ATT&CK Matrix
MITRE ATT&CK maps adversary TTPs — literacy on the matrix for planning emulation on $LAB_RT, not weaponizing strangers.
Visual · rt_attack_matrix
ATT&CK matrix literacy. $LAB_RT only. Original Cyberlium.
ATT&CK is a common language for red and blue — not a shopping list for unauthorized attacks.
The MITRE ATT&CK framework organizes adversary tactics (why) and techniques (how) into a matrix spanning enterprise, cloud, and mobile platforms. Red teams select techniques to emulate within RoE; blue teams map detections and gaps to the same IDs. Cyberlium teaches ATT&CK literacy so you plan campaigns on $LAB_RT with defender value. You will NOT treat ATT&CK as justification to phish strangers or deploy ransomware because a technique exists. Next: Tactics/Techniques.
1. Matrix structure: tactics across columns
Tactics run left to right — Reconnaissance through Impact — describing adversary goals. Each column holds techniques and sub-techniques with IDs like T1566. The matrix helps teams speak the same language during emulation and detection mapping.
Your $LAB_RT campaign notes should reference tactic columns you plan to touch — always filtered by RoE, never as permission to hit out-of-scope hosts.
Command guide
Try these commands — Matrix structure: tactics across columns
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: curl, jq. Reference sites: ATT&CK Enterprise Matrix (https://attack.mitre.org/matrices/enterprise/); MITRE ATT&CK (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Platforms and data sources
ATT&CK splits by platform: Windows, Linux, macOS, Cloud, Network. Data sources name telemetry defenders need — process creation, file monitoring, network traffic. Literacy means knowing where your lab generates evidence blue can hunt.
Professional teams align $LAB_RT logging to ATT&CK data sources before emulation — so purple debriefs cite technique ID and detection outcome together.
3. ATT&CK literacy is not attack authorization
Knowing T1059 exists does not authorize running scripts on production or classmates. Technique IDs describe behavior; RoE on $LAB_RT authorizes emulation in lab only.
Ship: three tactic columns you will study on $LAB_RT this module. Next: Tactics/Techniques.
4. What you ship: ATT&CK matrix orientation for $LAB_RT
Name matrix purpose, three tactic columns, platform note. $LAB_RT campaign context. NEVER stranger targets. chmod 600.
5. What you record before the next lesson
Date. ATT&CK matrix note. Three tactics. $LAB_RT named. File t21-m02-l01-attack-matrix.txt chmod 600.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Pick every Impact technique for a classmate VM. Treat ATT&CK as license to run ransomware anywhere.
- Right: Write ATT&CK matrix orientation tied to $LAB_RT. Next: Tactics/Techniques.
Mission: orient to ATT&CK for YOUR lab
1) Define tactics vs techniques in one sentence each. 2) List three tactic columns for $LAB_RT study. 3) chmod 600. Never cite ATT&CK to justify unauthorized testing.
Stuck? Ask Cyberlium AI Mentor
ATT&CK connects red emulation to blue detection — use it in debriefs.
APPLY: MITRE ATT&CK on Cyberlium supports:
APPLY: True or False: A technique ID authorizes emulation without RoE.
APPLY: ATT&CK data sources help purple teams by: