MITRE ATT&CK Technique Sorter

MITRE ATT&CK is a catalog of what attackers actually do, built from observed intrusions rather than from theory, and the first thing to get straight about it is the two-level structure. A tactic is the attacker's goal — the why. A technique is the method used to reach it — the how. Persistence is a tactic; adding a registry Run key is a technique that serves it. The framework is organized tactic-first precisely because the same technique can serve different goals depending on what the attacker is after, so sorting a behavior means asking what it accomplishes, not what tool it names. That is the habit this activity is built to train, and it is why the cards deliberately mention PowerShell, Word macros, cmd.exe, the registry, and %TEMP% — the tool is never the answer. Initial Access is how the attacker first gets in, and the boundary is the perimeter: a spear phishing link that harvests VPN credentials and an exploit against a public-facing web application are both about crossing from outside to inside for the first time. Execution is attacker-controlled code actually running on a victim system — PowerShell decoding a Base64 payload, a Word macro spawning cmd.exe. Note that both of those involve running something, but neither says anything about surviving a reboot, which is the line into Persistence. Persistence is about keeping the foothold: a scheduled task that re-runs the malware every reboot, a registry Run key that relaunches it at login. Ask whether the action would still matter after the machine restarts; if yes, it is Persistence. Privilege Escalation is about gaining rights the attacker did not have — exploiting a SUID binary to get from standard user to root, or impersonating a token to run as SYSTEM. Defense Evasion is about not being seen: disabling Windows Defender before dropping a second stage, or timestomping malware files so their timestamps match legitimate system files. Two of these boundaries are worth dwelling on because they are where careful students lose marks. The first is Privilege Escalation against Defense Evasion. In the real ATT&CK matrix several techniques are listed under both — abusing a SUID binary and manipulating access tokens genuinely appear in each — because one action can serve two goals at once. The cards here are worded to name the outcome that decides it: 'escalate from standard user to root' and 'run a process as SYSTEM' are both stating an elevation of rights, so they sort as Privilege Escalation. When a real report is ambiguous, the stated outcome is what settles it. The second, and the more commonly missed, is Collection against Exfiltration. Collection is gathering the data together while it is still inside the environment — a keylogger writing keystrokes to a local log file, or sensitive files staged in %TEMP% ready to move. Exfiltration is the data actually leaving — uploaded to an attacker-controlled server over HTTPS, or trickled out through encoded DNS queries. Staging files 'before exfiltration' is Collection, not Exfiltration, and the word 'before' is the tell: nothing has crossed the boundary yet. Defenders care about this split because the two are caught by different controls, and Collection is the earlier, cheaper place to catch it. This structure is worth internalizing because ATT&CK is the shared vocabulary of the field. Threat intelligence reports describe adversary groups by the tactics and techniques they favor, detection rules are written and measured against technique coverage, and incident responders map what they have found onto the matrix to work out which goals the attacker has already achieved and which are still ahead. Knowing that a piece of evidence belongs to Collection rather than Exfiltration is not a naming exercise — it tells the responder that the data may still be inside, and that there is still time to stop it leaving.