ATT&CK Threat Hunting key terms

The adversary's tactical goal, answering why an action is performed, such as Credential Access or Lateral Movement. Tactics group related techniques and give hunts a purpose-driven starting point.

A specific method adversaries use to achieve a tactical goal, such as OS Credential Dumping. Techniques carry the identifiers hunters map observations and detections against.

A narrower variant of a technique that describes a distinct implementation, such as LSASS memory dumping versus SAM database dumping. Sub-techniques let mapping and coverage tracking be more precise.

The concrete, observed implementation of a technique by a specific threat actor or tool, including command lines and artifacts. Procedures are the lowest level of the model and the most useful for detection logic.

A tabular layout with tactics as columns and techniques as rows for a given platform, such as Enterprise, Mobile, or ICS. It provides a shared visual vocabulary for mapping behavior.

The operating environment a technique applies to, such as Windows, Linux, macOS, or cloud services. Platform tags determine whether a technique is relevant to the systems a hunt covers.

A category of telemetry that can reveal adversary behavior, such as process creation or network traffic. Data sources are the bridge between techniques and the sensors a defender can collect.

A specific observable within a data source, such as command-line arguments or file creation events. Data components identify what evidence a detection needs to confirm a technique.

An ATT&CK entry describing a tool or malware family and the techniques it implements. Software entries help hunters prioritize behaviors seen when a specific tool is used in the environment.

An ATT&CK entry for a tracked threat actor cluster, listing the techniques and software attributed to it. Groups inform threat-informed prioritization of which techniques deserve hunting effort.

The process of translating intelligence reports, indicators, or observed behaviors into ATT&CK technique identifiers. Good mapping records the evidence supporting each assignment rather than guessing.

An artifact such as a file hash, IP address, or domain associated with malicious activity. Indicators are short-lived and atomic, so they complement rather than replace behavior-based technique mapping.

A pattern of activity, such as a process spawning a shell, that signals adversary tradecraft rather than a specific artifact. Behavioral indicators persist across campaigns and map naturally to techniques.

Prioritizing defensive investment and hunting based on the behaviors of adversaries most likely to target the organization. It uses ATT&CK to connect intelligence about real actors to concrete detection work.

A testable statement that an adversary may be performing a specific behavior in the environment, with the evidence that would confirm or refute it. A strong hypothesis names the technique, the data needed, and the expected observation.

A written document defining scope, hypothesis, required data sources, queries, success criteria, and timeline for a hunt. It keeps the investigation focused and makes results reproducible.

A framework describing progressive levels of hunting capability, from relying on automated alerting to hypothesis-driven, data-agnostic searches. It helps teams assess and plan capability growth.

Identifying the systems, data, and identities whose compromise would most harm the organization, then prioritizing hunts around them. It scopes hunting effort where adversary impact would be greatest.

The raw event and log data collected from endpoints, networks, cloud services, and identity providers. Telemetry quality and coverage determine which behaviors a hunt can actually observe.

A record of a new process starting, often including parent process, command line, user, and hash. It is a core Windows and Linux source for detecting execution and defense evasion techniques.

A Windows policy that records full command-line arguments for process creation events. Without it, many execution and script-based techniques are invisible or ambiguous in logs.

A Windows system service that logs detailed process, network, file, registry, and driver events to the event log. Its configuration determines which behaviors are captured and how noisy the data is.

The Linux kernel auditing subsystem that records system calls and security-relevant events based on configured rules. Thoughtful rule sets are needed to capture execution and persistence activity without flooding storage.

Provider-generated records of control-plane actions such as identity changes, permission grants, and resource creation. These logs are essential for detecting cloud account manipulation and persistence.

Authentication and authorization events from systems such as Entra ID or Okta, including sign-ins, MFA results, and token issuance. They reveal credential access, account manipulation, and token theft behaviors.

A device or tap capturing traffic metadata or content, such as Zeek logs, NetFlow, or DNS logs. Network telemetry exposes command-and-control and lateral movement that endpoint logs may miss.

The mapping of which assets, users, and environments actually send usable telemetry to the defender. Gaps in coverage create blind spots that invalidate negative hunt findings.

The completeness, timeliness, consistency, and fidelity of collected telemetry. Poor quality causes false negatives and false positives, so it must be validated before trusting hunt results.

Transforming heterogeneous log formats into a common schema with consistent field names and values. It lets one query reason across multiple platforms and sensors.

A search written around adversary behavior and relationships between events rather than static indicators. It typically joins process, parent, user, and network context to surface suspicious patterns.

A documented picture of normal activity for an environment, such as typical parent-child process relationships or login patterns. Deviations from a baseline guide hunting and reduce false positives.

An observation that departs from established baseline behavior, such as an unusual process lineage or off-hours access. Anomalies are hunt leads that require context to judge as malicious or benign.

Grouping events by a field such as parent process or command line and ranking by frequency to find rare outliers. It is a simple, effective technique for surfacing uncommon adversary behavior.

Running the planned queries and manual analysis, documenting findings, and iterating on leads as evidence emerges. Execution discipline ensures results are recorded and comparable across hunts.

Rapidly assessing hunt hits to separate likely malicious activity from benign noise using context and corroborating data. Effective triage determines what escalates to incident response.

An alert or hunt hit flagged as suspicious that is actually legitimate activity. Reducing them requires tuning logic and enriching context rather than simply suppressing results.

Malicious activity that a hunt or detection fails to surface, often due to telemetry gaps or overly narrow logic. False negatives are the most dangerous failure mode because they create silent blind spots.

The rule, query, or analytic that encodes a behavior and produces an alert when matched. It is the durable output of a successful hunt and must be tested before deployment.

The discipline of designing, testing, deploying, and maintaining detection logic with version control and lifecycle management. It converts validated hunt findings into repeatable, monitored analytics.

A measure of which techniques or sub-techniques the organization can reliably detect, often shown as a heat map. Coverage claims should reflect tested logic and available telemetry, not intent.