thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

ATT&CK Technique

An entry in MITRE ATT&CK describing how an adversary achieves a tactical goal, identified by a T number.

Definition

Techniques such as T1566 Phishing or T1003 OS Credential Dumping include descriptions, procedure examples from real groups, detection data sources and mitigations. Sub-techniques add a decimal, for example T1566.001 Spearphishing Attachment. A technique can belong to multiple tactics.

Example

T1053 Scheduled Task/Job is mapped to Execution, Persistence and Privilege Escalation.

Exam tip

Sub-technique IDs use a dot suffix, e.g. T1059.001.

Related terms