Study guide
6.2 Navigating MITRE ATT&CK: Tactics, Techniques, Sub-techniques
TryHackMe Security Analyst Level 1 SAL1
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current SAL1 Exam Facts 1.2 24-Hour Window, Check-In, and Delivery 1.3 Scoring, Retakes, Validity, and Access 1.4 MCQ Section Strategy
2 SOC Simulator Exam Skills
2.1 Analyst VM, Splunk, and Dynamic Alerts 2.2 Classification and Escalation Scoring 2.3 Case Reports and Investigation Notes
3 Network Essentials
3.1 OSI, TCP/IP, Devices, and the Three-Way Handshake 3.2 HTTP, TLS, VPN, Web Browsing, and Email Transmission
4 Operating System Basics
4.1 Windows and Linux Architecture, Auth, Filesystems, Processes 4.2 Active Directory and Event Logs for Tracing Activity
5 Cryptography, Cloud, Web and Scripting Basics
5.1 Encoding, Encryption, Hashing, and Decoding Tools 5.2 VMs vs Hosts, Cloud vs Virtual Hosting, SaaS and IaaS 5.3 Web Apps, APIs, JSON/XML, Scripts vs Compiled Programs
6 Cybersecurity Fundamentals and MITRE ATT&CK
6.1 CIA, Least Privilege, Human Factors, Log4Shell, EternalBlue 6.2 Navigating MITRE ATT&CK: Tactics, Techniques, Sub-techniques 6.3 Mapping Real Attacks onto ATT&CK Techniques
7 Kill Chain, NIST CSF, and Attack Indicators
7.1 Cyber Kill Chain Stages vs MITRE ATT&CK 7.2 NIST CSF: Identify, Protect, Detect, Respond, Recover 7.3 IoC vs IoA and the Pyramid of Pain
8 Social Engineering and Network Attacks
8.1 Phishing: Impersonation, Typosquatting, Spoofing, Header Analysis 8.2 SPF, DKIM, DMARC, and Email Authentication Results 8.3 Port Scanning, DDoS, and Man-in-the-Middle 8.4 DNS Poisoning, ARP Spoofing, Exfiltration, and C2 Traffic Patterns
9 Web Exploitation and Endpoint Attacks
9.1 Client vs Server Vulnerabilities, XSS, and SQL Injection 9.2 Code Injection, Path Traversal, Input Validation, Patching, WAF 9.3 Initial Access (RDP/SSH), Persistence, Privilege Escalation 9.4 Credential Theft, Mimikatz, Sysmon, and Auditd
10 Command and Control, Malware, and LOLBAS
10.1 Forward vs Reverse Shells, Beaconing, Metasploit, Cobalt Strike 10.2 Malware Types, Static vs Dynamic Analysis, LOLBAS
11 EDR, Firewalls, and WAF
11.1 EDR vs AV, Telemetry, Containment, Remote Shell 11.2 Firewall Deployments, Limits, and Log Analysis 11.3 WAF Capabilities, Limits, and Rule Creation
12 SIEM and SOAR
12.1 SIEM Deployments, Parsing, and Raw Logs to Alerts 12.2 Alert Management, Threat Hunting, Triage, Reporting 12.3 SOAR Playbooks, Enrichment, and TI Integration
13 Threat Intelligence and Vulnerability Scanning
13.1 Feeds, Indicators, Classifying IPs, Domains, and Hashes 13.2 YARA and TI Integration with SIEM/SOAR 13.3 External vs Internal, Web vs Network Scanning
14 SOC Team, Activities, and Alert Triage
14.1 Blue/Red Teams, Hierarchy, and SOC Roles 14.2 Proactive vs Reactive: FP Remediation, Detection Engineering, Tabletop, DFIR, Threat Hunting 14.3 Workbooks; Ticket vs Alert vs Detection Rule 14.4 Triage Workflow, Severity, Status, and Verdicts
15 SOC Metrics, Escalation, and Communication
15.1 MTTA, MTTD, MTTR, SLA, and Lookups 15.2 Escalation Matrix, Urgent Remediation, and Cross-Team Communication
6.2 Navigating MITRE ATT&CK: Tactics, Techniques, Sub-techniques
Key Takeaways Explain This Topic AI
MITRE ATT&CK is a knowledge base of adversary tactics, techniques, and procedures (TTPs), not a product you install and not a single linear path.
Tactics are matrix columns (adversary goals); techniques and sub-techniques (for example T1059.001) describe methods used to achieve those goals.
The Enterprise matrix is a lookup table for triage: search from evidence, read data sources, and record IDs—do not memorize every cell.
The same binary can support more than one tactic; the tactic follows the goal of that step, which you infer from context.
Last updated: September 2026
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a publicly maintained knowledge base of adversary tactics, techniques, and procedures (TTPs) . It is not a product you install, not a scoring engine, and not a promise that every intrusion follows a single path. SAL1 training content introduces ATT&CK so that an entry-level analyst can navigate it: name the adversary's goal, name the behavior, and map a real incident onto technique IDs. This independent study section teaches that navigation. It does not ask you to memorize every cell of the matrix.
What ATT&CK is—and what it is not
Think of ATT&CK as a shared language. When one SOC writes "the attacker dumped LSASS" and another writes "credential dumping from memory," they can both point at T1003 . When a detection engineer asks whether PowerShell is covered, they can look up T1059.001 and read listed data sources instead of arguing from folklore.
ATT&CK is organized as a matrix :
Tactics are the columns. A tactic is an adversary goal at a stage of the intrusion: get in, run code, stay, steal credentials, leave with data, and so on. Tactic IDs look like TA0002 (Execution).
Techniques are the cells under a tactic. A technique is a reasonably technology-agnostic method for achieving that goal, with an ID like T1059 (Command and Scripting Interpreter).
Sub-techniques split a technique into specific flavors, with IDs like T1059.001 (PowerShell), T1059.003 (Windows Command Shell), or T1059.004 (Unix Shell).
Procedures are the concrete implementations: this malware family, this command line, this script. Procedures live in examples and threat reports more than in a single extra ID column.
ATT&CK is not a timeline you must walk left to right. An intrusion can skip columns, repeat a column, or use several techniques under one tactic in the same hour. That flexibility is a feature. It is also why ATT&CK and the Cyber Kill Chain are not the same model—the next chapter compares them. For navigation, remember: columns are goals, cells are methods.
Enterprise matrix versus lookup skill
The matrix people mean in a SOC is usually Enterprise ATT&CK (Windows, Linux, macOS, cloud, containers, and network-centric behaviors). MITRE also publishes Mobile and ICS matrices. Do not mix them blindly: a mobile-only technique ID will confuse a Windows case.
The Enterprise matrix is large on purpose. New techniques appear as tradecraft evolves. Trying to memorize every cell is a failing study strategy. What SAL1-style questions and SOC work actually require:
Know the difference among tactic, technique, and sub-technique.
Recognize a handful of high-frequency tactics by name.
Given a behavior ("phishing email," "scheduled task," "LSASS dump"), know that you can search ATT&CK and land on a stable ID.
Read a technique page for data sources , detections, and mitigations during triage—not from memory at 3 a.m.
If you can open a technique page and extract which logs would show the behavior, you are using ATT&CK the way an analyst uses it. Lookup is the skill. Trivia is not.
How a SOC analyst uses ATT&CK during triage
A practical loop you can run on almost any ticket:
Read the alert as a behavior, not as a vendor name. "EDR detected X" is not a mapping. "A scheduled task was created that launches PowerShell from a temp path" is.
Ask the tactic question first. What was the adversary trying to achieve in this step? Run code? Stay after reboot? Steal credentials? Talk to a server on the internet?
Pick a technique only when evidence supports it. Process creation plus an encoded PowerShell blob can support T1059. A single unsigned binary in Downloads does not, by itself, tell you the tactic.
Drop to a sub-technique when you know the flavor. PowerShell versus cmd versus Bash changes which logs you pull (script-block logging versus Sysmon versus auditd).
Use the technique page as a checklist of telemetry. If MITRE lists Windows event logs and process monitoring, and you have neither, say so in the ticket. That is a detection-coverage finding, not a personal failure.
Write IDs in the case. T1566 in the summary helps the next analyst, the detection engineer, and anyone correlating incidents next month.
ATT&CK does not replace evidence. It labels evidence. If you cannot yet name a technique, leave the field as still investigating and keep collecting logs.
High-frequency tactics you will actually type
Reconnaissance and Resource Development exist in Enterprise ATT&CK and matter to threat intel, but many SOC queues are dominated by the tactics below. Learn their goals and one example technique each. You can look up the rest.
Tactic (column / goal) What the adversary is trying to do Example technique (look up the page; do not memorize every field)
- Initial Access Gain a foothold from outside T1566 Phishing
- Execution Run malicious or abused code T1059 Command and Scripting Interpreter
- Persistence Survive reboot or credential rotation T1053 Scheduled Task/Job
- Privilege Escalation Obtain higher rights T1068 Exploitation for Privilege Escalation
- Defense Evasion Stay out of alerts and logs T1070 Indicator Removal
- Discovery Learn users, hosts, shares, and trusts T1083 File and Directory Discovery
- Credential Access Steal passwords, hashes, or tokens T1003 OS Credential Dumping
- Lateral Movement Jump to another system T1021 Remote Services
- Command and Control (C2) Communicate with attacker infrastructure T1071 Application Layer Protocol
- Exfiltration Move stolen data out T1041 Exfiltration Over C2 Channel
- Impact Disrupt, destroy, or deface T1486 Data Encrypted for Impact
Notice the pattern: the left column is a goal, the right column is one method. Phishing is not the only Initial Access technique (valid accounts and exploit public-facing application also exist). Scheduled tasks are not the only persistence technique. Your exam and your tickets reward choosing a defensible cell, not inventing a unique nickname.
Reading an ID on sight
TA prefix: tactic ( TA0003 Persistence).
T plus four digits: technique ( T1059 ).
T plus four digits plus a dot and three digits: sub-technique ( T1059.001 ).
If you see T1059.001 , you should be able to say out loud: this is a sub-technique of Command and Scripting Interpreter, specifically PowerShell, under the Execution tactic—though PowerShell can also support other tactics depending on why it ran. That last clause matters. The same binary can map to Execution (run the payload), Defense Evasion (obfuscated encoded command), or Credential Access (invoking a dumper). The tactic follows the goal of that step, which you infer from context, not from the filename alone.
Navigation habits that prevent wasted time
Search by behavior ("LSASS memory") rather than by malware family first.
Filter by platform (Windows versus Linux versus cloud) so you do not apply a macOS technique to a domain controller.
Read mitigations as recommendations for the case's suggested actions, not as orders you can implement from the SOC chair without change control.
Treat procedure examples as illustrations. The presence of a named malware family on the page does not mean your alert is that family.
When two columns could fit, ask which goal this step served. Creating a scheduled task to survive reboot is Persistence even if the task later performs Execution when it fires.
If you remember only one operational sentence from this section, remember this: tactics are goals, techniques are methods, sub-techniques are specific methods, and the matrix is a lookup table you use during triage—not a script you memorize.