The twelve ATT&CK tactic categories were derived from which portion of the Cyber Kill Chain?

• A. The initial reconnaissance phase
• B. The later stages (Control, Maintain, and Execute) of the Seven-Stage Cyber Attack Lifecycle
• C. The weaponization phase
• D. The installation phase

Answer: (B)

The twelve ATT&CK tactic categories capture what attackers do after they have footholds in a system, focusing on how they control, maintain, and execute their objectives within the target environment. This aligns with the later phases of the Seven-Stage Cyber Attack Lifecycle—control (establishing and managing command and control), maintain (persistence, privilege escalation, evading defenses), and execute (carrying out actions to achieve goals). Early, pre-access activities like Reconnaissance and Weaponization are outside the scope of these post-compromise tactics, which is why the later stages is the best fit for how ATT&CK categorizes attacker behavior.