subtechnique

A subtechnique is a term used in cybersecurity taxonomies to denote a more granular category within a broader technique. In frameworks such as MITRE ATT&CK, a subtechnique describes a specific method that an adversary may use to accomplish the objective defined by its parent technique. Subtechniques refine the taxonomy by capturing discrete procedures, providing more precise descriptions than a single technique alone and enabling finer-grained analysis.

Examples of subtechniques include entries under a parent technique such as Phishing, where subtechniques include spearphishing attachments, spearphishing links, and spearphishing via service. Other parent techniques, such as Credential Access or Execution, likewise have subtechniques that represent distinct procedures or variants. Each subtechnique typically has its own descriptive text and is linked to relevant detection, mitigation, and threat-actor context.

Subtechniques support more accurate mapping of observed activity to a technique, improving threat intelligence, incident reporting, and security analytics. They allow defenders to attribute actions to specific methods, tailor detections to particular procedures, and communicate findings with greater precision. In practice, subtechniques are identified within a framework by a parent technique identifier followed by a suffix, enabling clear cross-referencing between techniques and their granular forms.

Limitations include increased taxonomy size and complexity, which can complicate governance and maintenance. Organizations must ensure consistent definitions and keep mappings up to date as adversaries evolve. While not universal across all frameworks, subtechniques have become a common element in modern threat intelligence and security analytics to provide nuanced descriptions of adversary behavior.