Tactics Techniques
Tactics techniques literacy walks representative Enterprise tactics — Initial Access through Impact — with named technique examples on YOUR $TI_LAB notes.
Visual · t33_tactics_techniques
Tactics techniques literacy. $TI_LAB only. Original Cyberlium.
From front door to objective — literacy names key tactics and techniques so you trace fictional lab kill chains on paper.
Enterprise tactics span Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact — version-dependent. Each tactic holds multiple techniques. Kill-chain tracing links technique sequence across tactics. Cyberlium traces fictional lab kill chain on YOUR $TI_LAB — five techniques across four tactics for CYBERLIUM-RED scenario. Next: Subtechniques.
1. Representative tactics and techniques (named)
Initial Access: T1566 Phishing, T1190 Exploit Public-Facing Application. Execution: T1059 Command and Scripting Interpreter. Persistence: T1547 Boot or Logon Autostart. Credential Access: T1003 OS Credential Dumping. Exfiltration: T1041 Exfiltration Over C2 Channel.
On $TI_LAB, trace five-technique kill chain across four tactics for fictional lab actor.
Command guide
Try these commands — Representative tactics and techniques (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, curl. Reference sites: MITRE tactics (https://attack.mitre.org/tactics/enterprise/); MITRE techniques (https://attack.mitre.org/techniques/enterprise/); Navigator (https://mitre-attack.github.io/attack-navigator/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why kill-chain tracing improves detection priority
Early-tactic detection (Initial Access) reduces downstream Impact. Technique sequence in IR timeline reconstructs attacker path. Purple teams validate detections per tactic stage.
Students trace lab kill chains on notes — employer IR timelines follow evidence handling and classification rules.
3. Lab boundary
Forbidden: publishing live victim kill-chain timelines without authorization. Allowed: tactics techniques card — five-technique chain with $TI_LAB fictional labels.
Ship: kill-chain trace card for YOUR lab scenario. Next: Subtechniques.
4. What you ship: kill-chain trace card for $TI_LAB
Five techniques across four tactics with IDs. $TI_LAB named. chmod 600.
5. What you record before the next lesson
Date. Kill-chain card. $TI_LAB named. File t33-m04-l02-tactics-techniques.txt chmod 600.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: List techniques without tactic context. Copy live APT timeline without scope.
- Right: Write kill-chain trace for YOUR $TI_LAB scenario. Next: Subtechniques.
Mission: trace kill chain on YOUR lab
1) Pick four tactics and five techniques with ATT&CK IDs. 2) Order techniques in plausible sequence. 3) Link one lab IOC from M3 inventory. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Initial Access detection buys time — map early tactics first in coverage reviews.
APPLY: T1566 belongs to which tactic category:
APPLY: True or False: Kill-chain tracing links techniques across multiple tactics.
APPLY: Tactics techniques literacy on Cyberlium uses: