ATT&CK, Kill Chain and TTPs

A tactic names the adversary's goal for an action, not the action. The same technique can serve several goals, so ATT&CK lists it under every tactic it achieves: T1078 Valid Accounts sits in four columns.

A T#### identifier names a technique, a class of adversary behaviour, and T####.### a sub-technique of it. The exact command line you saw is a procedure: one implementation of that class, and ATT&CK gives procedures no identifier at all.

No. ATT&CK's tactic columns are goal categories, not stages. An intrusion can re-enter one column repeatedly, never touch several of them, and hit them in any order. The Cyber Kill Chain is the model that asserts order; ATT&CK's columns do not.

That an intrusion succeeds only if it completes all seven stages in order, so removing any one stage defeats the whole attempt. It inverts the usual asymmetry: the intruder must win every link, not just one.

None does. An ATT&CK technique page carries an ID, tactics, platforms, procedure examples, mitigations, detection notes and data components, but no severity, likelihood, frequency or impact score. Severity is a property of your estate, not of the technique.

Height measures the adversary's replacement cost: how much money and operator time it costs them to swap that thing once it stops working. It says nothing about how dangerous the thing is or how confident you are.

No. An ATT&CK T-number names a class of adversary behaviour, not a defect in a product. T1550.001 - using an application's access token - involves nothing broken, so only a control over grants and scopes changes exposure.

None can be read from the unit alone. The same timer is byte-identical whether an operator installed it to keep access, installed it to reach root, or an administrator installed it during maintenance. The tactic names the goal, and the goal is not on disk.

No. You removed one procedure, a matchable value, not the technique. T1059.004 is the class of using a Unix shell to execute commands, and an operator who already runs code on that runner respells it in minutes.

Reconnaissance, Weaponization, Delivery and Exploitation. The buyer's path begins no earlier than Installation, and where the purchased access is itself standing access, their first act is Actions on Objectives.

Credit it only when the described outcome entails the step, and only as a row marked inferred against the sentence behind it. Silence is a fact about the author, not the intrusion.

ATT&CK records what was done and toward which goal, never whether the actor was permitted to do it. A cloud bulk-read technique is equally true of the nightly analytics job, so the identifier carries nothing that makes the export wrong.

Only that, within a dated window, a host presenting a particular private key exchanged traffic with a particular endpoint. It establishes an edge to a victim asset, not a compromise, not targeting, and not that the asset belongs to that company.

T1527 was revoked in the July 2020 ATT&CK v7 release, when sub-techniques were introduced. The same behaviour is now T1550.001, a sub-technique of Use Alternate Authentication Material. The number changed; the adversary behaviour did not.

By pivoting: a feature you already know is used as a search key to find features you do not. Knowing the capability and the infrastructure that served it, you can reach a victim nobody has looked at yet.

Not necessarily. An ATT&CK mapping is a claim about the account you read, not about the intrusion itself. Two people differ mainly because they apply different rules to steps the author never wrote down.

It tells you nobody has publicly written up a real adversary doing it. ATT&CK indexes published observations, so a missing technique is a fact about the literature, not proof that the behaviour is rare, impossible or harmless.

Revoked means replaced: the object names the technique that superseded it, so an old reference migrates mechanically. Deprecated means withdrawn with no successor, so nothing can be migrated and a person must re-judge the behaviour.

A platform is an applicability tag on techniques inside the single Enterprise matrix: it says the behaviour applies to IaaS, SaaS, identity or container assets. It creates no separate tactic set, no separate technique list and no separate matrix.

Because a tactic names a goal, not a step. An operator re-enters Discovery every time the next decision needs information they do not have, and never reaches Persistence when the objective completes inside one visit and returning is worth nothing to them.

Because they are what make an edge falsifiable. Meta-features date the event, say which way it ran, and record whether it succeeded, so a pivot is a claim someone can disprove rather than a permanent line on a graph.

Leave it unmapped and say so. ATT&CK catalogues adversary behaviour, so much of any account — conditions, motive, business context, the author's speculation — carries no identifier. Forcing the nearest one asserts a behaviour the source never describes.

Probably neither. ATT&CK stores no ordering, so both lists were built from assumptions the teams brought with them: who they expect to face, and what their estate exposes. Compare the assumptions, not the two lists.

A mutex name is just a literal the tool writes, like a service name or install path. Changing one is an edit and a rebuild. Losing the tool costs the capability itself: weeks of development, or money.

Because the catalogue moved underneath the series. Identifiers were revoked, split and re-parented across those releases, and the mappings count labels people wrote, not adversary actions. Normalise every year to one release first.

You produce two mappings in two coordinate systems and join them yourself. ATT&CK has no edge linking a T1### technique to a T0### one, so the ordering, the causal link and the single narrative are yours to write, not the catalogue's.

Remove the Privilege Escalation goal first: make nothing a lower-privileged account can write execute as root. That goal has no substitute. Persistence has many carriers, so blocking timers alone just relocates it.

One technique and three procedures, provided all three still depend on the same mechanism. Classify by what the action cannot do without, not by how it was written; a new sub-technique needs a mechanism that differs in kind, not a different string.

It is evidence about the operator's payoff, not a mapping error. Impact first says the visible effect was the objective itself, so nothing after it was worth doing. It does not prove that no data ever left.