LIVE
Top ATT&CK
50 · technique- 1355Exploit Public-Facing ApplicationT1190
- 2248Exploitation for Client ExecutionT1203
- 3217Exploitation for Privilege EscalationT1068
- 4214Command and Scripting InterpreterT1059
- 5184Data from Local SystemT1005
- 6182Valid AccountsT1078
- 7154Obfuscated Files or InformationT1027
- 8148Ingress Tool TransferT1105
- 9147File and Directory DiscoveryT1083
- 10143Web ProtocolsT1071.001
- 11135MasqueradingT1036
- 12127System Information DiscoveryT1082
- 13123Drive-by CompromiseT1189
- 14119Process InjectionT1055
- 15112Malicious FileT1204.002
- 16104External Remote ServicesT1133
- 17100Application Layer ProtocolT1071
- 1899Encrypted ChannelT1573
- 1998OS Credential DumpingT1003
- 2097Application or System ExploitationT1499.004
- 2193ProxyT1090
- 2290Remote System DiscoveryT1018
- 2389PhishingT1566
- 2485JavaScriptT1059.007
- 2585Web ShellT1505.003
- 2684Deobfuscate/Decode Files or InformationT1140
- 2783PowerShellT1059.001
- 2883Hijack Execution FlowT1574
- 2981Unix ShellT1059.004
- 3080Create AccountT1136
- 3179Process DiscoveryT1057
- 3270Credentials In FilesT1552.001
- 3364Exfiltration Over C2 ChannelT1041
- 3461Brute ForceT1110
- 3561System Owner/User DiscoveryT1033
- 3658Account ManipulationT1098
- 3758Data Encrypted for ImpactT1486
- 3857Adversary-in-the-MiddleT1557
- 3957Data DestructionT1485
- 4056Virtualization/Sandbox EvasionT1497
- 4155PythonT1059.006
- 4255Resource HijackingT1496
- 4354Remote Desktop ProtocolT1021.001
- 4453Unsecured CredentialsT1552
- 4549File DeletionT1070.004
- 4648Non-Application Layer ProtocolT1095
- 4748Network Service DiscoveryT1046
- 4846Domain AccountT1087.002
- 4945Steal Web Session CookieT1539
- 5043Scheduled TaskT1053.005
Techniques
227
Sub-techniques
479
Mapped
159
Coverage
70%
CVE mappings
9.0k
Tactics
14
MITRE ATT&CK Matrix
drag to scroll →Reconnaissance
TA00439/12
T159534
Active Scanning
+3 sub
T159111
Gather Victim Org Information
+4 sub
T15899
Gather Victim Identity Information
+3 sub
T15929
Gather Victim Host Information
+4 sub
T15937
Search Open Websites/Domains
+3 sub
T15964
Search Open Technical Databases
+5 sub
T15903
Gather Victim Network Information
+6 sub
T15982
Phishing for Information
+4 sub
T15971
Search Closed Sources
+2 sub
T1594—
Search Victim-Owned Websites
T1681—
Search Threat Vendor Data
T1682—
Query Public AI Services
Resource Development
TA00425/9
Initial Access
TA00019/11
T1190355
Exploit Public-Facing Application
T1078182
Valid Accounts
+4 sub
T1189123
Drive-by Compromise
T1133104
External Remote Services
T156689
Phishing
+4 sub
T109121
Replication Through Removable Media
T119516
Supply Chain Compromise
+3 sub
T119915
Trusted Relationship
T12003
Hardware Additions
T1659—
Content Injection
T1669—
Wi-Fi Networks
Execution
TA000215/22
T1203248
Exploitation for Client Execution
T1059214
Command and Scripting Interpreter
+13 sub
T157483
Hijack Execution Flow
+12 sub
T105337
Scheduled Task/Job
+5 sub
T120433
User Execution
+5 sub
T104731
Windows Management Instrumentation
T156930
System Services
+3 sub
T110626
Native API
T107216
Software Deployment Tools
T11277
Trusted Developer Utilities Proxy Execution
+3 sub
T11976
BITS Jobs
T11292
Shared Modules
T15592
Inter-Process Communication
+3 sub
T16092
Container Administration Command
T16102
Deploy Container
T1648—
Serverless Execution
T1651—
Cloud Administration Command
T1674—
Input Injection
T1675—
ESXi Administration Command
T1677—
Poisoned Pipeline Execution
T1698—
Indirect Prompt Injection
T1699—
Direct Prompt Injection
Persistence
TA000316/22
T1078182
Valid Accounts
+4 sub
T1133104
External Remote Services
T113680
Create Account
+3 sub
T109858
Account Manipulation
+7 sub
T105337
Scheduled Task/Job
+5 sub
T111237
Modify Registry
T117637
Software Extensions
+2 sub
T154732
Boot or Logon Autostart Execution
+14 sub
T154330
Create or Modify System Process
+5 sub
T150529
Server Software Component
+6 sub
T154216
Pre-OS Boot
+5 sub
T154610
Event Triggered Execution
+18 sub
T11976
BITS Jobs
T15566
Modify Authentication Process
+9 sub
T15254
Implant Internal Image
T15541
Compromise Host Software Binary
T1037—
Boot or Logon Initialization Scripts
+5 sub
T1137—
Office Application Startup
+6 sub
T1205—
Traffic Signaling
+2 sub
T1653—
Power Settings
T1668—
Exclusive Control
T1671—
Cloud Application Integration
Privilege Escalation
TA000412/13
T1068217
Exploitation for Privilege Escalation
T1078182
Valid Accounts
+4 sub
T1055119
Process Injection
+12 sub
T109858
Account Manipulation
+7 sub
T105337
Scheduled Task/Job
+5 sub
T154835
Abuse Elevation Control Mechanism
+6 sub
T154732
Boot or Logon Autostart Execution
+14 sub
T154330
Create or Modify System Process
+5 sub
T113421
Access Token Manipulation
+5 sub
T154610
Event Triggered Execution
+18 sub
T14849
Domain or Tenant Policy Modification
+2 sub
T16112
Escape to Host
T1037—
Boot or Logon Initialization Scripts
+5 sub
Defense Evasion
TA00050/0
no techniques
Credential Access
TA000615/18
T100398
OS Credential Dumping
+8 sub
T111061
Brute Force
+4 sub
T155757
Adversary-in-the-Middle
+4 sub
T155253
Unsecured Credentials
+8 sub
T153945
Steal Web Session Cookie
T105642
Input Capture
+4 sub
T155525
Credentials from Password Stores
+6 sub
T104018
Network Sniffing
T152816
Steal Application Access Token
T121213
Exploitation for Credential Access
T111111
Multi-Factor Authentication Interception
T155810
Steal or Forge Kerberos Tickets
+5 sub
T11877
Forced Authentication
T15566
Modify Authentication Process
+9 sub
T16061
Forge Web Credentials
+2 sub
T1621—
Multi-Factor Authentication Request Generation
T1649—
Steal or Forge Authentication Certificates
T1697—
Steal Application Specific Passwords
Discovery
TA000723/34
T1083147
File and Directory Discovery
T1082127
System Information Discovery
T101890
Remote System Discovery
T105779
Process Discovery
T103361
System Owner/User Discovery
T149756
Virtualization/Sandbox Evasion
+3 sub
T104648
Network Service Discovery
T151843
Software Discovery
+2 sub
T101641
System Network Configuration Discovery
+2 sub
T108736
Account Discovery
+4 sub
T101229
Query Registry
T113528
Network Share Discovery
T106922
Permission Groups Discovery
+3 sub
T101020
Application Window Discovery
T104919
System Network Connections Discovery
T104018
Network Sniffing
T148217
Domain Trust Discovery
T112415
System Time Discovery
T161412
System Location Discovery
+1 sub
T11208
Peripheral Device Discovery
T10073
System Service Discovery
T12171
Browser Information Discovery
T16131
Container and Resource Discovery
T1201—
Password Policy Discovery
T1526—
Cloud Service Discovery
T1538—
Cloud Service Dashboard
T1580—
Cloud Infrastructure Discovery
T1615—
Group Policy Discovery
T1619—
Cloud Storage Object Discovery
T1622—
Debugger Evasion
T1652—
Device Driver Discovery
T1654—
Log Enumeration
T1673—
Virtual Machine Discovery
T1680—
Local Storage Discovery
Lateral Movement
TA00089/9
T121038
Exploitation of Remote Services
T102134
Remote Services
+8 sub
T109121
Replication Through Removable Media
T155018
Use Alternate Authentication Material
+4 sub
T107216
Software Deployment Tools
T156310
Remote Service Session Hijacking
+2 sub
T15707
Lateral Tool Transfer
T10806
Taint Shared Content
T15345
Internal Spearphishing
Collection
TA000916/17
T1005184
Data from Local System
T155757
Adversary-in-the-Middle
+4 sub
T105642
Input Capture
+4 sub
T118539
Browser Session Hijacking
T111334
Screen Capture
T121331
Data from Information Repositories
+6 sub
T156023
Archive Collected Data
+3 sub
T153017
Data from Cloud Storage
T111414
Email Collection
+3 sub
T111912
Automated Collection
T107410
Data Staged
+2 sub
T11156
Clipboard Data
T10394
Data from Network Shared Drive
T11253
Video Capture
T16023
Data from Configuration Repository
+2 sub
T11231
Audio Capture
T1025—
Data from Removable Media
Command and Control
TA001114/18
T1105148
Ingress Tool Transfer
T1071100
Application Layer Protocol
+5 sub
T157399
Encrypted Channel
+2 sub
T109093
Proxy
+4 sub
T109548
Non-Application Layer Protocol
T157243
Protocol Tunneling
T157139
Non-Standard Port
T100135
Data Obfuscation
+3 sub
T121935
Remote Access Tools
+3 sub
T110223
Web Service
+3 sub
T100814
Fallback Channels
T11328
Data Encoding
+2 sub
T15686
Dynamic Resolution
+3 sub
T11043
Multi-Stage Channels
T1092—
Communication Through Removable Media
T1205—
Traffic Signaling
+2 sub
T1659—
Content Injection
T1665—
Hide Infrastructure
Exfiltration
TA00105/10
T104164
Exfiltration Over C2 Channel
T102017
Automated Exfiltration
+1 sub
T156714
Exfiltration Over Web Service
+4 sub
T104810
Exfiltration Over Alternative Protocol
+3 sub
T10302
Data Transfer Size Limits
T1011—
Exfiltration Over Other Network Medium
+1 sub
T1029—
Scheduled Transfer
T1052—
Exfiltration Over Physical Medium
+1 sub
T1537—
Transfer Data to Cloud Account
T1700—
AI-Enabled Exfiltration
Impact
TA004012/15
T148658
Data Encrypted for Impact
T148557
Data Destruction
+1 sub
T149655
Resource Hijacking
+4 sub
T149934
Endpoint Denial of Service
+4 sub
T156532
Data Manipulation
+3 sub
T149026
Inhibit System Recovery
T148924
Service Stop
T153114
Account Access Removal
T149810
Network Denial of Service
+2 sub
T14917
Defacement
+2 sub
T15296
System Shutdown/Reboot
T15613
Disk Wipe
+2 sub
T1495—
Firmware Corruption
T1657—
Financial Theft
T1667—
Email Bombing
Tactic Coverage
14 tactics- Reconnaissance9/12
- Resource Development5/9
- Initial Access9/11
- Execution15/22
- Persistence16/22
- Privilege Escalation12/13
- Defense Evasion0/0
- Credential Access15/18
- Discovery23/34
- Lateral Movement9/9
- Collection16/17
- Command and Control14/18
- Exfiltration5/10
- Impact12/15
Legend:50+10–491–90