Tactics vs Techniques in MITRE ATT&CK: The Practical Difference
Tactics define the adversary’s strategic intent, while techniques specify the concrete methods used to achieve that goal within the framework.
Tactics are the "why" of an attack, representing high-level objectives like initial access or execution. Techniques are the "how," detailing the specific actions an adversary takes to meet those objectives. Understanding this distinction allows you to map operational threat intelligence to specific defensive controls rather than vague threats.
The Core Distinction
The MITRE ATT&CK framework separates adversary behavior into two distinct layers: tactics and techniques. Tactics represent the adversary’s goal or intent at a specific stage of the engagement. They answer the question of why the attacker is performing a certain action. Techniques describe the specific method or approach used to achieve that tactical goal. They answer how the attacker accomplishes the objective. This separation is not merely academic; it dictates how you structure your detection engineering and response playbooks.
Defining Tactical Objectives
Tactics are the high-level reasons behind adversary actions. They remain relatively constant because human objectives in cybersecurity do not change rapidly. An attacker will always need to gain initial access, escalate privileges, or exfiltrate data. These goals are universal across different threat actors and campaigns. When you analyze operational threat intelligence, you identify which tactics an actor prioritizes. This helps you predict the next phase of an attack before the specific tools are revealed. Focusing solely on tools leaves you blind to shifts in strategic intent.
Defining Technical Methods
Techniques are the concrete implementations of tactical goals. They are more granular and prone to change as new software, exploits, and evasion methods emerge. A single tactic, such as "Credential Access," can be achieved through dozens of different techniques, including phishing, keylogging, or dumping credential stores. Each technique may have sub-techniques that further refine the specific method. For instance, "Phishing" is a technique, but "Spearphishing Attachment" is a sub-technique. You must map your security controls to these specific techniques to generate useful alerts.
Comparative Analysis
The following table contrasts the structural and functional differences between these two framework components. Understanding this matrix is vital for accurate threat modeling and effective log management.
| Aspect | Tactics | Techniques |
|---|---|---|
| Primary Question | Why is the attacker doing this? | How is the attacker doing this? |
| Stability | Highly stable over time | Evolves with new tools and exploits |
| Granularity | High-level objectives | Specific methods and actions |
| Detection Focus | Rarely detected directly | Primary target for detection rules |
| Response Action | Block the objective chain | Mitigate the specific method |
| Example | Lateral Movement | Pass the Hash |
| Dependency | Independent of tools | Dependent on available exploits |
Choosing the Right Lens
You should focus on tactics when designing your overall security architecture and incident response plans. This high-level view helps you identify gaps in your defense-in-depth strategy. If you lack controls for the "Exfiltration" tactic, you have a structural weakness regardless of the tools used. Conversely, you must choose techniques when writing detection rules and tuning alerts. Your sensors cannot see "intent"; they see network packets, process creations, and file modifications. These are technical artifacts of specific techniques.
See also: Initial Access Broker Response: Containment and Recovery Steps · How SOC Playbooks Work: Mechanism, Limits, and Execution
Choose Tactics When
- Designing enterprise-wide risk assessments.
- Prioritizing security investments based on likely adversary goals.
- Communicating risk to leadership who do not need technical details.
- Analyzing the strategic posture of specific threat actors.
Choose Techniques When
- Writing Sigma rules or YARA signatures.
- Tuning alerts to reduce noise in your log management pipeline.
- Responding to an active incident to identify the specific entry point.
- Evaluating the effectiveness of endpoint detection and response tools.
Areas of Overlap and Confusion
The boundary between tactics and techniques can blur in complex attack chains. Some actions serve multiple tactical purposes simultaneously. For example, "Process Injection" is a technique used to achieve both "Defense Evasion" and "Execution." This duality means a single detection event may trigger responses for multiple tactical phases. You must understand these overlaps to avoid alert fatigue. If you treat every technique as a unique incident, you will drown in noise. Instead, group detections by the tactical phase they disrupt.
Practical Application in Defense
Using this distinction improves your ability to conduct OSINT investigations and analyze threat intelligence feeds. When a new exploit is announced, identify the technique it enables. Then, determine which tactic that technique supports. If the technique supports "Initial Access," you can assess your perimeter defenses. If it supports "Privilege Escalation," you review your local security policies. This method prevents you from reacting to hype and focuses your efforts on actual risk reduction. It also helps in understanding PowerShell abuse, which is a technique often used for multiple tactical goals.
Limitations of the Framework
The framework does not cover every possible attack vector. It is a model of behavior, not a catalog of all threats. You must complement it with other sources of intelligence. Additionally, the framework describes adversary behavior, not defender actions. You must translate these adversary techniques into defensive controls. This translation requires deep knowledge of your own environment and the specific software you deploy. Without this context, the framework remains an abstract list rather than a practical tool.
Key takeaways
- Tactics are stable goals; techniques evolve as new tools emerge.
- You detect techniques, but you prevent tactics by breaking the chain of objectives.
- Misclassifying a technique as a tactic leads to ineffective log management strategies.
Tactics define the adversary's strategic goals, while techniques are the specific methods used to achieve them. Map your detection rules to techniques to catch specific behaviors, but design your overall security posture to block tactical objectives.
Frequently asked questions
Can one technique support multiple tactics?
Yes, many techniques are multi-purpose. For example, process injection can be used for both defense evasion and execution, depending on the adversary's immediate goal.
How does this affect my SIEM configuration?
You should configure your SIEM to parse logs for technical artifacts associated with specific techniques. This allows you to detect the "how" rather than guessing the "why" from vague alerts.
Should I track tactics or techniques in my threat intelligence program?
You should track both. Tactics help you understand the adversary's strategic intent and long-term goals, while techniques provide the specific indicators you need to detect current campaigns.
Is the MITRE ATT&CK framework complete?
No, it is a model that is continuously updated. It covers common adversary behaviors but may not include every niche exploit or custom tool developed by specific threat actors.
How this guide was produced: written by the DarkWeb Headlines editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.
