CYBRARY The order an intruder works in
Tactics are the why, techniques are the how. Getting the order right is what makes scoping possible.
By the end you can
- Say the common tactic order from initial access to impact.
- Tell a tactic apart from a technique.
- Explain why finding step four means steps one to three also happened.
Tactic, technique, procedure
A tactic is what the attacker is trying to achieve at that moment — get in, stay in, move sideways. A technique is the specific way they did it, and it has a published identifier like T1053.005. A procedure is the exact command they typed.
The identifier matters because it lets two people who have never met describe the same behavior without arguing about words.
- Initial access — the first foothold, usually a person opening something.
- Execution — something runs that the owner did not intend.
- Persistence — it survives a reboot.
- Privilege escalation — it gains rights it was not given.
- Defense evasion — logs cleared, tooling disabled, names made to look ordinary.
- Credential access — passwords or tokens taken.
- Discovery and lateral movement — the network is mapped, then crossed.
- Collection and exfiltration — data gathered and sent out.
- Impact — encryption, deletion, or a process made to misbehave.
Why order is the whole job
If you find a scheduled task running an attacker's script, persistence is proven — which means execution happened, which means something got in. Working backwards from the step you found is scoping, and it is the difference between rebuilding one machine and rebuilding the right ones.
Check yourself
You find a malicious scheduled task on one host. What do you know?
T1053.005 is a…