Talk to us
English is the default.
Attack Stories

How an Attack Progresses Through ATT&CK

Follow a fictional incident from entry to impact, switching between adversary intent and defender visibility.

Foundational6 min explorationReviewed MITRE ATT&CK 19.2
My learningNot started

Simple: everyday language, with no technical background needed.

Simple explanation

Understand it

An attack is a sequence of decisions in an environment, not a checklist with a guaranteed order. This fictional story selects several behaviors to show how an initial opportunity can develop into broader impact. Real incidents may skip, repeat or combine steps.

Switch to Defender view to see questions a security team could ask at each stage. The two views describe the same events from different perspectives: what the adversary wants and what a defender might observe or constrain.

Technical explanation

Under the hood

The story uses selected official Enterprise tactics and techniques from the displayed ATT&CK version. A phishing attempt relates to Initial Access; interpreter use relates to Execution; system information gathering relates to Discovery. The links describe this example, not every possible use of the tools.

Telemetry is distributed across email, identity, endpoint and network systems. Correlating those records requires timestamps, identities and host context. If a sensor is missing, a gap in the story may reflect missing visibility rather than absent activity.

Practitioner explanation

Practitioner perspective

Build an investigation timeline with explicit confidence and evidence references. Separate observed facts from inferred transitions. A later impact does not prove that every earlier tactic occurred, and the same behavior can have multiple explanations.

Choose response actions using impact, containment options and evidence preservation. Test detection opportunities with controlled exercises; never equate a colored tactic cell with validated prevention. Recovery and business coordination continue after the technical activity stops.

See the decision happen

Watch it work

A fictional, simplified model. Select a component to inspect it, or follow the steps in order.

Explore the system

Initial Access · T1566

A deceptive message creates an entry opportunity.

1 / 5

Takeaway This is one illustrative path, not a universal sequence or coverage claim.

Read every step without animation

Fictional Cedar incident

  1. Initial Access · T1566. A deceptive message creates an entry opportunity. Defender: Inspect delivery evidence and user reports; protect sign-in with phishing-resistant methods.
  2. Execution · T1059. An interpreter is used to execute adversary-directed activity. Defender: Correlate parent process, command context, identity and outbound activity.
  3. Discovery · T1082. The adversary gathers information about the host. Defender: Compare system-discovery activity with expected administration and preceding events.
  4. Lateral Movement · T1021. Remote services are used to reach another system. Defender: Review authentication history, remote-service logs and segmentation boundaries.
  5. Impact · T1486. Data encryption disrupts access to business information. Defender: Contain according to the response plan, preserve evidence and validate restoration.

This is one illustrative path, not a universal sequence or coverage claim.

Attack view

This fictional Cedar incident combines phishing, interpreter execution, discovery, remote-service access and encryption impact. The visual contains no payloads or operational instructions.

Defender view

  • Correlate evidence across identity, endpoint and network sources.
  • Restrict unnecessary privileges and remote access paths.
  • Prepare tested containment and recovery workflows, including restoration from protected backups.

Common mistakes

  • Not every incident passes through every tactic.
  • An ATT&CK map cannot fill missing evidence by itself.

Check your understanding

How should a timeline distinguish observed and inferred steps?
Active recall: explain this idea in 30 seconds

An attack is a sequence of decisions in an environment, not a checklist with a guaranteed order. This fictional story selects several behaviors to show how an initial opportunity can develop into broader impact. Real incidents may skip, repeat or combine steps.

Now give an example and name one limitation. Revisit the explanation if you get stuck.

Primary sources

Original explanations informed by these specifications and official resources. Source versions and lesson review are separate from product updates.

Content reviewed 2026-09-10. Framework reference: MITRE ATT&CK 19.2. Read the editorial policy.

What comes next?

SOC analyst foundations

Back to topic