Initial Access
How the intruder first got in: phishing, valid accounts, exposed services, supply chain.
Home / ATT&CK coverage
Mapped to MITRE ATT&CK
Every incident-response case declares the tactics and techniques it exercises, so you can pick a case by the behavior you want students to recognize. Any answer that names a technique is graded against the evidence. Students work from the responder's own tooling (EDR detection feeds and SIEM alert exports, corroborated by host logs) from first triage through containment, eradication and recovery, the NIST 800-61 lifecycle. Here's what the library covers today.
Execution
Running attacker code: scripting, LOLBins, scheduled tasks, service execution.
Persistence
Keeping a foothold across reboots: Run keys, services, tasks, accounts, startup items.
Privilege Escalation
Gaining higher rights: token theft, UAC bypass, exploit, abused privileges.
Stealth
Blending in: masquerading, process injection, timestomping, file deletion, valid accounts.
Defense Impairment
Blinding the defenders: clearing event logs, disabling AV and EDR, turning off security controls.
Credential Access
Stealing secrets: LSASS dumping, kerberoasting, browser and cached credentials.
Discovery
Learning the environment: host, account, network and share enumeration.
Lateral Movement
Moving host to host: remote services, RDP, SMB/admin shares, remote execution.
Collection
Staging data of interest: archives, local/network shares, screen or input capture.
Command & Control
Attacker channel: beacons, web protocols, DNS, remote-access tools.
Exfiltration
Getting data out: over the C2 channel, to cloud storage, or to an alternate protocol.
Impact
The damage done: ransomware encryption, data destruction, account lockout, defacement.
Tactics and technique IDs follow MITRE ATT&CK Enterprise v20.1. Alert feeds dated before v19 carry the IDs tools used then; an answer is graded right under either ID.
ATT&CK® and MITRE ATT&CK® are registered trademarks of The MITRE Corporation. Red Herrings maps to published ATT&CK tactics and techniques for teaching; it isn't affiliated with or endorsed by MITRE.