ATT&CK
MITRE ATT&CK
697 techniques across 15 tactics. Each links to the actors and software that use it, and to matching indicators in the corpus.
Reconnaissance
12 techniques
T1589Gather Victim Identity Information10T1590Gather Victim Network Information3T1591Gather Victim Org Information7T1592Gather Victim Host Information1T1593Search Open Websites/Domains6T1594Search Victim-Owned Websites6T1595Active ScanningT1596Search Open Technical Databases2T1597Search Closed Sources1T1598Phishing for Information5T1681Search Threat Vendor Data2T1682Query Public AI Services2
Resource Development
9 techniques
Initial Access
11 techniques
Execution
20 techniques
T1047Windows Management Instrumentation42T1053Scheduled Task/JobT1059Command and Scripting Interpreter17T1072Software Deployment Tools7T1106Native API20T1127Trusted Developer Utilities Proxy ExecutionT1129Shared Modules1T1197BITS Jobs5T1203Exploitation for Client Execution41T1204User Execution2T1559Inter-Process CommunicationT1569System ServicesT1574Hijack Execution FlowT1609Container Administration Command1T1610Deploy Container1T1648Serverless ExecutionT1651Cloud Administration Command2T1674Input Injection1T1675ESXi Administration Command1T1677Poisoned Pipeline Execution
Persistence
22 techniques
T1037Boot or Logon Initialization Scripts4T1053Scheduled Task/JobT1078Valid Accounts45T1098Account Manipulation4T1112Modify Registry29T1133External Remote Services28T1136Create Account3T1137Office Application Startup2T1176Software ExtensionsT1197BITS Jobs5T1205Traffic Signaling3T1505Server Software ComponentT1525Implant Internal ImageT1542Pre-OS BootT1543Create or Modify System ProcessT1546Event Triggered ExecutionT1547Boot or Logon Autostart Execution1T1554Compromise Host Software Binary2T1556Modify Authentication Process1T1653Power SettingsT1668Exclusive ControlT1671Cloud Application Integration
Privilege Escalation
13 techniques
T1037Boot or Logon Initialization Scripts4T1053Scheduled Task/JobT1055Process Injection15T1068Exploitation for Privilege Escalation22T1078Valid Accounts45T1098Account Manipulation4T1134Access Token Manipulation3T1484Domain or Tenant Policy ModificationT1543Create or Modify System ProcessT1546Event Triggered ExecutionT1547Boot or Logon Autostart Execution1T1548Abuse Elevation Control Mechanism1T1611Escape to Host1
Credential Access
17 techniques
T1003OS Credential Dumping13T1040Network Sniffing8T1056Input Capture3T1110Brute Force15T1111Multi-Factor Authentication Interception4T1187Forced Authentication2T1212Exploitation for Credential Access1T1528Steal Application Access Token2T1539Steal Web Session Cookie8T1552Unsecured Credentials1T1555Credentials from Password Stores12T1556Modify Authentication Process1T1557Adversary-in-the-Middle3T1558Steal or Forge Kerberos Tickets1T1606Forge Web CredentialsT1621Multi-Factor Authentication Request Generation3T1649Steal or Forge Authentication Certificates1
Discovery
34 techniques
T1007System Service Discovery15T1010Application Window Discovery3T1012Query Registry19T1016System Network Configuration Discovery43T1018Remote System Discovery40T1033System Owner/User Discovery40T1040Network Sniffing8T1046Network Service Discovery31T1049System Network Connections Discovery32T1057Process Discovery41T1069Permission Groups Discovery6T1082System Information Discovery57T1083File and Directory Discovery51T1087Account Discovery3T1120Peripheral Device Discovery9T1124System Time Discovery14T1135Network Share Discovery16T1201Password Policy Discovery3T1217Browser Information Discovery7T1482Domain Trust Discovery10T1497Virtualization/Sandbox Evasion3T1518Software Discovery11T1526Cloud Service Discovery1T1538Cloud Service Dashboard1T1580Cloud Infrastructure Discovery2T1613Container and Resource Discovery1T1614System Location Discovery2T1615Group Policy Discovery1T1619Cloud Storage Object DiscoveryT1622Debugger Evasion1T1652Device Driver Discovery1T1654Log Enumeration5T1673Virtual Machine Discovery1T1680Local Storage Discovery10
Lateral Movement
9 techniques
Collection
17 techniques
T1005Data from Local System45T1025Data from Removable Media4T1039Data from Network Shared Drive8T1056Input Capture3T1074Data Staged5T1113Screen Capture19T1114Email Collection4T1115Clipboard Data4T1119Automated Collection21T1123Audio Capture2T1125Video Capture4T1185Browser Session Hijacking1T1213Data from Information Repositories1T1530Data from Cloud Storage5T1557Adversary-in-the-Middle3T1560Archive Collected Data13T1602Data from Configuration Repository
Command and Control
18 techniques
T1001Data Obfuscation1T1008Fallback Channels5T1071Application Layer Protocol5T1090Proxy19T1092Communication Through Removable Media1T1095Non-Application Layer Protocol12T1102Web Service15T1104Multi-Stage Channels4T1105Ingress Tool Transfer86T1132Data Encoding1T1205Traffic Signaling3T1219Remote Access Tools12T1568Dynamic Resolution8T1571Non-Standard Port17T1572Protocol Tunneling15T1573Encrypted Channel4T1659Content Injection1T1665Hide Infrastructure2
Exfiltration
9 techniques
T1011Exfiltration Over Other Network MediumT1020Automated Exfiltration7T1029Scheduled Transfer1T1030Data Transfer Size Limits5T1041Exfiltration Over C2 Channel27T1048Exfiltration Over Alternative Protocol2T1052Exfiltration Over Physical MediumT1537Transfer Data to Cloud Account3T1567Exfiltration Over Web Service4
Impact
15 techniques
T1485Data Destruction6T1486Data Encrypted for Impact18T1489Service Stop7T1490Inhibit System Recovery7T1491DefacementT1495Firmware CorruptionT1496Resource HijackingT1498Network Denial of Service1T1499Endpoint Denial of Service1T1529System Shutdown/Reboot4T1531Account Access Removal2T1561Disk WipeT1565Data Manipulation1T1657Financial Theft15T1667Email Bombing1
Defense Impairment
18 techniques
T1112Modify Registry29T1207Rogue Domain ControllerT1222File and Directory Permissions ModificationT1484Domain or Tenant Policy ModificationT1553Subvert Trust Controls1T1556Modify Authentication Process1T1578Modify Cloud Compute InfrastructureT1599Network Boundary Bridging1T1600Weaken EncryptionT1601Modify System ImageT1647Plist File ModificationT1666Modify Cloud Resource HierarchyT1685Disable or Modify Tools32T1686Disable or Modify System Firewall13T1687Exploitation for Defense ImpairmentT1688Safe Mode BootT1689Downgrade AttackT1690Prevent Command History Logging4
Stealth
30 techniques
T1006Direct Volume Access2T1014Rootkit6T1027Obfuscated Files or Information18T1036Masquerading20T1055Process Injection15T1070Indicator Removal4T1078Valid Accounts45T1127Trusted Developer Utilities Proxy ExecutionT1134Access Token Manipulation3T1140Deobfuscate/Decode Files or Information38T1197BITS Jobs5T1202Indirect Command Execution2T1205Traffic Signaling3T1211Exploitation for Stealth2T1216System Script Proxy ExecutionT1218System Binary Proxy Execution2T1220XSL Script Processing2T1221Template Injection8T1480Execution Guardrails4T1497Virtualization/Sandbox Evasion3T1535Unused/Unsupported Cloud RegionsT1542Pre-OS BootT1564Hide ArtifactsT1574Hijack Execution FlowT1612Build Image on HostT1620Reflective Code Loading4T1622Debugger Evasion1T1678Delay Execution2T1679Selective Exclusion1T1684Social Engineering