Threat actor tactic
A threat actor tactic is a high-level objective or course of action pursued to achieve a cybersecurity goal.
Azure Security
A high-level behavior or approach a bad actor uses to achieve a goal.
- How it is used
- Uses observed bad-actor behavior to anticipate compromise and guide defensive preparation.
- How deep it goes
- Defines tactics within the tactics-techniques-procedures hierarchy and illustrates the levels, without detailing specific cyber procedures.
- Examples
- Uses a weight-loss goal, healthier lifestyle, exercise and eating techniques, progress tracking, and exercise-machine procedures as an analogy.
- What you can do after
- Evaluate bad-actor behavior to recognize threat complexity and anticipate likely compromise approaches.
Cyber Threat Hunting
A tactic in the ATT&CK framework is an adversary's tactical goal or reason for performing an action.
- How it is used
- Guides security monitoring rules and threat-hunting hypotheses by organizing adversary behavior around tactical goals.
- How deep it goes
- Defines the why-versus-how hierarchy and relates tactics to techniques, subtechniques, and procedures without detailing tactic internals.
- Examples
- Uses execution, credential access, exfiltration, T1059 subtechniques, and an APT41 certutil download procedure.
- What you can do after
- Evaluate adversary actions by mapping their tactical goals to ATT&CK techniques and hunting hypotheses.
Read how Cyber Threat Hunting explains threat actor tactic →
Related concepts
- MITRE ATT&CKpart of · MITRE ATT&CK is a publicly maintained knowledge base and framework cataloging adversary tactics, techniques, and procedures based on observed cyberattacks.
- techniquecontrasts with · A technique is a deliberate, systematic, and repeatable method for performing a task, solving a problem, or achieving a desired result.
- threat actorused by · A threat actor is a person, group, process, or other entity that intentionally attempts to compromise, misuse, disrupt, or defeat the security of a system or information.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.