics and the Enterprise Matrix

MITRE ATT&CK Fundamentals · Work through your exam, one topic at a time.

All guide sections

Adversary Tactics and the Enterprise Matrix

The Adversary Tactics and the Enterprise Matrix domain tests how well you read the Enterprise matrix and map behavior to the right column. The Enterprise matrix presents tactics as columns and techniques as rows. In the current Enterprise matrix the tactics are Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact. The first two absorbed much of the older Pre-ATT&CK material. Platform filters (Windows, macOS, Linux, Cloud, Network, Containers) change which techniques are relevant; a technique's presence does not mean it applies to every platform.

Core rules

  • A tactic is a goal, not a mandatory stage or a timestamp.
  • One action can serve several tactics: a scheduled task can be persistence and privilege escalation.
  • Defense Evasion is especially broad because many behaviors hide activity.
  • Use the platform and permission context when scoping a matrix for an environment.

Worked example

An analyst sees a user open a malicious attachment that launches a PowerShell downloader, then registers a service. Initial Access is Phishing (T1566.001 for a spearphishing attachment). Execution is PowerShell (T1059.001). Persistence could be Create or Modify System Process: Windows Service (T1543.003). The service registration is not Lateral Movement unless it moves to another host. Writing the reasoning prevents column drift.

Traps

Treating matrix columns left-to-right as an intrusion timeline is the most common error. Another is mapping an event to every plausible tactic rather than the defensible one. Ignoring platform columns creates false gaps. Finally, do not confuse tactic names with the older Cyber Kill Chain phases; they overlap but are not one-to-one.