ATT&CK Tactic Sequence — TechKnowSurge

About this interactive

Seven of the fourteen ATT&CK enterprise tactics are drawn each round, each with what the attacker is doing. Put them in the order the matrix lists them, which follows the usual flow of an attack: research and preparation, getting in, staying in and spreading, then reaching the objective.

What you'll learn

Order the fourteen MITRE ATT&CK enterprise tactics as the matrix lists them, from reconnaissance to impact
Describe the flow an adversary typically follows through a network, while recognizing that a real attack may skip tactics or start partway in

Aligned to

CompTIA CySA+

3.1 Explain concepts related to attack methodology frameworks.

Key terms

MITRE ATT&CK: A globally accessible knowledge base that categorizes adversary tactics and techniques based on real-world observations, used to understand and defend against cyber threats.
Tactic: In the MITRE ATT&CK framework, a high-level objective or goal an adversary seeks to achieve during an attack, such as reconnaissance or privilege escalation.
Reconnaissance: The first phase of an attack in which an adversary gathers information about a target — such as open ports, employee names, and technology stacks — before launching an attack. Reconnaissance can be passive (using public sources) or active (directly probing the target).
Persistence: A MITRE ATT&CK tactic in which an adversary maintains their foothold within a compromised network to survive restarts, credential changes, or other interruptions.
Privilege Escalation: An attack that exploits vulnerabilities to gain higher-level access than originally authorized.
Defense Evasion: A MITRE ATT&CK tactic in which adversaries take actions to avoid being detected by security tools and personnel during an attack.
Lateral Movement: A MITRE ATT&CK tactic in which an adversary pivots from one compromised system to other systems within the same network environment.
Command and Control: Command and Control refers to the infrastructure and communication channels used by attackers to issue instructions to and receive data from compromised systems, enabling persistent access and coordinated attack operations.
Data Exfiltration: The unauthorized transfer of data from a system to an external destination.

Topics

Interactive Ordering

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →