A sheriff's office analyst labels every PowerShell event a tactic. What is the correct TTP placement?
Select an answer to reveal the explanation.
Short Explanation
Calling every hammer a "construction tactic" mixes up the toolbox with the job. PowerShell is usually how Execution happens—a technique or procedure—not a tactic name hanging next to Credential Access.
Full Explanation
PowerShell is commonly modeled as a technique or procedure under the Execution tactic (and related techniques such as Command and Scripting Interpreter), not as a MITRE tactic name hanging beside Credential Access or Persistence. A sheriff's office analyst who labels every PowerShell event a "tactic" collapses the toolbox into the job title: PowerShell is how execution often happens on civic Windows hosts, while the tactic answers why the adversary ran it (execution, defense evasion, etc.). Correct TTP placement keeps tactic = goal class, technique/procedure = PowerShell usage details.
Treating PowerShell as a MITRE tactic equal to Credential Access and Persistence fails by elevating a scripting host to tactic rank. Saying PowerShell is only a CIM sourcetype and cannot be described in TTP language fails by denying ATT&CK coverage of scripting interpreters—CIM may normalize fields, but TTPs still apply. Calling PowerShell a Kill Chain stage above Command and Control invents a stage that does not exist in the Kill Chain model.
Exam caveat: tools and interpreters are usually technique/procedure detail under Execution (or other tactics), not tactic names themselves.
Operational check: retag sheriff's office playbooks so PowerShell notables annotate Execution (and the specific technique ID), capture the command line as procedure, and stop promoting "PowerShell" to the tactic field on Incident Review forms.