Home TacticsExecution

ATT&CK Tactics

Tactics represent the "why" of an ATT&CK technique. They are the adversary's tactical goals: the reason for performing an action. There are 14 tactics in the Enterprise ATT&CK Matrix.

TA0043

TA0002

Execution

The adversary is trying to run malicious code. Execution consists of techniques that result in adversary-controlled code running on a local or remote system.

Associated Techniques(17)

T1651

Cloud Administration Command

Adversaries may abuse cloud management services to execute commands within virtual machines.

T1059

Command and Scripting Interpreter

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

13 sub-techniques

T1609

Container Administration Command

Adversaries may abuse a container administration service to execute commands within a container.

T1610

Deploy Container

Adversaries may deploy a container into an environment to facilitate execution or evade defenses.

T1648

ESXi Administration Command

Adversaries may abuse ESXi administration commands to execute commands on virtual machines.

T1203

Exploitation for Client Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

T1673

Input Injection

Adversaries may inject malicious input to execute commands or code.

T1559

Inter-Process Communication

Adversaries may abuse inter-process communication mechanisms for local code execution.

3 sub-techniques

T1106

Native API

Adversaries may interact with the native OS application programming interface to execute behaviors.

T1053

Scheduled Task/Job

Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution.

5 sub-techniques

T1129

Shared Modules

Adversaries may execute malicious payloads via loading shared modules.

T1072

Software Deployment Tools

Adversaries may gain access to and use third-party software suites installed within an enterprise network.

T1569

System Services

Adversaries may abuse system services or daemons to execute commands or programs.

3 sub-techniques

T1204

User Execution

An adversary may rely upon specific actions by a user in order to gain execution.

5 sub-techniques

T1047

Windows Management Instrumentation

Adversaries may abuse Windows Management Instrumentation to execute malicious commands.

T1674

Input Injection

Adversaries may simulate keystrokes on a victim's computer by various means to perform any type of action on behalf of the user.

T1675

ESXi Administration Command

Adversaries may abuse ESXi administration services to execute commands on guest machines hosted within an ESXi virtual environment.

CIC-ATT&CK

ATT&CK Tactics

Recon

Resource Dev

Initial Access

Execution

Persistence

Priv Esc

Defense Evasion

Cred Access

Discovery

Lateral Move

Collection

C2

Exfiltration

Impact

Execution

Associated Techniques(17)

Cloud Administration Command

Command and Scripting Interpreter

Container Administration Command

Deploy Container

ESXi Administration Command

Exploitation for Client Execution

Input Injection

Inter-Process Communication

Native API

Scheduled Task/Job

Shared Modules

Software Deployment Tools

System Services

User Execution

Windows Management Instrumentation

Input Injection

ESXi Administration Command