Simple definition
The high-level objective behind an attacker behavior, such as persistence, privilege escalation, or exfiltration.
Tactics provide the top-level behavioral context in ATT&CK. A single intrusion can involve several tactics as the adversary moves through different objectives over time.
What does a tactic represent?
Attacker objective
Describes why the behavior is being performed.
Behavior grouping
Groups related techniques that serve the same broad objective.
Mapping
Provides a common label for incidents, detections, threats, and tests.
Coverage
Helps teams summarize where validated detections exist across adversary objectives.
Attack progression
Shows how different objectives can appear across stages of an intrusion.
Context
Adds strategic meaning to individual technical behaviors.
Why tactics matter in detection engineering
- Tactics provide a common high-level vocabulary for describing attacker goals.
- Technique-level detections are easier to organize when their tactical objective is clear.
- Coverage reports can reveal broad areas where telemetry or analytics are weak.
- Incident timelines can show how an adversary moved between objectives.
- Threat intelligence can be translated into defensive priorities using consistent ATT&CK structure.
- Tactic coverage alone should not be treated as proof that every underlying technique is detected.
How a tactic works
Define the observed behavior
Start from an incident, threat report, detection, or emulation scenario.
Identify the objective
Determine what the adversary was trying to accomplish.
Map the tactic
Associate the behavior with the best-supported ATT&CK tactic.
Map techniques
Identify the specific technique or sub-technique that represents how the objective was pursued.
Validate telemetry
Confirm the data required to observe that behavior exists.
Measure coverage
Track detection, testing, triage, and response readiness for relevant behavior.
Tactic mapping principles
Objective first
Map based on the adversary goal represented by the behavior.
Technique relationship
Use techniques to describe the concrete method beneath the tactic.
Evidence
Support mappings with observed activity or explicit detection intent.
Multiple tactics
One incident can involve many tactics as attacker goals change.
Coverage limits
One detection under a tactic does not mean the entire tactic is covered.
Version review
Review mappings as ATT&CK and internal detection content evolve.
Common tactic use cases
Detection organization
Group analytics by adversary objective.
Threat intelligence
Summarize which attacker goals appear in reports or campaigns.
Incident analysis
Describe the objectives observed across an intrusion timeline.
Purple teaming
Plan exercises around attacker objectives and the techniques beneath them.
Coverage analysis
Find tactical areas with weak telemetry or few validated detections.
Use-case planning
Prioritize monitoring scenarios around relevant business and threat objectives.
Tactic vs Technique vs Sub-Technique
| ATT&CK level | Primary meaning | Example role |
|---|---|---|
| Tactic | The high-level objective behind adversary behavior. | Describe why the attacker is acting. |
| Technique | A specific method used to achieve a tactical objective. | Describe how the objective is pursued. |
| Sub-Technique | A more specific behavior under a technique. | Describe a particular implementation of that method. |
Key technical considerations
Store ATT&CK identifiers
Keep stable tactic IDs alongside labels where applicable.
Allow many-to-many mapping
Detections and incidents may relate to several tactics or techniques.
Track telemetry dependencies
Coverage should identify the data supporting each mapped behavior.
Validate mappings
Use representative activity or emulation to prove the analytic matches the behavior.
Separate breadth from depth
Count both tactical areas and the specific techniques actually covered.
Keep analyst context
Tactic labels should complement—not replace—the evidence and rule rationale.
Benefits and common problems
Benefits
- Common language for attacker objectives.
- Clear organization for detections.
- Useful coverage summaries.
- Improved threat-intelligence communication.
- Better incident and purple-team analysis.
Common problems
- Tactics are treated as if they are individual detections.
- Coverage is overstated from one mapped rule.
- Mappings are added without evidence.
- Technique detail is lost at the high level.
- ATT&CK updates are not reflected internally.
How ForshTec helps with ATT&CK tactics
ForshTec helps security teams map tactics to techniques, telemetry, detection logic, test cases, and operational coverage.
- ATT&CK mapping
- Tactic and technique coverage analysis
- Detection engineering
- Telemetry dependency mapping
- Purple-team validation
- Detection-gap prioritization
Need ATT&CK coverage tied to real detections instead of labels alone?
ForshTec can connect adversary objectives to the techniques, telemetry, tests, and workflows your security program actually uses.
Talk to ForshTecFAQs
What is a tactic in MITRE ATT&CK?
A tactic is the high-level objective behind attacker behavior, such as persistence, privilege escalation, or exfiltration.
How is a tactic different from a technique?
A tactic describes why the attacker is acting, while a technique describes how the attacker carries out behavior to achieve that objective.
Can one incident involve multiple tactics?
Yes. Intrusions often move through several objectives as the adversary progresses.
Does one rule mapped to a tactic mean the tactic is covered?
No. Tactics contain many behaviors, so coverage should be measured at a more specific technique or sub-technique level when possible.
How are tactics used in threat intelligence?
They help organize reported adversary activity around common high-level objectives.
How should tactics be used in detection engineering?
Use them to organize use cases and coverage, then map the actual analytic to the specific techniques and telemetry it can observe.