Siam Thanat Hack Co., Ltd.

MITRE ATT&CK v19.1: every Enterprise tactic for pentesting and red teaming

This guide uses Enterprise ATT&CK v19.1 as a common language for threat-informed testing. Select authorised behaviours from scope, critical assets, and business risk; it is not an instruction to attack live systems or a coverage guarantee.

Based on Enterprise ATT&CK v19.1: tactics describe adversary objectives and techniques describe how those objectives can be achieved.

Using MITRE ATT&CK to keep testing threat-informed

MITRE ATT&CK is a knowledge base for communicating observed adversary behaviour. Good use starts with a threat model and critical assets, not an attempt to tick every technique.

Thai infographic explaining: Using MITRE ATT&CK to keep testing threat-informed
Visual summary: Using MITRE ATT&CK to keep testing threat-informed
  • Select tactics and techniques from business context, attack surface, architecture, and threat intelligence relevant to the organisation.
  • Create an adversary-emulation plan with clear scope, timing, and guardrails, testing prevention, detection, and response only to the authorised degree.
  • Connect test evidence to telemetry, detection rules, SIEM, EDR, network logs, or cloud logs so gaps are traceable.
  • An ATT&CK mapping does not prove 100 percent coverage. Prioritise improvement by impact, likelihood, and service criticality.

Enterprise tactic 1 of 15

Reconnaissance

Example technique
T1595 Active Scanning
Tactical objective
Gather information useful for planning future operations.
Authorised testing illustration for Reconnaissance using T1595 Active Scanning
Authorised-test attack-flow illustration. Select the image to inspect it at full size.

Pentest / red-team relevance

The test team validates only in-scope attack surface, such as hosts, services, TLS, and web paths, with rate and timing controlled by the Rules of Engagement.

Evidence and detections to validate

Validate whether WAF, IDS/IPS, CDN, and DNS telemetry captures, distinguishes, and alerts on scan patterns.

Enterprise tactic 2 of 15

Resource Development

Example technique
T1583 Acquire Infrastructure
Tactical objective
Establish resources that support operations.
Authorised testing illustration for Resource Development using T1583 Acquire Infrastructure
Authorised-test attack-flow illustration. Select the image to inspect it at full size.

Pentest / red-team relevance

The red team uses only project-controlled domains and endpoints to emulate the agreed indicators and response workflow.

Evidence and detections to validate

Validate threat-intelligence intake, monitoring for newly observed domains, and triage that does not unnecessarily block business services.

Enterprise tactic 3 of 15

Initial Access

Example technique
T1190 Exploit Public-Facing Application
Tactical objective
Gain entry to the target network or system.
Authorised testing illustration for Initial Access using T1190 Exploit Public-Facing Application
Authorised-test attack-flow illustration. Select the image to inspect it at full size.

Pentest / red-team relevance

A pentest validates internet-facing systems with authorised, non-destructive proofs and avoids production-impacting exploitation.

Evidence and detections to validate

Validate asset inventory, WAF and application logs, vulnerability alerting, and escalation from the edge to the service owner.

Enterprise tactic 4 of 15

Execution

Example technique
T1059 Command and Scripting Interpreter
Tactical objective
Run code or commands on a system.
Authorised testing illustration for Execution using T1059 Command and Scripting Interpreter
Authorised-test attack-flow illustration. Select the image to inspect it at full size.

Pentest / red-team relevance

Use harmless commands or a command simulator to check that EDR and logging record the interpreter, parent process, and command line.

Evidence and detections to validate

Validate process telemetry completeness, alert fidelity, and correlation to the relevant account and host.

Enterprise tactic 5 of 15

Persistence

Example technique
T1505 Server Software Component
Tactical objective
Maintain an ongoing foothold.
Authorised testing illustration for Persistence using T1505 Server Software Component
Authorised-test attack-flow illustration. Select the image to inspect it at full size.

Pentest / red-team relevance

Emulate a server-component change only in a lab or non-production environment with rollback; never leave a backdoor or persistent file in production.

Evidence and detections to validate

Validate file-integrity monitoring, change control, deployment audit trails, and alerts for unauthorised component change.

Enterprise tactic 6 of 15

Privilege Escalation

Example technique
T1068 Exploitation for Privilege Escalation
Tactical objective
Gain higher-level permissions.
Authorised testing illustration for Privilege Escalation using T1068 Exploitation for Privilege Escalation
Authorised-test attack-flow illustration. Select the image to inspect it at full size.

Pentest / red-team relevance

Assess patch posture, privilege boundaries, and escalation paths with test accounts or simulated systems; do not use zero-days or exceed approved privilege limits.

Evidence and detections to validate

Validate privilege-change alerts, patch gaps, PAM controls, and audit evidence for access elevation.

Enterprise tactic 7 of 15

Stealth

Example technique
T1070 Indicator Removal
Tactical objective
Hide or blend activity into normal behaviour.
Authorised testing illustration for Stealth using T1070 Indicator Removal
Authorised-test attack-flow illustration. Select the image to inspect it at full size.

Pentest / red-team relevance

Use synthetic files and events to test whether retention, tamper detection, and investigation workflows retain authorised cleanup evidence.

Evidence and detections to validate

Validate central log forwarding, immutability or retention, alerts for evidence deletion, and retrospective search capability.

Enterprise tactic 8 of 15

Defense Impairment

Example technique
T1562 Impair Defenses
Tactical objective
Break or undermine security mechanisms, tooling, or pipelines.
Authorised testing illustration for Defense Impairment using T1562 Impair Defenses
Authorised-test attack-flow illustration. Select the image to inspect it at full size.

Pentest / red-team relevance

Test only through agreed health signals or a simulator. Do not disable EDR, logging, or production security controls without an approved change window.

Evidence and detections to validate

Validate telemetry health, tamper protection, alerts for silent agents, and runbooks that restore visibility.

Enterprise tactic 9 of 15

Credential Access

Example technique
T1003 OS Credential Dumping
Tactical objective
Obtain account names, passwords, or authentication material.
Authorised testing illustration for Credential Access using T1003 OS Credential Dumping
Authorised-test attack-flow illustration. Select the image to inspect it at full size.

Pentest / red-team relevance

Use test accounts, honey credentials, or a non-secret simulator rather than collecting real credentials, to assess protection of credential stores and behavioural detection.

Evidence and detections to validate

Validate EDR alerts, privileged-access controls, credential-store hardening, and response to risky material access.

Enterprise tactic 10 of 15

Discovery

Example technique
T1087 Account Discovery
Tactical objective
Learn about the target environment.
Authorised testing illustration for Discovery using T1087 Account Discovery
Authorised-test attack-flow illustration. Select the image to inspect it at full size.

Pentest / red-team relevance

Emulate scoped account and role discovery to assess identity telemetry, rate controls, and analyst context.

Evidence and detections to validate

Validate directory audit, cloud identity logs, alerts for anomalous enumeration, and ownership context for critical accounts.

Enterprise tactic 11 of 15

Lateral Movement

Example technique
T1021 Remote Services
Tactical objective
Move through the environment to other systems.
Authorised testing illustration for Lateral Movement using T1021 Remote Services
Authorised-test attack-flow illustration. Select the image to inspect it at full size.

Pentest / red-team relevance

Use temporary accounts and authorised hosts to test scoped remote services such as SSH or RDP without moving beyond the approved production path.

Evidence and detections to validate

Validate remote-connection logs, segmentation controls, MFA, session recording, and detection of anomalous sessions.

Enterprise tactic 12 of 15

Collection

Example technique
T1005 Data from Local System
Tactical objective
Gather data relevant to the objective.
Authorised testing illustration for Collection using T1005 Data from Local System
Authorised-test attack-flow illustration. Select the image to inspect it at full size.

Pentest / red-team relevance

Use clearly marked sentinel files or synthetic data to test data access, DLP, and collection detection without touching real customer data.

Evidence and detections to validate

Validate access logs, data classification, DLP signals, and the ability to determine which account accessed which data and when.

Enterprise tactic 13 of 15

Command and Control

Example technique
T1071 Application Layer Protocol
Tactical objective
Communicate with controlled systems.
Authorised testing illustration for Command and Control using T1071 Application Layer Protocol
Authorised-test attack-flow illustration. Select the image to inspect it at full size.

Pentest / red-team relevance

Use a harmless beacon emulator directed to a project-controlled endpoint to assess proxy, DNS, EDR, and network detection without creating a persistent channel.

Evidence and detections to validate

Validate egress telemetry, proxy and DNS logs, policy-appropriate TLS inspection, alert correlation, and triage time.

Enterprise tactic 14 of 15

Exfiltration

Example technique
T1041 Exfiltration Over C2 Channel
Tactical objective
Remove data from the environment.
Authorised testing illustration for Exfiltration using T1041 Exfiltration Over C2 Channel
Authorised-test attack-flow illustration. Select the image to inspect it at full size.

Pentest / red-team relevance

Send a small synthetic archive to a project-controlled receiver to assess egress controls and response without using real data.

Evidence and detections to validate

Validate DLP and egress rules, proxy logs, network alerts, case management, and containment that avoids unnecessary impact on critical services.

Enterprise tactic 15 of 15

Impact

Example technique
T1486 Data Encrypted for Impact
Tactical objective
Manipulate, interrupt, or destroy systems and data.
Authorised testing illustration for Impact using T1486 Data Encrypted for Impact
Authorised-test attack-flow illustration. Select the image to inspect it at full size.

Pentest / red-team relevance

Use a ransomware-impact simulator or synthetic files in a sandbox only. Never encrypt or destroy production data; validate detection, isolation, backup, and incident response.

Evidence and detections to validate

Validate endpoint and backup alerts, host isolation, RTO/RPO evidence, recovery steps, and incident communications.

MITRE ATT&CK v19.1 reference

Open the official version history and Enterprise ATT&CK reference