MITRE ATT&CK v19.2: every Enterprise tactic for pentesting and red teaming
This reference maps the Enterprise ATT&CK v19.2 framework for proactive security assessments, aligning penetration testing and red teaming with real-world adversary behaviors based on authorized scope, critical assets, and organizational risk.
Under Enterprise ATT&CK v19.2: Tactics represent adversary objectives, while Techniques describe the specific methods used to achieve them.
Using MITRE ATT&CK to keep testing threat-informed
MITRE ATT&CK is a knowledge base for communicating observed adversary behaviour. Good use starts with a threat model and critical assets, not an attempt to tick every technique.
Select behavior relevant to real systems and use evidence to evaluate safeguards and follow remediation.
- Tactic — The objective an adversary tries to achieve
- Technique — The method used to cross a security boundary
- Authorized exercise — Emulate behavior within an agreed scope
- Evidence — Observe prevention, detection, and response
- Select tactics and techniques from business context, attack surface, architecture, and threat intelligence relevant to the organisation.
- Create an adversary-emulation plan with clear scope, timing, and guardrails, testing prevention, detection, and response only to the authorised degree.
- Connect test evidence to telemetry, detection rules, SIEM, EDR, network logs, or cloud logs so gaps are traceable.
- An ATT&CK mapping does not prove 100 percent coverage. Prioritise improvement by impact, likelihood, and service criticality.
TA0043 · Enterprise tactic 1 of 15
Reconnaissance
- Official tactic ID
- TA0043
- Example technique
- T1595 Active Scanning
- Tactical objective
- Gather information useful for planning future operations.
Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed.
- Tactic objective — Gather information useful for planning future operations.
- Authorized validation — The test team validates only in-scope attack surface, such as hosts, services, TLS, and web paths, with rate and timing controlled by the Rules of Engagement.
- Evidence and safeguards — Validate whether WAF, IDS/IPS, CDN, and DNS telemetry captures, distinguishes, and alerts on scan patterns.
Pentest / red-team relevance
The test team validates only in-scope attack surface, such as hosts, services, TLS, and web paths, with rate and timing controlled by the Rules of Engagement.
Evidence and detections to validate
Validate whether WAF, IDS/IPS, CDN, and DNS telemetry captures, distinguishes, and alerts on scan patterns.
TA0042 · Enterprise tactic 2 of 15
Resource Development
- Official tactic ID
- TA0042
- Example technique
- T1583 Acquire Infrastructure
- Tactical objective
- Establish resources that support operations.
Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed.
- Tactic objective — Establish resources that support operations.
- Authorized validation — The red team uses only project-controlled domains and endpoints to emulate the agreed indicators and response workflow.
- Evidence and safeguards — Validate threat-intelligence intake, monitoring for newly observed domains, and triage that does not unnecessarily block business services.
Pentest / red-team relevance
The red team uses only project-controlled domains and endpoints to emulate the agreed indicators and response workflow.
Evidence and detections to validate
Validate threat-intelligence intake, monitoring for newly observed domains, and triage that does not unnecessarily block business services.
TA0001 · Enterprise tactic 3 of 15
Initial Access
- Official tactic ID
- TA0001
- Example technique
- T1190 Exploit Public-Facing Application
- Tactical objective
- Gain entry to the target network or system.
Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed.
- Tactic objective — Gain entry to the target network or system.
- Authorized validation — A pentest validates internet-facing systems with authorised, non-destructive proofs and avoids production-impacting exploitation.
- Evidence and safeguards — Validate asset inventory, WAF and application logs, vulnerability alerting, and escalation from the edge to the service owner.
Pentest / red-team relevance
A pentest validates internet-facing systems with authorised, non-destructive proofs and avoids production-impacting exploitation.
Evidence and detections to validate
Validate asset inventory, WAF and application logs, vulnerability alerting, and escalation from the edge to the service owner.
TA0002 · Enterprise tactic 4 of 15
Execution
- Official tactic ID
- TA0002
- Example technique
- T1059 Command and Scripting Interpreter
- Tactical objective
- Run code or commands on a system.
Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed.
- Tactic objective — Run code or commands on a system.
- Authorized validation — Use harmless commands or a command simulator to check that EDR and logging record the interpreter, parent process, and command line.
- Evidence and safeguards — Validate process telemetry completeness, alert fidelity, and correlation to the relevant account and host.
Pentest / red-team relevance
Use harmless commands or a command simulator to check that EDR and logging record the interpreter, parent process, and command line.
Evidence and detections to validate
Validate process telemetry completeness, alert fidelity, and correlation to the relevant account and host.
TA0003 · Enterprise tactic 5 of 15
Persistence
- Official tactic ID
- TA0003
- Example technique
- T1505 Server Software Component
- Tactical objective
- Maintain an ongoing foothold.
Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed.
- Tactic objective — Maintain an ongoing foothold.
- Authorized validation — Emulate a server-component change only in a lab or non-production environment with rollback; never leave a backdoor or persistent file in production.
- Evidence and safeguards — Validate file-integrity monitoring, change control, deployment audit trails, and alerts for unauthorised component change.
Pentest / red-team relevance
Emulate a server-component change only in a lab or non-production environment with rollback; never leave a backdoor or persistent file in production.
Evidence and detections to validate
Validate file-integrity monitoring, change control, deployment audit trails, and alerts for unauthorised component change.
TA0004 · Enterprise tactic 6 of 15
Privilege Escalation
- Official tactic ID
- TA0004
- Example technique
- T1068 Exploitation for Privilege Escalation
- Tactical objective
- Gain higher-level permissions.
Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed.
- Tactic objective — Gain higher-level permissions.
- Authorized validation — Assess patch posture, privilege boundaries, and escalation paths with test accounts or simulated systems; do not use zero-days or exceed approved privilege limits.
- Evidence and safeguards — Validate privilege-change alerts, patch gaps, PAM controls, and audit evidence for access elevation.
Pentest / red-team relevance
Assess patch posture, privilege boundaries, and escalation paths with test accounts or simulated systems; do not use zero-days or exceed approved privilege limits.
Evidence and detections to validate
Validate privilege-change alerts, patch gaps, PAM controls, and audit evidence for access elevation.
TA0005 · Enterprise tactic 7 of 15
Stealth
- Official tactic ID
- TA0005
- Example technique
- T1070 Indicator Removal
- Tactical objective
- Hide or blend activity into normal behaviour.
Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed.
- Tactic objective — Hide or blend activity into normal behaviour.
- Authorized validation — Use synthetic files and events to test whether retention, tamper detection, and investigation workflows retain authorised cleanup evidence.
- Evidence and safeguards — Validate central log forwarding, immutability or retention, alerts for evidence deletion, and retrospective search capability.
Pentest / red-team relevance
Use synthetic files and events to test whether retention, tamper detection, and investigation workflows retain authorised cleanup evidence.
Evidence and detections to validate
Validate central log forwarding, immutability or retention, alerts for evidence deletion, and retrospective search capability.
TA0112 · Enterprise tactic 8 of 15
Defense Impairment
- Official tactic ID
- TA0112
- Example technique
- T1685 Disable or Modify Tools
- Tactical objective
- Break or undermine security mechanisms, tooling, or pipelines.
Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed.
- Tactic objective — Break or undermine security mechanisms, tooling, or pipelines.
- Authorized validation — Test only through agreed health signals or a simulator. Do not disable EDR, logging, or production security controls without an approved change window.
- Evidence and safeguards — Validate telemetry health, tamper protection, alerts for silent agents, and runbooks that restore visibility.
Pentest / red-team relevance
Test only through agreed health signals or a simulator. Do not disable EDR, logging, or production security controls without an approved change window.
Evidence and detections to validate
Validate telemetry health, tamper protection, alerts for silent agents, and runbooks that restore visibility.
TA0006 · Enterprise tactic 9 of 15
Credential Access
- Official tactic ID
- TA0006
- Example technique
- T1003 OS Credential Dumping
- Tactical objective
- Obtain account names, passwords, or authentication material.
Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed.
- Tactic objective — Obtain account names, passwords, or authentication material.
- Authorized validation — Use test accounts, honey credentials, or a non-secret simulator rather than collecting real credentials, to assess protection of credential stores and behavioural detection.
- Evidence and safeguards — Validate EDR alerts, privileged-access controls, credential-store hardening, and response to risky material access.
Pentest / red-team relevance
Use test accounts, honey credentials, or a non-secret simulator rather than collecting real credentials, to assess protection of credential stores and behavioural detection.
Evidence and detections to validate
Validate EDR alerts, privileged-access controls, credential-store hardening, and response to risky material access.
TA0007 · Enterprise tactic 10 of 15
Discovery
- Official tactic ID
- TA0007
- Example technique
- T1087 Account Discovery
- Tactical objective
- Learn about the target environment.
Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed.
- Tactic objective — Learn about the target environment.
- Authorized validation — Emulate scoped account and role discovery to assess identity telemetry, rate controls, and analyst context.
- Evidence and safeguards — Validate directory audit, cloud identity logs, alerts for anomalous enumeration, and ownership context for critical accounts.
Pentest / red-team relevance
Emulate scoped account and role discovery to assess identity telemetry, rate controls, and analyst context.
Evidence and detections to validate
Validate directory audit, cloud identity logs, alerts for anomalous enumeration, and ownership context for critical accounts.
TA0008 · Enterprise tactic 11 of 15
Lateral Movement
- Official tactic ID
- TA0008
- Example technique
- T1021 Remote Services
- Tactical objective
- Move through the environment to other systems.
Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed.
- Tactic objective — Move through the environment to other systems.
- Authorized validation — Use temporary accounts and authorised hosts to test scoped remote services such as SSH or RDP without moving beyond the approved production path.
- Evidence and safeguards — Validate remote-connection logs, segmentation controls, MFA, session recording, and detection of anomalous sessions.
Pentest / red-team relevance
Use temporary accounts and authorised hosts to test scoped remote services such as SSH or RDP without moving beyond the approved production path.
Evidence and detections to validate
Validate remote-connection logs, segmentation controls, MFA, session recording, and detection of anomalous sessions.
TA0009 · Enterprise tactic 12 of 15
Collection
- Official tactic ID
- TA0009
- Example technique
- T1005 Data from Local System
- Tactical objective
- Gather data relevant to the objective.
Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed.
- Tactic objective — Gather data relevant to the objective.
- Authorized validation — Use clearly marked sentinel files or synthetic data to test data access, DLP, and collection detection without touching real customer data.
- Evidence and safeguards — Validate access logs, data classification, DLP signals, and the ability to determine which account accessed which data and when.
Pentest / red-team relevance
Use clearly marked sentinel files or synthetic data to test data access, DLP, and collection detection without touching real customer data.
Evidence and detections to validate
Validate access logs, data classification, DLP signals, and the ability to determine which account accessed which data and when.
TA0011 · Enterprise tactic 13 of 15
Command and Control
- Official tactic ID
- TA0011
- Example technique
- T1071 Application Layer Protocol
- Tactical objective
- Communicate with controlled systems.
Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed.
- Tactic objective — Communicate with controlled systems.
- Authorized validation — Use a harmless beacon emulator directed to a project-controlled endpoint to assess proxy, DNS, EDR, and network detection without creating a persistent channel.
- Evidence and safeguards — Validate egress telemetry, proxy and DNS logs, policy-appropriate TLS inspection, alert correlation, and triage time.
Pentest / red-team relevance
Use a harmless beacon emulator directed to a project-controlled endpoint to assess proxy, DNS, EDR, and network detection without creating a persistent channel.
Evidence and detections to validate
Validate egress telemetry, proxy and DNS logs, policy-appropriate TLS inspection, alert correlation, and triage time.
TA0010 · Enterprise tactic 14 of 15
Exfiltration
- Official tactic ID
- TA0010
- Example technique
- T1041 Exfiltration Over C2 Channel
- Tactical objective
- Remove data from the environment.
Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed.
- Tactic objective — Remove data from the environment.
- Authorized validation — Send a small synthetic archive to a project-controlled receiver to assess egress controls and response without using real data.
- Evidence and safeguards — Validate DLP and egress rules, proxy logs, network alerts, case management, and containment that avoids unnecessary impact on critical services.
Pentest / red-team relevance
Send a small synthetic archive to a project-controlled receiver to assess egress controls and response without using real data.
Evidence and detections to validate
Validate DLP and egress rules, proxy logs, network alerts, case management, and containment that avoids unnecessary impact on critical services.
TA0040 · Enterprise tactic 15 of 15
Impact
- Official tactic ID
- TA0040
- Example technique
- T1486 Data Encrypted for Impact
- Tactical objective
- Manipulate, interrupt, or destroy systems and data.
Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed.
- Tactic objective — Manipulate, interrupt, or destroy systems and data.
- Authorized validation — Use a ransomware-impact simulator or synthetic files in a sandbox only. Never encrypt or destroy production data; validate detection, isolation, backup, and incident response.
- Evidence and safeguards — Validate endpoint and backup alerts, host isolation, RTO/RPO evidence, recovery steps, and incident communications.
Pentest / red-team relevance
Use a ransomware-impact simulator or synthetic files in a sandbox only. Never encrypt or destroy production data; validate detection, isolation, backup, and incident response.
Evidence and detections to validate
Validate endpoint and backup alerts, host isolation, RTO/RPO evidence, recovery steps, and incident communications.
Frequently Asked Questions (FAQ)
Key answers and practical guidance addressing common compliance questions.
What is MITRE ATT&CK® v19.2 and how is it utilized in Penetration Testing?
MITRE ATT&CK® is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. Testing teams use it to design realistic adversary emulation scenarios and systematically evaluate detection, logging, and response capabilities.
Does mapping penetration testing findings to MITRE ATT&CK certify 100% security?
No. Mapping results to ATT&CK enhances traceability and identifies defensive detection gaps, but it is a behavioral framework rather than a certification standard or an exhaustive 100%-coverage checklist.