CYBRARY Analyst vocabulary: ATT&CK, IEC 62443 and the words on a case
The same ideas as Foundations, written the way they appear in a report. Technique and requirement identifiers are published by MITRE and ISA/IEC; the mapping to our labs is ours, and it is not an accreditation.
ATT&CK tactics — the why of a step
A tactic is the attacker's goal at that moment. A technique is how they achieved it.
- Reconnaissance — Learning about the target before touching it.
- Resource development — Registering the domains and building the tooling used later.
- Initial access — The first foothold: phishing, a public-facing flaw, a valid account.
- Execution — Attacker-controlled code runs on the host.
- Persistence — Access survives a reboot or a password change.
- Privilege escalation — From a normal account to an administrative one.
- Defense evasion — Logs cleared, tooling disabled, names made to look ordinary.
- Credential access — Passwords, hashes, tokens and keys taken.
- Discovery — Mapping hosts, shares, accounts and trusts from inside.
- Lateral movement — Using what was stolen to reach the next machine.
- Collection — Staging what will be taken.
- Command and control — The channel back to the operator.
- Exfiltration — Data leaves.
- Impact — Encryption, deletion, or a process made to misbehave.
Techniques this range actually performs
Built from the scenario data the labs are graded on — 45 techniques across 16 product-line runs. If a run stops performing one, it leaves this table on its own.
| ID | Technique | Tactic |
|---|---|---|
| T0814 | Denial of service (ICS) | Inhibit response function |
| T0822 | External remote services (ICS) | Initial access |
| T0831 | Manipulation of control (ICS) | Impair process control |
| T0842 | Network sniffing (ICS) | Discovery |
| T0865 | Spearphishing attachment (ICS) | Initial access |
| T1003.001 | LSASS memory | Credential access |
| T1005 | Data from local system | Collection |
| T1018 | Remote system discovery | Discovery |
| T1021.001 | Remote desktop protocol | Lateral movement |
| T1021.002 | SMB/Windows admin shares | Lateral movement |
| T1027 | Obfuscated files or information | Defense evasion |
| T1039 | Data from network shared drive | Collection |
| T1041 | Exfiltration over C2 channel | Exfiltration |
| T1046 | Network service discovery | Discovery |
| T1048 | Exfiltration over alternative protocol | Exfiltration |
| T1053.005 | Scheduled task | Persistence |
| T1070.001 | Clear Windows event logs | Defense evasion |
| T1071.001 | Application layer protocol: web | Command and control |
| T1071.004 | Application layer protocol: DNS | Command and control |
| T1078 | Valid accounts | Credential access |
| T1087 | Account discovery | Discovery |
| T1087.002 | Domain account discovery | Discovery |
| T1098 | Account manipulation | Privilege escalation |
| T1098.005 | Device registration | Persistence |
| T1110.003 | Password spraying | Credential access |
| T1110.004 | Credential stuffing | Credential access |
| T1114.002 | Remote email collection | Collection |
| T1133 | External remote services | Initial access |
| T1135 | Network share discovery | Discovery |
| T1195.002 | Supply chain compromise: software supply chain | Initial access |
| T1204 | User execution | Execution |
| T1204.002 | User execution: malicious file | Execution |
| T1213 | Data from information repositories | Collection |
| T1486 | Data encrypted for impact | Impact |
| T1490 | Inhibit system recovery | Impact |
| T1543.003 | Windows service | Persistence |
| T1546.004 | Unix shell configuration modification | Persistence |
| T1547.001 | Registry Run key | Persistence |
| T1558.003 | Kerberoasting | Credential access |
| T1565.001 | Stored data manipulation | Impact |
| T1566 | Phishing | Initial access |
| T1566.001 | Phishing: spearphishing attachment | Initial access |
| T1566.002 | Phishing: spearphishing link | Initial access |
| T1567.002 | Exfiltration to cloud storage | Exfiltration |
| T1621 | Multi-factor authentication request generation | Credential access |
IEC 62443: zones, conduits, requirements and levels
A zone is a group of assets that share security requirements. A conduit is the controlled path between two zones. Each zone is given a target security level, and the seven foundational requirements say what has to hold at that level.
- FR 1 Identification and authentication controlEvery human and device is known.
- FR 2 Use controlAn identity can only do what its role allows.
- FR 3 System integrityCode, configuration and process data are not silently altered.
- FR 4 Data confidentialityInformation at rest and in transit stays readable only to those entitled.
- FR 5 Restricted data flowZones and conduits — traffic crosses only where it is meant to.
- FR 6 Timely response to eventsIt is noticed, recorded and acted on while it still matters.
- FR 7 Resource availabilityThe process keeps running; denial of service is survivable.
- SL 1 — Protection against casual or coincidental misuse.
- SL 2 — Against intentional misuse with simple means and low resources.
- SL 3 — Against sophisticated means, moderate resources and specific system knowledge.
- SL 4 — Against sophisticated means, extended resources and specific system knowledge.
- Where the range produces the evidence for each requirement is set out on the IEC 62443 pages.
Alert and case vocabulary
- Critical — Answer now. Evidence is being destroyed, or a safety function is involved.
- High — Answer this shift. A confirmed attacker behavior on a real asset.
- Medium — Answer today. Suspicious, with an ordinary explanation still available.
- Low — Context. Worth having in the case, not worth waking anyone for.
Indicator: an observable value — a hash, a domain, an address. Observable: the same value once it is attached to a case. True positive: the rule was right. Benign true positive: the rule was right and the activity was authorized — the hardest verdict to earn, because it needs the authorization shown, not assumed. Dwell time: first attacker action to detection. MTTD / MTTR: mean time to detect and to respond — the two numbers your scored runs move.