Apply attack frameworks to observed adversary behavior

An attack framework gives analysts a shared vocabulary for observed behavior. ATT&CK tactics describe an adversary goal, while techniques describe how that goal may be achieved. Map only what the evidence supports: a process that creates a scheduled task can support a persistence-technique mapping without proving who operated it or why.

A useful mapping preserves the underlying records, names the data source, and states confidence and alternatives. The framework label should help defenders find related evidence and controls; it must not replace the event sequence. Several techniques can fit one command, so prefer the narrowest mapping justified by context and identify what additional evidence would distinguish alternatives.

Frameworks organize observations at different levels. A lifecycle model can show progression across stages, and ATT&CK can describe techniques within those stages. Missing telemetry can make a sequence appear to skip a stage, so analysts should mark unknowns instead of inventing events to complete a diagram.

Behavior overlap is expected: administrators and adversaries may both use remote services, scripting, and archives. Distinguish them with account authorization, host role, change records, destinations, timing, and follow-on effects. A framework mapping raises useful investigative questions but does not by itself prove maliciousness or attribution.

The Cyber Kill Chain stages are reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Map only stages supported by retained evidence: target research may support reconnaissance, payload construction weaponization, receipt delivery, triggered code exploitation, persistence installation, a tasking channel command and control, and the intended theft or disruption actions on objectives. Evidence may begin late or skip a phase, so mark missing stages unknown. The Diamond Model links adversary, capability, infrastructure, and victim vertices; a confirmed vertex can guide collection about the others while uncertainty remains visible.

ATT&CK organizes adversary goals and behaviors. Tactics are not a mandatory order, techniques are not actor identities, and one event can support multiple mappings. Choose the framework that answers the current question, retain the underlying observations, and mark gaps rather than inventing a complete story.

ATT&CK Enterprise version 19 lists 15 tactics, each naming the adversary's goal for a step: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact. Earlier versions listed 14, with a single Defense Evasion tactic where Stealth and Defense Impairment now appear, so older reports and tools still use that name. Techniques such as T1059 Command and Scripting Interpreter, and sub-techniques such as T1059.001 PowerShell, describe how a goal is pursued; a procedure is the specific implementation observed.