## Tactics: The "Why" (The Top Row)

Tactics represent the **Adversary's Goals**. There are 14 Tactics in the Enterprise Matrix. You should memorize the flow of an attack.

1.  **Reconnaissance**: Gathering info (Scanning, LinkedIn research).
2.  **Resource Development**: Buying servers, stealing accounts.
3.  **Initial Access**: Getting in (Phishing, Exploit).
4.  **Execution**: Running code (`calc.exe`).
5.  **Persistence**: Staying in (Reboot survival).
6.  **Privilege Escalation**: Getting Root/Admin.
7.  **Defense Evasion**: Hiding (Deleting logs, turning off AV).
8.  **Credential Access**: Stealing passwords.
9.  **Discovery**: Looking around ("Where am I?").
10. **Lateral Movement**: Jumping to other computers.
11. **Collection**: Gathering data needed.
12. **Command and Control (C2)**: Talking to the boss.
13. **Exfiltration**: Stealing the data (Sending it out).
14. **Impact**: Destroying data (Wiping, Encrypting).

**Note**: Attackers don't always follow this order linearly, but it is the general lifecycle.