The full MITRE ATT&CK matrix has hundreds of techniques and sub-techniques across 14 tactics, and it’s easy to get lost in it. In practice, most SOC investigations keep circling back to the same handful of techniques, just recombined in different attack chains.
This is a working cheat sheet — the 10 techniques that show up most often in real investigations, what each one actually looks like in your logs, and the fastest way to detect it. Bookmark it, print it, stick it next to your monitor.
1. T1566 — Phishing
Tactic: Initial Access What it looks like: malicious links or attachments delivered via email, designed to get a user to click, enable a macro, or enter credentials on a spoofed page. Fastest detection signal: email gateway logs showing links to newly-registered domains, combined with user-reported phishing volume spikes.
2. T1059 — Command and Scripting Interpreter
Tactic: Execution What it looks like: attackers using PowerShell, Bash, Python, or similar interpreters already present on the system to run commands, rather than dropping a standalone executable. Fastest detection signal: command-line/process logging (Event ID 4688 or PowerShell Script Block Logging) showing encoded or obfuscated command arguments.
3. T1204 — User Execution
Tactic: Execution What it looks like: the attack chain depending on a human actually opening the file, enabling the macro, or running the installer — this technique is the reason phishing and malicious documents work at all. Fastest detection signal: EDR alerts on Office applications (winword.exe, excel.exe) spawning child processes like cmd.exe or powershell.exe.
4. T1078 — Valid Accounts
Tactic: Defense Evasion, Persistence, Privilege Escalation, Initial Access What it looks like: attackers using legitimate, already-compromised credentials instead of malware — which is exactly why this technique is so hard to catch with signature-based tools. Fastest detection signal: impossible-travel alerts, logins outside normal working hours for that user, or authentication from a new device/ASN combined with unusual post-login behavior.
5. T1053 — Scheduled Task/Job
Tactic: Execution, Persistence, Privilege Escalation What it looks like: creating a scheduled task or cron job so malicious code keeps running after a reboot, or runs at a specific future time to evade real-time monitoring. Fastest detection signal: Windows Event ID 4698 (scheduled task creation) or cron file modifications outside of normal change-management windows.
6. T1055 — Process Injection
Tactic: Defense Evasion, Privilege Escalation What it looks like: malicious code running inside the memory space of a legitimate, trusted process (like explorer.exe or svchost.exe) to hide from process-list-based detection. Fastest detection signal: EDR alerts on unusual memory allocation, API calls like CreateRemoteThread, or a trusted process suddenly making outbound network connections it never has before.
7. T1071 — Application Layer Protocol
Tactic: Command and Control What it looks like: C2 traffic disguised as ordinary HTTP, HTTPS, or DNS traffic, specifically to blend in with the huge volume of legitimate traffic those protocols carry. Fastest detection signal: regularly-timed (“beaconing”) outbound connections, unusual User-Agent strings, or JA3/TLS fingerprints that don’t match the claimed application.
8. T1021 — Remote Services
Tactic: Lateral Movement What it looks like: using RDP, SSH, SMB, or WinRM with valid (often stolen) credentials to move from one compromised host to another inside the network. Fastest detection signal: a single account authenticating to an unusually high number of distinct hosts in a short window — a strong lateral-movement signature.
9. T1082 — System Information Discovery
Tactic: Discovery What it looks like: early-stage reconnaissance commands run right after initial access — checking OS version, installed software, network configuration — so the attacker knows what they’re working with before going further. Fastest detection signal: a burst of discovery commands (systeminfo, whoami, net view, ipconfig /all) run in quick succession, especially from an account or host with no history of running them.
10. T1486 — Data Encrypted for Impact
Tactic: Impact What it looks like: the ransomware payload itself — mass file encryption across accessible drives and shares, usually the final, loudest stage of an attack chain that started days or weeks earlier with one of the techniques above. Fastest detection signal: a sudden spike in file modification/rename events across many files in a short window, or file extensions changing en masse — by the time this fires, speed of response matters more than detection precision.
How to Actually Use This
Notice the order isn’t random — it roughly follows a real attack chain: phishing gets you in (T1566), the user executes something (T1204) via a script interpreter (T1059), the attacker establishes persistence (T1053), evades detection (T1055), phones home (T1071), moves laterally using stolen accounts (T1078, T1021) after some reconnaissance (T1082), and finally causes impact (T1486).
The practical value of ATT&CK isn’t memorizing technique IDs — it’s mapping your existing detection rules against this list and finding the gaps. If your SOC has strong coverage on T1566 and T1486 but nothing meaningfully covering T1055 or T1071, that’s the exact middle-of-the-chain blind spot where attackers spend the most time undetected.
Get the printable version: Download the MITRE ATT&CK Cheat Sheet PDF — all 10 techniques, detection signals, and a blank column to map your own coverage. Download MITRE Sheet →
Related reading: 10 Real Attacks a SOC Analyst Sees Every Single Day — see several of these exact ATT&CK techniques in action, described from the analyst’s side of the alert.
Leave a Reply