Reconnaissance

In surveillance, the adversary is trying to gather information about your organisation, which they can use to plan future operations.

Resource development

In resource development, cyber attackers try to create, purchase or steal resources they can use to sustain their operations.

Initial access

In this phase, the tactic is to try to get into your organisation's network by targeted spear phishing and exploiting weaknesses on public-facing web servers.

Execution

In execution, the attacker tries to run malicious code on your system to reinforce the attack.

Persistence

The attacker will try to gain a foothold to keep access to your system to prevent being cut off in case of a restart, change of credential or other interruption.

Privilege escalation

This tactic consists of techniques to gain higher-level permissions on a system or network by taking advantage of system weakness or misconfiguration.

Defence evasion

In defence evasion, the attacker tries to avoid detection through uninstalling security software or encrypting data and scripts.

Credentials access

This tactic consists of the attacker's techniques for stealing data, like account names and passwords.

Discovery

In discovery, the attacker is trying to learn about your system and internal network.

Lateral movement

In this tactic, the attacker tries to get into and control a remote system on your network.

Collection

In the collection, the attacker is trying to gather relevant data. Typical targets are drive types, browsers and email.

Command and control

Attackers try to communicate with the compromised system to manipulate them.

Exfiltration

This tactic consists of techniques like compressing and encrypting data that attackers use to steal information from your network.

Impact

The attacker tries to manipulate or disrupt your business and the operational process by destroying or tampering with your data.