>> Welcome to Module 1,
Lesson 3, tactics.
In this lesson, we will define and
explore what an ATT&CK Tactic is,
as well as start to build an appreciation for how
these tactics fit into the overall ATT&CK TTP model.
Tactics can be defined as the goals
an adversary has during an attack.
We can think of this as why they
perform each action or behavior during a campaign.
While the list of tactics may differ across
technology domains, or matrices,
as you'll see, there's plenty of
overlap and there's lots of
tactics is relatively static over time.
The ATT&CK model treats tactics as objects,
each of which is assigned a unique ID.
Tactics also have short and long descriptions,
as you can see from the example below,
with the persistence tactic.
Going back to our matrix view,
you can see that tactics are
represented as column headers.
Zooming in on individual tactic,
in this case, lateral movement,
you can see that there are
various techniques and sub techniques associated with
performing behaviors that achieve
the goal of the overall tactic of lateral movement.
We'll dive into technique and some techniques later.
With that we've reached our Lesson 3, knowledge check.
An ATT&CK Tactic is,
please take a moment and pause the video and
select the correct answer before proceeding.
In this case, the correct answer was B.
An ATT&CK Tactic is an
intermediate objective of the adversary.
With that, we've reached the conclusion of Lesson 3.
In summary, ATT&CK Tactics represent
adversary goals or why they perform actions.
Finally, tactics are assigned unique IDs and lead
us into more specifics regarding
adversary behaviors such as
techniques and sub techniques.