MITRE ATT&CK · CVEKit

LIVE

Top ATT&CK

50 · technique

Techniques

225

Sub-techniques

472

Mapped

149

Coverage

66.2%

CVE mappings

5.1k

Tactics

14

MITRE ATT&CK Matrix

drag to scroll →

Reconnaissance

TA00436/12

Active Scanning

Gather Victim Identity Information

Gather Victim Network Information

Search Open Websites/Domains

Search Open Technical Databases

Search Closed Sources

Gather Victim Org Information

Gather Victim Host Information

Search Victim-Owned Websites

Phishing for Information

Search Threat Vendor Data

Query Public AI Services

Resource Development

TA00425/9

Stage Capabilities

Obtain Capabilities

Compromise Infrastructure

Acquire Infrastructure

Develop Capabilities

Establish Accounts

Compromise Accounts

Generate Content

Initial Access

TA00012/4

Replication Through Removable Media

Content Injection

Execution

TA000210/16

Command and Scripting Interpreter

Hijack Execution Flow

Windows Management Instrumentation

Windows Management Instrumentation

Scheduled Task/Job

Scheduled Task/Job

System Services

Container Administration Command

Deploy Container

Software Deployment Tools

Serverless Execution

Cloud Administration Command

Input Injection

ESXi Administration Command

Poisoned Pipeline Execution

Privilege Escalation

TA000416/18

Exploitation for Privilege Escalation

Process Injection

Process Injection

Account Manipulation

Scheduled Task/Job

Scheduled Task/Job

Boot or Logon Autostart Execution

Boot or Logon Autostart Execution

Create or Modify System Process

Create or Modify System Process

Event Triggered Execution

Event Triggered Execution

Domain or Tenant Policy Modification

Domain or Tenant Policy Modification

Boot or Logon Initialization Scripts

Boot or Logon Initialization Scripts

Defense Evasion

TA00050/0

no techniques

Credential Access

TA000612/14

OS Credential Dumping

OS Credential Dumping

Steal Web Session Cookie

Steal Web Session Cookie

Network Sniffing

Network Sniffing

Multi-Factor Authentication Interception

Steal Application Access Token

Steal Application Access Token

Forge Web Credentials

Multi-Factor Authentication Request Generation

Steal or Forge Authentication Certificates

Discovery

TA000731/43

System Information Discovery

File and Directory Discovery

Remote System Discovery

Remote System Discovery

Process Discovery

Virtualization/Sandbox Evasion

Virtualization/Sandbox Evasion

System Owner/User Discovery

System Owner/User Discovery

Software Discovery

Software Discovery

System Network Configuration Discovery

System Network Configuration Discovery

Network Service Discovery

Network Service Discovery

Application Window Discovery

Application Window Discovery

Network Sniffing

Network Sniffing

System Network Connections Discovery

System Network Connections Discovery

Account Discovery

Permission Groups Discovery

Domain Trust Discovery

Domain Trust Discovery

System Location Discovery

System Service Discovery

System Service Discovery

Container and Resource Discovery

Cloud Service Discovery

Cloud Service Discovery

Cloud Service Dashboard

Cloud Service Dashboard

Cloud Infrastructure Discovery

Group Policy Discovery

Cloud Storage Object Discovery

Debugger Evasion

Device Driver Discovery

Log Enumeration

Virtual Machine Discovery

Local Storage Discovery

Lateral Movement

TA00085/8

Replication Through Removable Media

Remote Services

Remote Services

Lateral Tool Transfer

Taint Shared Content

Software Deployment Tools

Internal Spearphishing

Internal Spearphishing

Collection

TA000910/13

Data from Local System

Data from Local System

Data from Cloud Storage

Data from Cloud Storage

Email Collection

Data from Network Shared Drive

Data from Network Shared Drive

Data from Removable Media

Data from Removable Media

Data from Configuration Repository

Command and Control

TA001114/17

Ingress Tool Transfer

Application Layer Protocol

Encrypted Channel

Non-Application Layer Protocol

Non-Standard Port

Fallback Channels

Fallback Channels

Protocol Tunneling

Multi-Stage Channels

Data Obfuscation

Data Obfuscation

Dynamic Resolution

Communication Through Removable Media

Content Injection

Hide Infrastructure

Exfiltration

TA00108/16

Exfiltration Over C2 Channel

Exfiltration Over C2 Channel

Automated Exfiltration

Automated Exfiltration

Exfiltration Over Alternative Protocol

Exfiltration Over Alternative Protocol

Data Transfer Size Limits

Data Transfer Size Limits

Exfiltration Over Other Network Medium

Exfiltration Over Other Network Medium

Scheduled Transfer

Scheduled Transfer

Exfiltration Over Physical Medium

Exfiltration Over Physical Medium

Transfer Data to Cloud Account

Transfer Data to Cloud Account

Tactic Coverage

14 tactics

Reconnaissance6/12
Resource Development5/9
Initial Access2/4
Execution10/16
Persistence17/22
Privilege Escalation16/18
Defense Evasion0/0
Credential Access12/14
Discovery31/43
Lateral Movement5/8
Collection10/13
Command and Control14/17
Exfiltration8/16
Impact20/24

Legend:50+10–491–90