Tactics, techniques, and procedures
Tactics, techniques, and procedures describe adversary behavior at different levels, from the goal an attacker pursues to the method and its specific implementation.
Goal, method, implementation
In MITRE ATT&CK, a tactic expresses an adversary’s tactical goal. A technique describes a way to pursue a goal. A sub-technique describes a more specific behavior within a technique, while a procedure records a particular implementation.
These levels let you move from a broad goal to the details of an actual attack. Adding an ATT&CK identifier labels the behavior. You still need evidence to say it happened in your environment or that a control detected it.
Mapping a help-desk call
Consider a caller who impersonates an employee and persuades a help desk to restore access to an account the caller does not own. The intended goal is initial access. MITRE’s Spearphishing Voice sub-technique, T1566.004, describes voice communications used to pursue access.
The story the caller tells, the change they request, and the help-desk process they encounter make up the procedure. A real-incident mapping needs the investigation or threat report that supports those details.
Using a mapping in an assessment
Start with the behavior and evidence, then select the relevant technique or sub-technique. Keep the supporting report or case record alongside the mapping so another reader can inspect the reasoning.
For an authorized assessment, specify the procedure being simulated, its prerequisites, and the decision or system action you will observe. Ask whether the tested behavior was prevented, detected, or escalated, and retain the evidence for that outcome. A successful test tells you about that scenario, not every way an attacker could use the technique.