# MITRE ATT&CK v19.2: every Enterprise tactic for pentesting and red teaming Locale: `en` Source: `/en/compliance/mitre-attack/` Summary: Enterprise ATT&CK v19.2 mapped to pentesting and red teaming by authorized scope, critical asset, and risk. On this page 1. [Overview](/en/compliance/mitre-attack/#topic-overview) 2. [Using MITRE ATT&CK to keep testing threat-informed](/en/compliance/mitre-attack/#compliance-control-summary) 3. [Reconnaissance](/en/compliance/mitre-attack/#reconnaissance) 4. [Resource Development](/en/compliance/mitre-attack/#resource-development) 5. [Initial Access](/en/compliance/mitre-attack/#initial-access) 6. [Execution](/en/compliance/mitre-attack/#execution) 7. [Persistence](/en/compliance/mitre-attack/#persistence) 8. [Privilege Escalation](/en/compliance/mitre-attack/#privilege-escalation) 9. [Stealth](/en/compliance/mitre-attack/#stealth) 10. [Defense Impairment](/en/compliance/mitre-attack/#defense-impairment) 11. [Credential Access](/en/compliance/mitre-attack/#credential-access) 12. [Discovery](/en/compliance/mitre-attack/#discovery) 13. [Lateral Movement](/en/compliance/mitre-attack/#lateral-movement) 14. [Collection](/en/compliance/mitre-attack/#collection) 15. [Command and Control](/en/compliance/mitre-attack/#command-and-control) 16. [Exfiltration](/en/compliance/mitre-attack/#exfiltration) 17. [Impact](/en/compliance/mitre-attack/#impact) 18. [Frequently Asked Questions](/en/compliance/mitre-attack/#compliance-faq) 19. [Related Frameworks](/en/compliance/mitre-attack/#related-compliance-frameworks) # MITRE ATT&CK v19.2: every Enterprise tactic for pentesting and red teaming This reference maps the Enterprise ATT&CK v19.2 framework for proactive security assessments, aligning penetration testing and red teaming with real-world adversary behaviors based on authorized scope, critical assets, and organizational risk. Under Enterprise ATT&CK v19.2: Tactics represent adversary objectives, while Techniques describe the specific methods used to achieve them. ## Using MITRE ATT&CK to keep testing threat-informed MITRE ATT&CK is a knowledge base for communicating observed adversary behaviour. Good use starts with a threat model and critical assets, not an attempt to tick every technique. [![From adversary behavior to defensive evidence: Tactic, Technique, Authorized exercise, Evidence](/assets/compliance/mitre-overview-en-v2.webp)](/assets/compliance/mitre-overview-en-v2.webp) **From adversary behavior to defensive evidence** Select behavior relevant to real systems and use evidence to evaluate safeguards and follow remediation. - **Tactic** — The objective an adversary tries to achieve - **Technique** — The method used to cross a security boundary - **Authorized exercise** — Emulate behavior within an agreed scope - **Evidence** — Observe prevention, detection, and response - Select tactics and techniques from business context, attack surface, architecture, and threat intelligence relevant to the organisation. - Create an adversary-emulation plan with clear scope, timing, and guardrails, testing prevention, detection, and response only to the authorised degree. - Connect test evidence to telemetry, detection rules, SIEM, EDR, network logs, or cloud logs so gaps are traceable. - An ATT&CK mapping does not prove 100 percent coverage. Prioritise improvement by impact, likelihood, and service criticality. TA0043 · Enterprise tactic 1 of 15 ## Reconnaissance Official tactic ID TA0043 Example technique T1595 Active Scanning Tactical objective Gather information useful for planning future operations. [![TA0043 Reconnaissance · T1595 Active Scanning: Tactic objective, Authorized validation, Evidence and safeguards](/assets/compliance/mitre-reconnaissance-en-v3.webp)](/assets/compliance/mitre-reconnaissance-en-v3.webp) **TA0043 Reconnaissance · T1595 Active Scanning** Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed. - **Tactic objective** — Gather information useful for planning future operations. - **Authorized validation** — The test team validates only in-scope attack surface, such as hosts, services, TLS, and web paths, with rate and timing controlled by the Rules of Engagement. - **Evidence and safeguards** — Validate whether WAF, IDS/IPS, CDN, and DNS telemetry captures, distinguishes, and alerts on scan patterns. ### Pentest / red-team relevance The test team validates only in-scope attack surface, such as hosts, services, TLS, and web paths, with rate and timing controlled by the Rules of Engagement. ### Evidence and detections to validate Validate whether WAF, IDS/IPS, CDN, and DNS telemetry captures, distinguishes, and alerts on scan patterns. TA0042 · Enterprise tactic 2 of 15 ## Resource Development Official tactic ID TA0042 Example technique T1583 Acquire Infrastructure Tactical objective Establish resources that support operations. [![TA0042 Resource Development · T1583 Acquire Infrastructure: Tactic objective, Authorized validation, Evidence and safeguards](/assets/compliance/mitre-resource-development-en-v1.webp)](/assets/compliance/mitre-resource-development-en-v1.webp) **TA0042 Resource Development · T1583 Acquire Infrastructure** Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed. - **Tactic objective** — Establish resources that support operations. - **Authorized validation** — The red team uses only project-controlled domains and endpoints to emulate the agreed indicators and response workflow. - **Evidence and safeguards** — Validate threat-intelligence intake, monitoring for newly observed domains, and triage that does not unnecessarily block business services. ### Pentest / red-team relevance The red team uses only project-controlled domains and endpoints to emulate the agreed indicators and response workflow. ### Evidence and detections to validate Validate threat-intelligence intake, monitoring for newly observed domains, and triage that does not unnecessarily block business services. TA0001 · Enterprise tactic 3 of 15 ## Initial Access Official tactic ID TA0001 Example technique T1190 Exploit Public-Facing Application Tactical objective Gain entry to the target network or system. [![TA0001 Initial Access · T1190 Exploit Public-Facing Application: Tactic objective, Authorized validation, Evidence and safeguards](/assets/compliance/mitre-initial-access-en-v3.webp)](/assets/compliance/mitre-initial-access-en-v3.webp) **TA0001 Initial Access · T1190 Exploit Public-Facing Application** Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed. - **Tactic objective** — Gain entry to the target network or system. - **Authorized validation** — A pentest validates internet-facing systems with authorised, non-destructive proofs and avoids production-impacting exploitation. - **Evidence and safeguards** — Validate asset inventory, WAF and application logs, vulnerability alerting, and escalation from the edge to the service owner. ### Pentest / red-team relevance A pentest validates internet-facing systems with authorised, non-destructive proofs and avoids production-impacting exploitation. ### Evidence and detections to validate Validate asset inventory, WAF and application logs, vulnerability alerting, and escalation from the edge to the service owner. TA0002 · Enterprise tactic 4 of 15 ## Execution Official tactic ID TA0002 Example technique T1059 Command and Scripting Interpreter Tactical objective Run code or commands on a system. [![TA0002 Execution · T1059 Command and Scripting Interpreter: Tactic objective, Authorized validation, Evidence and safeguards](/assets/compliance/mitre-execution-en-v1.webp)](/assets/compliance/mitre-execution-en-v1.webp) **TA0002 Execution · T1059 Command and Scripting Interpreter** Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed. - **Tactic objective** — Run code or commands on a system. - **Authorized validation** — Use harmless commands or a command simulator to check that EDR and logging record the interpreter, parent process, and command line. - **Evidence and safeguards** — Validate process telemetry completeness, alert fidelity, and correlation to the relevant account and host. ### Pentest / red-team relevance Use harmless commands or a command simulator to check that EDR and logging record the interpreter, parent process, and command line. ### Evidence and detections to validate Validate process telemetry completeness, alert fidelity, and correlation to the relevant account and host. TA0003 · Enterprise tactic 5 of 15 ## Persistence Official tactic ID TA0003 Example technique T1505 Server Software Component Tactical objective Maintain an ongoing foothold. [![TA0003 Persistence · T1505 Server Software Component: Tactic objective, Authorized validation, Evidence and safeguards](/assets/compliance/mitre-persistence-en-v2.webp)](/assets/compliance/mitre-persistence-en-v2.webp) **TA0003 Persistence · T1505 Server Software Component** Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed. - **Tactic objective** — Maintain an ongoing foothold. - **Authorized validation** — Emulate a server-component change only in a lab or non-production environment with rollback; never leave a backdoor or persistent file in production. - **Evidence and safeguards** — Validate file-integrity monitoring, change control, deployment audit trails, and alerts for unauthorised component change. ### Pentest / red-team relevance Emulate a server-component change only in a lab or non-production environment with rollback; never leave a backdoor or persistent file in production. ### Evidence and detections to validate Validate file-integrity monitoring, change control, deployment audit trails, and alerts for unauthorised component change. TA0004 · Enterprise tactic 6 of 15 ## Privilege Escalation Official tactic ID TA0004 Example technique T1068 Exploitation for Privilege Escalation Tactical objective Gain higher-level permissions. [![TA0004 Privilege Escalation · T1068 Exploitation for Privilege Escalation: Tactic objective, Authorized validation, Evidence and safeguards](/assets/compliance/mitre-privilege-escalation-en-v1.webp)](/assets/compliance/mitre-privilege-escalation-en-v1.webp) **TA0004 Privilege Escalation · T1068 Exploitation for Privilege Escalation** Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed. - **Tactic objective** — Gain higher-level permissions. - **Authorized validation** — Assess patch posture, privilege boundaries, and escalation paths with test accounts or simulated systems; do not use zero-days or exceed approved privilege limits. - **Evidence and safeguards** — Validate privilege-change alerts, patch gaps, PAM controls, and audit evidence for access elevation. ### Pentest / red-team relevance Assess patch posture, privilege boundaries, and escalation paths with test accounts or simulated systems; do not use zero-days or exceed approved privilege limits. ### Evidence and detections to validate Validate privilege-change alerts, patch gaps, PAM controls, and audit evidence for access elevation. TA0005 · Enterprise tactic 7 of 15 ## Stealth Official tactic ID TA0005 Example technique T1070 Indicator Removal Tactical objective Hide or blend activity into normal behaviour. [![TA0005 Stealth · T1070 Indicator Removal: Tactic objective, Authorized validation, Evidence and safeguards](/assets/compliance/mitre-stealth-en-v1.webp)](/assets/compliance/mitre-stealth-en-v1.webp) **TA0005 Stealth · T1070 Indicator Removal** Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed. - **Tactic objective** — Hide or blend activity into normal behaviour. - **Authorized validation** — Use synthetic files and events to test whether retention, tamper detection, and investigation workflows retain authorised cleanup evidence. - **Evidence and safeguards** — Validate central log forwarding, immutability or retention, alerts for evidence deletion, and retrospective search capability. ### Pentest / red-team relevance Use synthetic files and events to test whether retention, tamper detection, and investigation workflows retain authorised cleanup evidence. ### Evidence and detections to validate Validate central log forwarding, immutability or retention, alerts for evidence deletion, and retrospective search capability. TA0112 · Enterprise tactic 8 of 15 ## Defense Impairment Official tactic ID TA0112 Example technique T1685 Disable or Modify Tools Tactical objective Break or undermine security mechanisms, tooling, or pipelines. [![TA0112 Defense Impairment · T1685 Disable or Modify Tools: Tactic objective, Authorized validation, Evidence and safeguards](/assets/compliance/mitre-defense-impairment-en-v3.webp)](/assets/compliance/mitre-defense-impairment-en-v3.webp) **TA0112 Defense Impairment · T1685 Disable or Modify Tools** Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed. - **Tactic objective** — Break or undermine security mechanisms, tooling, or pipelines. - **Authorized validation** — Test only through agreed health signals or a simulator. Do not disable EDR, logging, or production security controls without an approved change window. - **Evidence and safeguards** — Validate telemetry health, tamper protection, alerts for silent agents, and runbooks that restore visibility. ### Pentest / red-team relevance Test only through agreed health signals or a simulator. Do not disable EDR, logging, or production security controls without an approved change window. ### Evidence and detections to validate Validate telemetry health, tamper protection, alerts for silent agents, and runbooks that restore visibility. TA0006 · Enterprise tactic 9 of 15 ## Credential Access Official tactic ID TA0006 Example technique T1003 OS Credential Dumping Tactical objective Obtain account names, passwords, or authentication material. [![TA0006 Credential Access · T1003 OS Credential Dumping: Tactic objective, Authorized validation, Evidence and safeguards](/assets/compliance/mitre-account-access-en-v2.webp)](/assets/compliance/mitre-account-access-en-v2.webp) **TA0006 Credential Access · T1003 OS Credential Dumping** Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed. - **Tactic objective** — Obtain account names, passwords, or authentication material. - **Authorized validation** — Use test accounts, honey credentials, or a non-secret simulator rather than collecting real credentials, to assess protection of credential stores and behavioural detection. - **Evidence and safeguards** — Validate EDR alerts, privileged-access controls, credential-store hardening, and response to risky material access. ### Pentest / red-team relevance Use test accounts, honey credentials, or a non-secret simulator rather than collecting real credentials, to assess protection of credential stores and behavioural detection. ### Evidence and detections to validate Validate EDR alerts, privileged-access controls, credential-store hardening, and response to risky material access. TA0007 · Enterprise tactic 10 of 15 ## Discovery Official tactic ID TA0007 Example technique T1087 Account Discovery Tactical objective Learn about the target environment. [![TA0007 Discovery · T1087 Account Discovery: Tactic objective, Authorized validation, Evidence and safeguards](/assets/compliance/mitre-discovery-en-v1.webp)](/assets/compliance/mitre-discovery-en-v1.webp) **TA0007 Discovery · T1087 Account Discovery** Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed. - **Tactic objective** — Learn about the target environment. - **Authorized validation** — Emulate scoped account and role discovery to assess identity telemetry, rate controls, and analyst context. - **Evidence and safeguards** — Validate directory audit, cloud identity logs, alerts for anomalous enumeration, and ownership context for critical accounts. ### Pentest / red-team relevance Emulate scoped account and role discovery to assess identity telemetry, rate controls, and analyst context. ### Evidence and detections to validate Validate directory audit, cloud identity logs, alerts for anomalous enumeration, and ownership context for critical accounts. TA0008 · Enterprise tactic 11 of 15 ## Lateral Movement Official tactic ID TA0008 Example technique T1021 Remote Services Tactical objective Move through the environment to other systems. [![TA0008 Lateral Movement · T1021 Remote Services: Tactic objective, Authorized validation, Evidence and safeguards](/assets/compliance/mitre-lateral-movement-en-v2.webp)](/assets/compliance/mitre-lateral-movement-en-v2.webp) **TA0008 Lateral Movement · T1021 Remote Services** Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed. - **Tactic objective** — Move through the environment to other systems. - **Authorized validation** — Use temporary accounts and authorised hosts to test scoped remote services such as SSH or RDP without moving beyond the approved production path. - **Evidence and safeguards** — Validate remote-connection logs, segmentation controls, MFA, session recording, and detection of anomalous sessions. ### Pentest / red-team relevance Use temporary accounts and authorised hosts to test scoped remote services such as SSH or RDP without moving beyond the approved production path. ### Evidence and detections to validate Validate remote-connection logs, segmentation controls, MFA, session recording, and detection of anomalous sessions. TA0009 · Enterprise tactic 12 of 15 ## Collection Official tactic ID TA0009 Example technique T1005 Data from Local System Tactical objective Gather data relevant to the objective. [![TA0009 Collection · T1005 Data from Local System: Tactic objective, Authorized validation, Evidence and safeguards](/assets/compliance/mitre-collection-en-v1.webp)](/assets/compliance/mitre-collection-en-v1.webp) **TA0009 Collection · T1005 Data from Local System** Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed. - **Tactic objective** — Gather data relevant to the objective. - **Authorized validation** — Use clearly marked sentinel files or synthetic data to test data access, DLP, and collection detection without touching real customer data. - **Evidence and safeguards** — Validate access logs, data classification, DLP signals, and the ability to determine which account accessed which data and when. ### Pentest / red-team relevance Use clearly marked sentinel files or synthetic data to test data access, DLP, and collection detection without touching real customer data. ### Evidence and detections to validate Validate access logs, data classification, DLP signals, and the ability to determine which account accessed which data and when. TA0011 · Enterprise tactic 13 of 15 ## Command and Control Official tactic ID TA0011 Example technique T1071 Application Layer Protocol Tactical objective Communicate with controlled systems. [![TA0011 Command and Control · T1071 Application Layer Protocol: Tactic objective, Authorized validation, Evidence and safeguards](/assets/compliance/mitre-command-and-control-en-v1.webp)](/assets/compliance/mitre-command-and-control-en-v1.webp) **TA0011 Command and Control · T1071 Application Layer Protocol** Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed. - **Tactic objective** — Communicate with controlled systems. - **Authorized validation** — Use a harmless beacon emulator directed to a project-controlled endpoint to assess proxy, DNS, EDR, and network detection without creating a persistent channel. - **Evidence and safeguards** — Validate egress telemetry, proxy and DNS logs, policy-appropriate TLS inspection, alert correlation, and triage time. ### Pentest / red-team relevance Use a harmless beacon emulator directed to a project-controlled endpoint to assess proxy, DNS, EDR, and network detection without creating a persistent channel. ### Evidence and detections to validate Validate egress telemetry, proxy and DNS logs, policy-appropriate TLS inspection, alert correlation, and triage time. TA0010 · Enterprise tactic 14 of 15 ## Exfiltration Official tactic ID TA0010 Example technique T1041 Exfiltration Over C2 Channel Tactical objective Remove data from the environment. [![TA0010 Exfiltration · T1041 Exfiltration Over C2 Channel: Tactic objective, Authorized validation, Evidence and safeguards](/assets/compliance/mitre-exfiltration-en-v2.webp)](/assets/compliance/mitre-exfiltration-en-v2.webp) **TA0010 Exfiltration · T1041 Exfiltration Over C2 Channel** Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed. - **Tactic objective** — Remove data from the environment. - **Authorized validation** — Send a small synthetic archive to a project-controlled receiver to assess egress controls and response without using real data. - **Evidence and safeguards** — Validate DLP and egress rules, proxy logs, network alerts, case management, and containment that avoids unnecessary impact on critical services. ### Pentest / red-team relevance Send a small synthetic archive to a project-controlled receiver to assess egress controls and response without using real data. ### Evidence and detections to validate Validate DLP and egress rules, proxy logs, network alerts, case management, and containment that avoids unnecessary impact on critical services. TA0040 · Enterprise tactic 15 of 15 ## Impact Official tactic ID TA0040 Example technique T1486 Data Encrypted for Impact Tactical objective Manipulate, interrupt, or destroy systems and data. [![TA0040 Impact · T1486 Data Encrypted for Impact: Tactic objective, Authorized validation, Evidence and safeguards](/assets/compliance/mitre-impact-en-v2.webp)](/assets/compliance/mitre-impact-en-v2.webp) **TA0040 Impact · T1486 Data Encrypted for Impact** Use an authorized scenario to verify visibility and response for this behavior, retaining evidence that can be traced and reviewed. - **Tactic objective** — Manipulate, interrupt, or destroy systems and data. - **Authorized validation** — Use a ransomware-impact simulator or synthetic files in a sandbox only. Never encrypt or destroy production data; validate detection, isolation, backup, and incident response. - **Evidence and safeguards** — Validate endpoint and backup alerts, host isolation, RTO/RPO evidence, recovery steps, and incident communications. ### Pentest / red-team relevance Use a ransomware-impact simulator or synthetic files in a sandbox only. Never encrypt or destroy production data; validate detection, isolation, backup, and incident response. ### Evidence and detections to validate Validate endpoint and backup alerts, host isolation, RTO/RPO evidence, recovery steps, and incident communications. ## Frequently Asked Questions (FAQ) Key answers and practical guidance addressing common compliance questions. ### What is MITRE ATT&CK® v19.2 and how is it utilized in Penetration Testing? MITRE ATT&CK® is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. Testing teams use it to design realistic adversary emulation scenarios and systematically evaluate detection, logging, and response capabilities. ### Does mapping penetration testing findings to MITRE ATT&CK certify 100% security? No. Mapping results to ATT&CK enhances traceability and identifies defensive detection gaps, but it is a behavioral framework rather than a certification standard or an exhaustive 100%-coverage checklist. ## Related Compliance Frameworks and Security Standards - [ OWASP Top 10 guides for Web, Mobile, API, LLM, and Agentic ](/en/compliance/owasp-top-10/) - [ Thailand Cybersecurity Act 2019 and penetration testing ](/en/compliance/cybersecurity-act/) - [ Bank of Thailand pentest rules for financial institutions ](/en/compliance/bank-of-thailand/) - [ Bank of Thailand ATM malware-risk guidance ](/en/compliance/bot-atm-malware-guideline/) ## MITRE ATT&CK v19.2 reference [Open the official Enterprise ATT&CK matrix ](https://attack.mitre.org/matrices/enterprise/) Open full-size image to zoom ## Need a pentest that satisfies these requirements? Tell us about your systems and the requirements you must meet. The STH team will assess the approach and prepare a quotation. [Request a Pentest quote](/en/#contact) Last updated 16 October 2026