TechKnowSurge

VideoSecurityFree

Cyber Attack Tactics

The MITRE ATT&CK framework defines 14 adversary tactics—from reconnaissance through impact—that map the progression of a network attack, and it can be used alongside the Cyber Kill Chain to build a comprehensive picture of threat behavior.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

The MITRE ATT&CK framework is a widely recognized model that categorizes adversary behavior into 14 distinct tactics, spanning from initial reconnaissance all the way through to final objectives such as data exfiltration or environmental disruption. Each tactic represents a general goal an attacker pursues at a given stage of an intrusion, and together they form a logical progression that describes how a threat actor moves through a target environment. Because the framework is available publicly through the MITRE ATT&CK website, security professionals can reference it directly to understand what each tactic entails and how it fits within the broader attack lifecycle. The tactics begin with reconnaissance, where an adversary gathers intelligence about a target, followed by resource development, where they acquire the tools and capabilities needed to execute an attack. From there, the adversary seeks initial access into the network and then works through execution, persistence, privilege escalation, and defense evasion to establish a stable and concealed presence. Subsequent tactics—credential access, discovery, lateral movement, and collection—describe how an attacker expands their reach and gathers information from within the environment before using command and control channels to manage compromised systems and ultimately act on their objectives. The Cyber Kill Chain is a comparable framework that covers similar ground with a more streamlined set of phases. The two models share conceptual overlap—reconnaissance, weaponization, delivery, and exploitation in the Kill Chain align closely with reconnaissance, resource development, initial access, and execution in MITRE ATT&CK, among other parallels. Using both frameworks together provides a fuller analytical picture: the Cyber Kill Chain offers a concise view of attacker progression and integrates well with models like the Diamond Model of Intrusion Analysis, while MITRE ATT&CK delivers the depth and granularity needed to account for the full range of tactics a threat actor might employ against an enterprise network.

What you'll learn

Identify the 14 tactics of the MITRE ATT&CK framework and describe the sequential flow an adversary follows when compromising a network
Distinguish between the MITRE ATT&CK framework and the Cyber Kill Chain model by comparing their corresponding phases and use cases

What's covered

MITRE ATT&CK & Cyber Kill Chain

MITRE ATT&CK Framework
- 14 Tactics Overview
  - Reconnaissance to Exfiltration
  - Not strictly sequential
- Early Stage Tactics
  - Reconnaissance
  - Resource Development
  - Initial Access & Execution
- Mid Stage Tactics
  - Persistence & Privilege Escalation
  - Defense Evasion
  - Credential Access & Discovery
- Late Stage Tactics
  - Lateral Movement & Collection
  - Command and Control
  - Exfiltration & Impact
Cyber Kill Chain
- Streamlined Attack Flow
- Similar Phases to MITRE
  - Weaponization vs Resource Dev
  - Delivery vs Initial Access
- Used for Diamond Model
Using Both Frameworks
- Kill Chain for Adversary Steps
- MITRE for Comprehensive View
- Insider Threat Consideration

Key terms

MITRE ATT&CK: A globally accessible knowledge base that categorizes adversary tactics and techniques based on real-world observations, used to understand and defend against cyber threats.
Tactic: In the MITRE ATT&CK framework, a high-level objective or goal an adversary seeks to achieve during an attack, such as reconnaissance or privilege escalation.
Reconnaissance: The first phase of an attack in which an adversary gathers information about a target — such as open ports, employee names, and technology stacks — before launching an attack. Reconnaissance can be passive (using public sources) or active (directly probing the target).
Privilege Escalation: An attack that exploits vulnerabilities to gain higher-level access than originally authorized.
Defense Evasion: A MITRE ATT&CK tactic in which adversaries take actions to avoid being detected by security tools and personnel during an attack.
Lateral Movement: A MITRE ATT&CK tactic in which an adversary pivots from one compromised system to other systems within the same network environment.
Command and Control: Command and Control refers to the infrastructure and communication channels used by attackers to issue instructions to and receive data from compromised systems, enabling persistent access and coordinated attack operations.
Data Exfiltration: The unauthorized transfer of data from a system to an external destination.
Cyber Kill Chain: The Cyber Kill Chain is a Lockheed Martin threat model describing the seven stages of a targeted cyberattack — reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives — used to structure defensive strategies.
Persistence: A MITRE ATT&CK tactic in which an adversary maintains their foothold within a compromised network to survive restarts, credential changes, or other interruptions.

Topics

Mitre Attck Cyber Kill Chain Threat Intelligence Adversary Tactics Cybersecurity Network Security

Transcript

We're going to take a deeper dive into tactics, looking at the different tactics that an adversary will use to get into a network and leverage things within the network.

MITRE ATT&CK outlines 14 different tactics, from reconnaissance to resource development to initial access, execution, and so on and so forth. These tactics are designed to be a flow. That is, a lot of adversaries will start at the beginning here, reconnaissance, and then work their way through these different tactics. Not that they have to necessarily hit each one of these tactics — in fact, they might not even start at reconnaissance. For instance, maybe they're already an insider threat: they're already within the business, within the organization. Well, they have already gained initial access, so they just need to start at the next step. So the MITRE ATT&CK framework allows us to see the flow of what an adversary will do as they are attacking a network, as they are taking advantage of an organization.

I'm here on the MITRE ATT&CK website, and if I go to tactics and say enterprise tactics, I can see all of these listed out. These give us an idea, once again, of what that flow looks like, and a description of each one of those tactics.

The flow of tactics

Most adversaries are going to start by reconnaissance, which is gathering information about their target. Then they go into resource development. This is where they're going to start collecting the tools and skills and everything they need to carry out their attack. Once they've got that, they're going to try to gain access into the network. This is initial access; this is just getting into the network. Once they're in the network, they might go through the execution phase, where they're going to run some sort of malicious code. And part of this is that they want to gain persistence within the network. That is, they don't want to be booted out of the network as soon as they're in the network, so they're going to try to maintain some sort of foothold in here.

Then they get into privilege escalation. When they get into the network, they might not have the necessary privileges to carry out their attack, so they're going to try to get a higher level of permission. Then they're going to get into defense evasion. They don't want to be detected, so they're going to do some things to avoid being detected. Then they're going to get some credentials in the system. They're going to look for credentials, look for access, so maybe steal some sort of account usernames and passwords.

Then they'll go through a discovery phase. In the discovery phase, they're going to discover things within the network. This is similar to the reconnaissance phase, but now they're inside of the network. Then they're going to perform lateral movement. When they're in the network, they're going to pivot from one area of the network to another, so they're going to move throughout the environment. Then they're going to start collecting more data and gathering more data of their interest. Where are they trying to attack? How are they going to meet their goals?

Then they do what's called command and control. Command and control is the idea that they want to control aspects of the environment, so they're going to communicate within the environment and control different aspects of the environment. Then it comes time for action on objectives. Maybe they're doing some sort of data exfiltration — this is stealing data — or maybe they're trying to make some sort of impact to the environment: manipulating or interrupting the environment, destroying something within the environment, maybe causing some sort of chaos within the environment.

Another model: the cyber kill chain

So MITRE ATT&CK is a flow of information, but it's not the only model or framework that we have to work with out there. We also have the cyber kill chain, which has a similar type of flow with similar types of tactics in it. In fact, I've got them all lined up here. You can see that in both models there's a reconnaissance phase. In one model they call it weaponization, in the other resource development. In one there's delivery and exploitation, in the other one there's initial access and execution. So there's a lot of similarities between these two models.

Which one should you use?

We're going to use both throughout this course. What I'm actually going to do is, if I'm talking more about the steps that an adversary is going to take, I'm going to use the cyber kill chain. It's a little more streamlined in how it operates, and it is used for things like the diamond intrusion analysis model. So we're going to be using that cyber kill chain for much of this course.

But I also want to make sure we approach this from a very comprehensive angle, where we're going to take an in-depth look into how an attacker, how an adversary, attacks a network. So we're going to be using MITRE ATT&CK in many cases to really see the overall picture, all of the things that could happen on your network. So the answer to this is we'll be using both the cyber kill chain and MITRE ATT&CK throughout this course.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →