I85PREP
⌘ K
MITRE ATT&CK Fundamentals study materials
MITRE ATT&CK Fundamentals study resources

MITRE ATT&CK Fundamentals: Techniques, Sub-techniques, and Procedure Examples

MITRE ATT&CK Fundamentals · Work through your exam, one topic at a time.

All guide sections

Techniques, Sub-techniques, and Procedure Examples

The Techniques, Sub-techniques, and Procedure Examples domain tests precise mapping and knowledge of ATT&CK entry structure. Every technique has a T#### identifier. Sub-techniques use T####.### and narrow the parent's scope, often by platform, target, or method. A procedure is the observed use of a technique by a group, software, or campaign; it is not a separate ATT&CK object with a T-number. Technique pages include description, platforms, required permissions, effective permissions, detection guidance, references, and procedure examples. Sub-techniques inherit the parent's context but can have distinct detection logic and data components.

Mapping rules

  • Map to the most specific technique you can defend with evidence.
  • If the evidence only supports the general behavior, use the parent technique.
  • Record the procedure text and source separately from the technique ID.
  • Check deprecations and revoked IDs before publishing a mapping.

Worked example

Telemetry shows rundll32.exe loading a DLL from a user-writable directory to execute code. The defensible mapping is Signed Binary Proxy Execution: Rundll32 (T1218.011), not the broad parent T1218. If the evidence only says 'a signed Windows utility ran,' the parent may be appropriate. The command line, parent process, and user context belong in the procedure note. A detection should target the specific image path and DLL location, not merely the string rundll32.

Traps

Do not map every use of a tool to the technique named after it. Do not choose a sub-technique without evidence of its distinguishing feature. Do not use a procedure example as proof that your environment will see the same implementation. Do not treat deprecated technique IDs as current; validate against the ATT&CK version you cite.