A sheriff's office analyst labels every PowerShell event a tactic. What is the correct TTP placement?
Select an answer to reveal the explanation.
Short Explanation
Calling every hammer a "construction tactic" mixes up the toolbox with the job. PowerShell is usually how Execution happens—a technique or procedure—not a tactic name hanging next to Credential Access.
Full Explanation
A tactic is an adversary goal such as Execution, Credential Access, or Persistence, while PowerShell is commonly a technique (Command and Scripting Interpreter: PowerShell) or a procedure implementing Execution—not a tactic name itself. It can still be discussed in TTP language even though it also appears as telemetry. Civic analysts should keep tools and procedures under the tactic they serve rather than treating PowerShell as a Kill Chain stage or a peer of MITRE tactics.