Behaviour with No Technique

## The scenario, stated precisely An engineer who has resigned but is still employed assumes `role/data-engineer` — the role their job description requires — and issues the cloud object store's bulk read against the customer dataset, pulling tens of thousands of objects. Own identity. Own laptop. A Tuesday afternoon. Every call is inside what the role grants. Nothing in the account was compromised: no exploit, no stolen credential, no privilege escalation, no malware. Someone now asks you which ATT&CK technique this is. ## What a technique object actually holds A technique entry carries an identifier, a name, a description, the tactics it serves, the platforms it applies to, data sources, mitigations and procedure examples drawn from published intrusions. Some entries additionally name the **privilege level required to execute** the technique — administrator, SYSTEM, a particular role. That field is a *prerequisite for the technique to work*; it is not a claim that the actor lacked a legitimate reason to act. Nowhere in the schema is there a field that says *this actor was not supposed to do this*. That is the whole answer, and everything else is a consequence of it. ## Why the nearest mapping fails `T1530` **Data from Cloud Storage** describes reading data out of a cloud object store. Applied to our export it is *true*. Applied to the nightly analytics pipeline that reads the same bucket through the same role it is *equally true*. An identifier that is true of both the incident and the business-as-usual job carries zero discriminating information about which one you are looking at. `T1078.004` **Valid Accounts: Cloud Accounts** is the reflex second guess, and it is a worse fit rather than a better one. It describes an adversary operating through credentials **belonging to someone else** — obtained, phished, or left lying around. Our engineer is the credential's rightful holder. Using that identifier smuggles in a claim about the account being co-opted that is simply false, and anyone who later reads the record will believe an account takeover occurred. ## The axis the model does not have ATT&CK encodes **goals** — the tactic layer is literally a list of adversary objectives — and it encodes **mechanisms**. It does not encode **authorisation**. Two people can pursue an identical goal by an identical mechanism, and only one of them is committing an incident; the difference lives entirely in permission and intent, which the catalogue was never built to represent. This is not an oversight. ATT&CK's inclusion rule rests on published cases of adversary behaviour, and an adversary is assumed by construction to be operating without permission. When the actor holds the permission legitimately, the assumption that made the model coherent no longer holds, and the model has nothing to say. The same hole shows from the other side with fraud. An objective reached entirely through a convincing conversation and an instruction that the finance system happily accepts involves **no technical action at all** — so there is no mechanism for a technique to name, and the catalogue is silent for a second, unrelated reason. ## What actually distinguishes the export, then Not the action. What distinguishes it is context the catalogue has no column for: the person is leaving; the volume is far outside how that role is normally exercised; the data has value to a competitor; the read serves no work assignment. Every one of those is a fact about the person and the organisation, not about the API call. ## And what removes it This matters because a mapping steers a remedy. If the answer is a technique identifier, the next question becomes "which technical control blocks that technique?" — and for a permitted action, none of them can, because the action is indistinguishable from work the role exists to do. The control classes that engage here are authorisation and process ones: scoping the role so bulk read is not part of it, making bulk export a separately granted, time-bound and approved operation, separating the person who requests an export from the person who releases it, and shrinking standing rights at the moment of resignation rather than at the moment of departure. None of those is a countermeasure to a technique. They remove the *permission* the behaviour depends on, which is exactly the dimension the catalogue omits. ## The answer to give Say the action maps and the wrongness does not. Offer the plain description — a rightful holder of a role used it, at scale, for a purpose it was not granted for — and be explicit that supplying a technique identifier would make the record less accurate rather than more, because every identifier available asserts something that is not true of this event.