In MITRE ATT&CK, a sub-technique is a category of behavior, a more specific version of a technique. A procedure is a specific, observed implementation of that behavior by a named group or piece of software. Sub-techniques organize the matrix. Procedures are the evidence under each entry.
How do tactics, techniques and sub-techniques stack up?
MITRE's FAQ gives the clean version. Tactics are the "why": the adversary's goal, such as credential access. Techniques are the "how": dumping credentials to reach that goal. Sub-techniques describe the same behavior at a lower level, such as accessing LSA Secrets to dump those credentials.
A technique page often lists many sub-techniques. The Command and Scripting Interpreter technique, T1059, lists thirteen, from PowerShell (T1059.001) through Python (T1059.006), Cloud API (T1059.009) and Container CLI/API (T1059.013) as shown on the live site today. The list grows as the knowledge base is updated, so never hard code it.
What exactly is a procedure?
MITRE defines procedures as the specific implementation an adversary uses for a technique or sub-technique. They are recorded as observed in the wild use, in the Procedure Examples table on each technique page.
Look at T1059.001. The table includes entries such as a ransomware family that executes PowerShell commands to delete system volume shadow copies, and a separate entry for the same family using PowerShell scripts for credential harvesting and privilege escalation. Each row names who did it and what they did. None of those rows is a new sub-technique. They are examples of one.
Why do people mix them up?
Because a single real intrusion step usually spans several categories at once. The FAQ makes this point directly: an adversary using PowerShell to inject into a process and scrape credential memory is one procedure that contains several techniques and sub-techniques covering PowerShell, process injection and credential dumping.
So the relationship is not a ladder where each procedure belongs to exactly one sub-technique. It is closer to this: a procedure is a story, and sub-techniques are the labels you attach to its parts.
Which one do detections target?
This is where the distinction pays off.
Constructed example: a detection engineer writes a rule that alerts when powershell.exe runs with an encoded command. That rule matches a behavior inside T1059.001, but it also matches one specific style, encoded commands. An actor who calls the same capability through the .NET interfaces without launching the binary is still doing T1059.001, and the rule misses them. MITRE's page notes PowerShell can run without invoking powershell.exe directly.
The lesson: a detection written against a procedure is narrow and precise. A detection written against the sub-technique is broader and noisier. Good coverage uses both, and says which level each rule sits at.
How to check or apply this
- When you tag a rule or a finding, record the technique or sub-technique ID, not the group name.
- Keep procedures separate. Store them as notes or test cases: who did it, which tool, which command pattern.
- Test one rule against several procedures of the same sub-technique. If it only fires on one, you have a procedure rule, not a coverage rule.
- Do not count a sub-technique as covered because one procedure is detected.
- Re-check IDs each release. MITRE states that ATT&CK is updated twice a year, and current versions of pages carry their own modified dates.
- When reporting, write the sentence in plain words first, then add the ID.
How should a report phrase it?
Write the behavior in plain words first, then the ID, then the evidence. For example: the actor ran a script interpreter to delete backup copies (T1059.001), observed on the file server at 02:10, matching a procedure example listed for a known ransomware family. That sentence lets a reader outside the SOC understand the event, lets a detection engineer find the rule to check, and keeps the observed procedure separate from the category it belongs to.
Quick check
Can one procedure map to more than one sub-technique?
Yes. MITRE's own example of PowerShell injecting into a process to scrape credentials spans several techniques and sub-techniques.
Where do I find procedures in ATT&CK?
In the Procedure Examples table on each technique or sub-technique page. They are built from public reporting on observed use.
Sources
Last reviewed: 18 October 2026.
