A threat intelligence analyst is updating a document according to the MITRE ATT&CK framework. The analyst detects the following behavior from a malicious actor: "The malicious actor will attempt to…

Procedures are the specific implementations or steps taken by an adversary to execute a technique, such as using a particular exploit or tool, which is more granular than the general objective of achieving unauthorized access.

Techniques are the 'how' an adversary achieves a tactic, representing specific actions like 'Exploitation for Client Execution' or 'Phishing.' The described behavior is too broad for a specific technique.

In the MITRE ATT&CK framework, 'Tactics' represent the adversary's technical objectives or 'why' an adversary might perform an action. 'Initial Access' is a primary tactic that describes methods adversaries use to gain their first foothold in a network. The behavior of attempting to achieve unauthorized access directly maps to this high-level objective, making it a Tactic.

Subtechniques are more specific ways an adversary might execute a technique, offering even greater detail, which is far more granular than the general statement about unauthorized access.