The Map and the Territory — How Little of MITRE ATT&CK a Real Attacker Uses

TI-2026-070A · Series: 🗺️ The Map and the Territory · TLP:WHITE · 2026-07-09

MITRE ATT&CK maps roughly 200 techniques across 14 tactics — the whole imaginable space of adversary behavior. The honeypot recorded what real intruders actually typed. They use about six of them, and half of everything they do is one question: "what CPU is this?"

📋 The Short Version

We hold the complete ATT&CK knowledge base in our OSINT library — Enterprise, Mobile, and ICS matrices, the canonical map of everything an adversary could do. It is vast: ~200 Enterprise techniques across 14 tactics, from Reconnaissance to Exfiltration to Impact.

Then we watched 7,434 commands that real intruders ran after breaking into the honeypot. Mapped onto that vast map, they cover a footpath: roughly six to eight techniques, from four tactics. And it is wildly lopsided — one technique, System Information Discovery, is 48% of everything they do.

The map is a continent. The territory the flood of real attackers actually walks is a single trail across one corner of it.

Confidence: HIGH on the observed command distribution. MEDIUM on the sweeping claim that attackers "use almost none of ATT&CK" — a Cowrie honeypot sees the setup, not the payload (§6), though the multi-year stability of this exact command set argues the repertoire really is this small.

1. The Whole Repertoire, in One Table

Here is every ATT&CK technique the 7,434 commands touch, by volume:

Four tactics. Discovery, Execution, Persistence, a touch of Defense Evasion and C2. That is the entire observed behavior of 363 IPs across 1,884 break-ins. ATT&CK's other ten tactics — Privilege Escalation, Credential Access (in-session), Lateral Movement, Collection, Exfiltration, Impact — are absent from the transcript.

2. Half of Everything Is "What CPU Is This?"

The lopsidedness is the story. System Information Discovery alone is 48% of all commands. The most-run individual commands are barely more than a hardware inventory:

uname -s -v -n -r -m                          584
uname -s -v -n -m 2>/dev/null                 409
busybox uname -s -v -n -m 2>/dev/null         313
[ -f /etc/os-release ]                        313
head -1 /proc/version | cut -d' ' -f1         313
cat /proc/cpuinfo | grep name | wc -l          85

The single most common thing a human or bot does after breaking into a Linux server is ask what processor it has. Not read files. Not pivot. Not steal. Profile the silicon.

The reason is economic. This is triage: is this box worth mining, and is it worth enrolling in the botnet? The intruder is pricing the machine's compute, not casing its contents.

3. Persistence Is One Move, Copied Everywhere

If there is a second act, it is always the same one — T1098, hijacking the SSH authorized_keys file:

cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz..." > .ssh/authorized_keys
cd ~; chattr -ia .ssh; lockr -ia .ssh

Delete the real keys, write the attacker's, then chattr/lockr the directory so the owner can't remove it. This is the Outlaw/mdrfckr backdoor — the same key family (credential 345gs5662d34) documented in The Key to 81 Machines (008B) and The Family Tree (052A), run near-identically across operators who share nothing else.

One persistence technique. Industry-standard among the commodity crews. And therefore trivially monitorable: any write to authorized_keys is the alarm.

4. What Never Happens

The absences are as telling as the presences. Across 1,884 intrusions, the honeypot never sees:

• Lateral Movement — no pivoting to other hosts.
• Collection / Exfiltration — no reading, staging, or stealing of data.
• Privilege Escalation — because they arrive as root via credential stuffing; there is nothing to escalate.
• Sophisticated Defense Evasion — beyond history -c, nothing.

The commodity intrusion lifecycle is complete in four verbs: get in, profile, persist, hand off. The operator does not explore the machine because they do not care what is on it. They came for the CPU and the network position, to feed the next campaign. The box is a resource, not a target — which is exactly why data-exfiltration-centric defenses miss the actual objective.

5. Why the Gap Exists

ATT&CK is comprehensive by design — it must catalog what APTs, ransomware crews, and nation-states do, because someone does each technique. But those are the tail. The flood — the 363 IPs, the millions of credential attempts behind them — is not sophisticated. It is a script that logs in, runs uname, drops a key, and leaves.

So the map and the territory serve different readers. The map is right: every technique on it is real. The territory is right too: almost none of them show up when you watch the actual traffic. The gap is not an error in either. It is the difference between what is possible and what is common — and defense has to budget for both, weighted correctly.

6. The Honest Limit

A Cowrie SSH honeypot watches the interactive setup — the commands a live session types: recon, key drop, tool fetch. It does not run the delivered payload. So Resource Hijacking (T1496) is staged here (the recon that precedes it, the wget that fetches it) but executed off-box, invisible to this sensor. Some of the narrowness in §1 is the honeypot's vantage point, not the attacker's true repertoire.

But two things push back. First, the payload's own behavior is itself narrow (052's malware graph: one binary, seven years, no evolution). Second, this exact command set has been stable for years (048A, 049B) — if the interactive repertoire were merely truncated, it would still vary; instead it is a fixed script. The map-vs-territory gap is real. It just has to be read as "the techniques a live intruder types," not "everything the malware ever does."

Where the Series Goes

This opens The Map and the Territory. Having established the gap, the series will walk the footpath the flood actually uses: the one dominant question (T1082 — why "what CPU" is the master triage), the one persistence move (T1098 — the key that owns the machine), and the tactics that are conspicuously missing and what their absence reveals about who is really on the other end. The map is the same for everyone. The territory is where the truth about the adversary actually lives.

Investigation Metadata

Cross-references: TI-2026-048A (The Nine Commands) · TI-2026-049B (The Command Language) · TI-2026-008B (The Key to 81 Machines — the T1098 backdoor) · TI-2026-052A (The Family Tree — the payload's own narrowness) · TI-2026-015 (Echo BMOK — the C2 beacon) · TI-2026-069A/B/C (The Open Armory — the public tools behind these techniques).