Simple definition
A specific method an attacker may use to achieve a tactical objective.
Techniques are one of the most practical levels for detection engineering because they describe recognizable behavior while still remaining broad enough to apply across tools and implementations.
What does a technique connect?
Tactic
Links the behavior to the higher-level adversary objective.
Sub-technique
Provides a more specific behavioral variant when ATT&CK defines one.
Procedure
Shows a concrete implementation observed in a tool, actor, or campaign.
Telemetry
Identifies the evidence required to observe the behavior.
Detection logic
Implements analytics that identify or investigate the behavior.
Response
Connects the behavior to triage and containment guidance.
Why techniques matter
- Technique mapping gives detection engineers a behavior-based vocabulary that is more stable than vendor-specific alerts.
- Threat intelligence can be translated into telemetry and analytics by identifying the techniques involved.
- Incident responders can map observed activity consistently across different security tools.
- Sub-techniques provide more specificity when a broad technique contains several distinct behaviors.
- Coverage analysis is stronger when techniques are backed by actual data, rules, and tests.
- Technique labels without validation can create false confidence in defensive coverage.
How a technique works
Define the behavior
Start from a threat report, incident, detection objective, or emulation test.
Map the tactic
Identify the higher-level adversary objective.
Choose the technique
Select the ATT&CK behavior that best matches the evidence.
Check sub-techniques
Use a more specific mapping when the evidence supports it.
Connect telemetry and logic
Document the data sources, fields, analytics, and test cases.
Validate coverage
Confirm the detection works and keep the mapping current as content changes.
Technique mapping principles
Behavior over tool
Map the activity itself rather than the product or malware name.
Evidence based
Choose the technique supported by what actually occurred or what the rule detects.
Specificity
Use a sub-technique only when the available evidence supports that level.
Data dependency
Document the telemetry required to observe the behavior.
Validation
A technique mapping is stronger when backed by a reproducible test.
Multiple mappings
One analytic can legitimately map to several techniques when its logic covers them.
Common technique use cases
Detection mapping
Organize and tag analytics according to attacker behavior.
Threat intelligence
Describe actor, malware, or campaign behavior consistently.
Incident analysis
Map observed activity during investigation.
Purple teaming
Emulate techniques and compare expected detection results.
Coverage analysis
Identify important techniques with missing telemetry or weak analytics.
Use-case development
Translate behavior into data, logic, alert context, and response.
Technique vs Tactic vs TTP
| Concept | Primary meaning | Example role |
|---|---|---|
| Technique | A specific method used to achieve an adversary objective. | Describe how the attacker performs the behavior. |
| Tactic | The high-level adversary objective. | Describe why the attacker is acting. |
| TTP | Tactics, techniques, and procedures considered together. | Describe broader attacker behavior and operational patterns. |
Key technical considerations
Store ATT&CK IDs
Use stable identifiers alongside human-readable names.
Track framework version
Review mappings when ATT&CK definitions evolve.
Document fields
Link techniques to concrete event fields and data components.
Keep test cases
Use emulation or representative telemetry to validate the analytic.
Measure real coverage
Distinguish mapped, tested, production, and response-ready states.
Keep rationale
Record why the analytic maps to the technique.
Benefits and common problems
Benefits
- Behavior-based detection organization.
- Clear threat-intelligence translation.
- Useful coverage analysis.
- Strong foundation for purple teaming.
- More portable detection concepts.
Common problems
- Technique labels are added without evidence.
- Vendor alerts are mapped too broadly.
- Sub-technique specificity is guessed.
- Coverage is claimed without telemetry or tests.
- Mappings become stale as rules change.
How ForshTec helps with ATT&CK techniques
ForshTec maps ATT&CK techniques to real telemetry, detection logic, validation cases, and operational response.
- Technique and sub-technique mapping
- Detection engineering
- Telemetry and field mapping
- Purple-team validation
- Coverage-gap analysis
- Use-case development
Need technique mappings that reflect what your analytics truly detect?
ForshTec can connect ATT&CK techniques to the data, rules, tests, and response workflows that prove coverage.
Talk to ForshTecFAQs
What is a technique in MITRE ATT&CK?
A technique is a specific method an attacker may use to achieve a tactical objective.
How is a technique different from a tactic?
A tactic describes the attacker's objective, while a technique describes how the attacker carries out behavior to achieve it.
What is a sub-technique?
A sub-technique is a more specific behavioral form under a broader technique.
How are techniques used in detection engineering?
They help translate adversary behavior into telemetry requirements, detection logic, tests, and coverage metrics.
Can a detection map to multiple techniques?
Yes, when the detection logic genuinely identifies behavior that spans several techniques.
What makes a technique mapping reliable?
Evidence, correct telemetry, validated detection logic, test cases, and documented rationale.