Cyber Sergeants. Org

Compact, actionable guide tying the MITRE ATT&CK tactics to the classic Cyber Kill Chain, plus concrete defenses for businesses and everyday users. Use this as a cheat sheet to understand how attacks progress and where to harden systems. Quick MITRE tactics refresher (IDs & one-line) TA0043 — Reconnaissance — attacker research & mapping. TA0042 — Resource Development — build/hire infrastructure, accounts, tools. TA0001 — Initial Access — get inside (phishing, exposed services

Before striking, attackers prepare. Under TA0042 – Resource Development, adversaries build, buy, or steal the tools and infrastructure needed for later stages — like domains, servers, and credentials. Think of it as their “setup phase” before execution. ⚙️ Types (Sub-Techniques) Acquire Infrastructure (T1583)Attackers buy or rent domains, servers, or VPS to host phishing pages or C2.Example: Registering fake domains like “micr0soft-secure[.]com”. Compromise Infrastructure (T1

Reconnaissance is the research phase attackers use to learn everything they can about a target before they strike. It’s low-risk for the attacker but high-value: the more they know (people, tech stack, suppliers, exposures), the better their chances of a successful compromise. Think of it as the map-making stage of an attack — and good maps make for efficient, targeted operations. 🧭 What does Reconnaissance look like? Reconnaissance includes any activity that helps an advers

Impact is the phase where adversaries intentionally disrupt, degrade, or destroy systems and data to achieve their objectives — whether that’s financial gain (ransom), sabotage, or a show of force. Unlike earlier stages that focus on access and stealth, Impact is loud, visible, and often costly. You might be wondering why the jump from TA0011 to TA0040, it's because the MITRE has recently added new Tactics TA0040, TA0042 & TA0043. TA0040 is the post-attack phase, while TA004

Once attackers infiltrate a network, they need a way to control compromised systems remotely — this is where Command and Control (C2) comes in. Through this channel, adversaries send commands, exfiltrate data, and pivot to other systems — all while staying under the radar. ⚙️ Types of Command & Control Techniques Application Layer Protocol (T1071) Attackers use common web protocols like HTTP, HTTPS, or DNS to disguise C2 traffic as normal web communication. 💡 Example: Using

When attackers reach the Exfiltration stage in the MITRE ATT&CK framework, they’ve already won half the battle. 😈This is the phase where valuable data is packaged, encrypted, and whisked away — silently slipping past your defenses. Think of it as the digital getaway after the cyber heist. 🚨 🔍 What Is Exfiltration? Exfiltration (Tactic ID: TA0010) refers to unauthorized transfer of data from a compromised network to an external destination controlled by attackers. Attackers

In the Cyber World, attackers not just go after the money, they collect whatever data they can. Once inside a network, their mission shifts from intrusion to information harvesting — capturing sensitive data, files, credentials, screenshots, or even keystrokes that could unlock more secrets. The Collection (TA0009) tactic in the MITRE ATT&CK framework covers all the techniques adversaries use to gather data before exfiltrating it out of the environment. 🔍 Common Techniques U

Lateral Movement is the stage where an attacker, already inside a network, starts to move deeper across systems — quietly expanding their reach to access critical data or higher privileges. This tactic (TA0008) is part of the MITRE ATT&CK framework and represents an intruder’s stealthy path from one compromised machine to another — all without raising alarms 🚨. ⚙️ Types / Techniques under TA0008 Below are the common techniques adversaries use to laterally move across network

“Know your target — before striking.” Once attackers enter a network, their next mission isn’t immediate destruction — it’s information gathering. This phase, called Discovery, is where adversaries map the environment, users, systems, and defenses to plan their next moves like privilege escalation, lateral movement, or data theft. 💡 What Happens in Discovery Attackers use legitimate tools like PowerShell, CMD, Bash, cloud consoles, or scripts to explore the environment — bl

When an attacker gets your credentials, it’s game over. The MITRE ATT&CK Tactic TA0006 – Credential Access focuses on how adversaries capture usernames, passwords, and tokens to move deeper into systems and networks. This is the phase where they turn a single compromise into complete control. 🧠💀 🧩 What Is Credential Access? Credential Access covers all methods used by attackers to steal or manipulate login data.Instead of breaking through firewalls, they simply log in li

Cyber attackers, they no longer sneak into your systems — they live within them, unseen and unnoticed. The MITRE ATT&CK tactic TA0005: Defense Evasion focuses on how adversaries dodge security tools, act legitimate, delete traces, and disguise their activities to stay undetected. ⚙️ Common Evasion Tricks 🧰 Living Off the Land (LOTL): Using built-in tools like PowerShell, certutil, or mshta instead of malware to blend in. 🎭 Masquerading & DLL Side-Loading: Renaming files or

Privilege Escalation (TA0004) covers techniques adversaries use to gain higher-level permissions on a system or network so they can access protected resources, change configurations, or perform actions normally reserved for administrators. In practice it’s what attackers do when they’ve landed with low privileges but need more power to reach their goals. 🎯 High-level objective Gain elevated permissions (local or domain) so the adversary can move laterally, access sensitive d

Persistence (TA0003) is the set of techniques adversaries use to keep access to systems across reboots, password changes, or other interruptions that might otherwise kick them out. In short: persistence is how attackers make sure they can come back later — even if you clean up the initial foothold. Why it matters: if an adversary successfully implements persistence, they can return after patching, rebooting, or credential rotation — giving time to escalate privileges, move l

In the MITRE ATT&CK framework, Execution (TA0002) represents one of the core tactics adversaries use after gaining initial access — it’s the phase where they run malicious code on the target system. Simply put: 🎯 Execution = How attackers make their code run on your machine. Once executed, attackers can install backdoors, steal data, move laterally, or maintain persistence. This makes Execution one of the most critical stages in any attack chain. 🧠 Objective of the Executio

Initial Access (TA0001) is the very first step attackers take — gaining a foothold inside your environment so they can run the rest of their playbook. Below I list the common Initial Access techniques from the MITRE ATT&CK framework, explain each briefly, and give concrete prevention, detection, and response recommendations you can apply today. What counts as “Initial Access”? Initial Access = any technique an adversary uses to get into your network or systems in the first pl

In the ever-evolving world of cybersecurity, defenders need more than just tools — they need a structured way to think like attackers. That’s where the MITRE ATT&CK Framework comes in. 🔍 What Is the MITRE ATT&CK Framework? MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally recognized knowledge base of real-world cyberattacks. It maps out the steps adversaries take — from the moment they gain access to a system to when they achieve their goals