Tactics and Techniques
Tactics are goals; techniques are methods — map both for $LAB_RT emulation plans with detection in mind.
Visual · rt_tactics_techniques
Tactics/techniques literacy. $LAB_RT only. Original Cyberlium.
T1566 is a label for a behavior class — your RoE decides if you emulate it in lab.
Techniques nest under tactics: Initial Access might include Phishing (T1566) or Valid Accounts (T1078). Sub-techniques add specificity — Spearphishing Attachment (T1566.001). Red teams pick a small technique set per campaign; blue teams prioritize detections for the same IDs. Cyberlium teaches tactic/technique literacy for planning on $LAB_RT — not operational guides for stranger phishing or real weapon kits. Next: Navigator Literacy.
1. Reading technique pages
Each ATT&CK technique page lists procedure examples, mitigations, and detections — literacy gold for purple teams. Read procedure examples as 'what defenders should see,' not as step-by-step against strangers.
For $LAB_RT, note technique ID, tactic, platform, and one detection idea per technique you plan to emulate under RoE.
Command guide
Try these commands — Reading technique pages
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: curl, jq, grep. Reference sites: Tactics vs Techniques (https://attack.mitre.org/tactics/enterprise/); ATT&CK Navigator (https://mitre-attack.github.io/attack-navigator/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Sub-techniques and procedure variance
Adversaries implement the same technique differently — PowerShell vs cmd for Execution, attachment vs link for Phishing. Emulation plans pick one sub-technique per objective to keep campaigns measurable.
Document variance in notes: which sub-technique on $LAB_RT, expected log source, success signal for blue.
3. Technique selection stays inside RoE
Forbidden in Cyberlium: selecting Initial Access techniques to target classmates, or Impact techniques implying ransomware on production. Allowed: naming TTPs you will simulate in $LAB_RT for detection testing.
Ship: table header — technique ID, tactic, platform, detection note for $LAB_RT. Next: Navigator Literacy.
4. What you ship: tactic/technique table template for $LAB_RT
Columns: ID, tactic, platform, detection note. $LAB_RT only. NEVER weapon guides for strangers. chmod 600.
5. What you record before the next lesson
Date. Technique table template. $LAB_RT named. File t21-m02-l02-tactics-techniques.txt chmod 600.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Copy procedure examples verbatim against production. Treat sub-techniques as mandatory full chains on strangers.
- Right: Write technique table template for $LAB_RT. Next: Navigator Literacy.
Mission: template technique table
1) Define tactic vs technique vs sub-technique. 2) Create table columns for $LAB_RT planning. 3) chmod 600. Never plan techniques outside RoE.
Stuck? Ask Cyberlium AI Mentor
One technique well-debriefed beats twenty random TTPs.
APPLY: A technique in ATT&CK describes:
APPLY: True or False: Sub-techniques add specificity under parent techniques.
APPLY: Procedure examples on ATT&CK pages should be read as: