Home TacticsImpact

ATT&CK Tactics

Tactics represent the "why" of an ATT&CK technique. They are the adversary's tactical goals: the reason for performing an action. There are 14 tactics in the Enterprise ATT&CK Matrix.

TA0043

TA0040

Impact

The adversary is trying to manipulate, interrupt, or destroy your systems and data. Impact consists of techniques that adversaries use to disrupt availability or compromise integrity.

Associated Techniques(23)

T1531

Account Access Removal

Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.

T1485

Data Destruction

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.

T1486

Data Encrypted for Impact

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

T1565

Data Manipulation

Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity.

3 sub-techniques

T1491

Defacement

Adversaries may modify visual content available internally or externally to an enterprise network.

2 sub-techniques

T1561

Disk Wipe

Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources.

2 sub-techniques

T1499

Endpoint Denial of Service

Adversaries may perform Endpoint Denial of Service attacks to degrade or block the availability of services to users.

4 sub-techniques

T1657

Financial Theft

Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods.

T1495

Firmware Corruption

Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system.

T1490

Inhibit System Recovery

Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system.

T1498

Network Denial of Service

Adversaries may perform Network Denial of Service attacks to degrade or block the availability of targeted resources to users.

2 sub-techniques

T1496

Resource Hijacking

Adversaries may leverage the resources of co-opted systems in order to solve resource intensive problems.

3 sub-techniques

T1489

Service Stop

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

T1529

System Shutdown/Reboot

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.

T1667

Email Bombing

Adversaries may flood targeted email addresses with an overwhelming volume of messages to bury legitimate emails and disrupt business operations.

T1653

Power Settings

Adversaries may impair a system's ability to hibernate, reboot, or shut down in order to extend access to infected machines.

T1668

Compromise Accounts

Adversaries may compromise accounts with services that can be used during targeting.

4 sub-techniques

T1612

Build Image on Host

Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry.

T1671

Email Spoofing

Adversaries may send messages with a spoofed sender address to targets.

T1672

Email Bombing

Adversaries may flood targeted email addresses with an overwhelming volume of messages.

T1677

Encrypted Channel

Adversaries may employ a known encryption algorithm to conceal command and control traffic.

T1679

Exploitation for Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

T1681

Masquerade Task or Service

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign.

CIC-ATT&CK

ATT&CK Tactics

Recon

Resource Dev

Initial Access

Execution

Persistence

Priv Esc

Defense Evasion

Cred Access

Discovery

Lateral Move

Collection

C2

Exfiltration

Impact

Impact

Associated Techniques(23)

Account Access Removal

Data Destruction

Data Encrypted for Impact

Data Manipulation

Defacement

Disk Wipe

Endpoint Denial of Service

Financial Theft

Firmware Corruption

Inhibit System Recovery

Network Denial of Service

Resource Hijacking

Service Stop

System Shutdown/Reboot

Email Bombing

Power Settings

Compromise Accounts

Build Image on Host

Email Spoofing

Email Bombing

Encrypted Channel

Exploitation for Privilege Escalation

Masquerade Task or Service