Simple definition
A more specific behavior under a broader MITRE ATT&CK technique.
Not every ATT&CK technique has sub-techniques, and mappings should be based on observed behavior rather than choosing the most detailed label possible without evidence.
How do sub-techniques fit into ATT&CK?
Tactic
Represents the adversary objective—the reason the behavior is performed.
Technique
Represents the broader method used to achieve that objective.
Sub-technique
Represents a more specific implementation of the broader technique.
Procedure
Describes a concrete way a threat actor, tool, or campaign used the behavior.
Telemetry
Provides evidence needed to observe the behavior.
Detection
Implements logic that identifies or investigates the mapped behavior.
Why sub-techniques matter
- Broad technique mappings can hide important differences in how adversary behavior is implemented.
- More specific mappings can clarify which data sources and fields are required.
- Detection coverage is more useful when it reflects the actual behavior an analytic can observe.
- Threat intelligence can use sub-techniques to describe specific adversary procedures consistently.
- Purple-team tests can target a defined behavior and compare expected detection outcomes.
- Overly precise mapping without evidence can create false confidence in coverage.
How a sub-technique works
Observe or define the behavior
Start from a threat report, incident, emulation test, or security use case.
Find the broader technique
Identify the ATT&CK technique that best matches the behavior.
Check for sub-techniques
Determine whether ATT&CK provides a more specific behavioral representation.
Validate the evidence
Confirm the data actually supports the more specific mapping.
Map detections and tests
Associate the analytic, telemetry, and validation case with the behavior.
Review coverage
Track whether the mapping still matches the production detection and current ATT&CK structure.
Sub-technique mapping principles
Evidence first
Use the most specific mapping the available evidence can support.
Parent technique
Understand the broader behavior the sub-technique belongs to.
Data dependency
Document which telemetry demonstrates the behavior.
Validation
Use emulation or representative events to prove the detection works.
Coverage
Do not claim all sub-techniques are covered because one parent technique is mapped.
Version review
ATT&CK evolves, so internal mappings should be reviewed over time.
Common sub-technique use cases
Detection mapping
Tag analytics to specific adversary behavior.
Threat intelligence
Describe how actors or tools implement a broader technique.
Incident analysis
Map observed activity during an investigation.
Purple teaming
Emulate a specific behavior and validate detection response.
Coverage gaps
Identify missing detection for specific variants of a technique.
Use-case design
Translate ATT&CK behavior into telemetry, logic, and response requirements.
Sub-Technique vs Technique vs Tactic
| ATT&CK level | Primary meaning | Example role |
|---|---|---|
| Sub-Technique | A more specific behavior under a technique. | Describe the specific implementation being detected. |
| Technique | A method used to achieve an adversary objective. | Group related specific behaviors. |
| Tactic | The adversary's high-level objective. | Explain why the activity is being performed. |
Key technical considerations
Store ATT&CK IDs
Use stable technique and sub-technique identifiers alongside names.
Track ATT&CK version
Mappings can change as the knowledge base evolves.
Allow multiple mappings
One analytic may cover several behaviors when evidence supports it.
Tie to test cases
A mapping is stronger when a test demonstrates detection of the behavior.
Document fields
Record the telemetry and fields that support the detection.
Connect workflow
Detection mapping is more useful when triage and response guidance also reflect the behavior.
Benefits and common problems
Benefits
- More precise threat-behavior mapping.
- Better telemetry and detection requirements.
- Clearer coverage analysis.
- Useful purple-team targets.
- Improved threat-intelligence consistency.
Common problems
- Sub-techniques are mapped without evidence.
- Parent-technique coverage is mistaken for full sub-technique coverage.
- Mappings are not updated when ATT&CK changes.
- Detection tags do not match actual logic.
- Teams track labels but not validation.
How ForshTec helps with ATT&CK sub-techniques
ForshTec helps security teams map sub-techniques to real telemetry, detection logic, validation tests, and measurable coverage.
- ATT&CK mapping
- Technique and sub-technique coverage analysis
- Telemetry and data-source mapping
- Detection engineering
- Purple-team validation
- Detection-gap identification
Need ATT&CK mappings that reflect what your detections can actually observe?
ForshTec can connect sub-techniques to telemetry, analytics, tests, and operational coverage evidence.
Talk to ForshTecFAQs
What is a sub-technique in MITRE ATT&CK?
A sub-technique is a more specific behavior under a broader MITRE ATT&CK technique.
Do all ATT&CK techniques have sub-techniques?
No. Sub-techniques are used where ATT&CK provides a more specific breakdown of a broader behavior.
How is a sub-technique different from a technique?
A technique describes a broader adversary method, while a sub-technique describes a more specific implementation of that method.
Should detections always map to the most specific sub-technique?
Only when the detection evidence supports that level of specificity.
How do sub-techniques help coverage analysis?
They expose whether a detection covers only one implementation of a broader technique or several specific variants.
How should teams maintain ATT&CK mappings?
Track ATT&CK IDs and versions, validate mappings against production logic, and review them as detections and ATT&CK evolve.