MITRE ATT&CK · CVEKit

LIVE

Top ATT&CK

50 · technique

Techniques

225

Sub-techniques

472

Mapped

131

Coverage

58.2%

CVE mappings

3.5k

Tactics

14

MITRE ATT&CK Matrix

drag to scroll →

Reconnaissance

TA00432/12

Gather Victim Identity Information

Active Scanning

Gather Victim Network Information

Gather Victim Org Information

Gather Victim Host Information

Search Open Websites/Domains

Search Victim-Owned Websites

Search Open Technical Databases

Search Closed Sources

Phishing for Information

Search Threat Vendor Data

Query Public AI Services

Resource Development

TA00422/9

Stage Capabilities

Compromise Infrastructure

Acquire Infrastructure

Establish Accounts

Compromise Accounts

Develop Capabilities

Obtain Capabilities

Generate Content

Initial Access

TA00017/9

Exploit Public-Facing Application

Drive-by Compromise

External Remote Services

Supply Chain Compromise

Trusted Relationship

Hardware Additions

Content Injection

Execution

TA000212/19

Exploitation for Client Execution

Hijack Execution Flow

Windows Management Instrumentation

Windows Management Instrumentation

Scheduled Task/Job

Scheduled Task/Job

System Services

Trusted Developer Utilities Proxy Execution

Inter-Process Communication

Container Administration Command

Deploy Container

Serverless Execution

Cloud Administration Command

Input Injection

ESXi Administration Command

Poisoned Pipeline Execution

Privilege Escalation

TA000410/13

Process Injection

Process Injection

Abuse Elevation Control Mechanism

Boot or Logon Autostart Execution

Scheduled Task/Job

Scheduled Task/Job

Create or Modify System Process

Access Token Manipulation

Event Triggered Execution

Boot or Logon Initialization Scripts

Boot or Logon Initialization Scripts

Domain or Tenant Policy Modification

Defense Evasion

TA00050/0

no techniques

Credential Access

TA000612/16

OS Credential Dumping

OS Credential Dumping

Adversary-in-the-Middle

Unsecured Credentials

Steal Web Session Cookie

Network Sniffing

Network Sniffing

Exploitation for Credential Access

Steal Application Access Token

Forced Authentication

Credentials from Password Stores

Forge Web Credentials

Modify Authentication Process

Steal or Forge Kerberos Tickets

Multi-Factor Authentication Request Generation

Steal or Forge Authentication Certificates

Discovery

TA000724/38

Remote System Discovery

Remote System Discovery

Virtualization/Sandbox Evasion

System Owner/User Discovery

System Owner/User Discovery

Software Discovery

Application Window Discovery

Application Window Discovery

Network Service Discovery

Network Service Discovery

Network Sniffing

Network Sniffing

System Network Configuration Discovery

System Network Configuration Discovery

Peripheral Device Discovery

System Network Connections Discovery

System Network Connections Discovery

Domain Trust Discovery

Network Share Discovery

System Location Discovery

System Time Discovery

Container and Resource Discovery

System Service Discovery

System Service Discovery

Password Policy Discovery

Browser Information Discovery

Cloud Service Discovery

Cloud Service Dashboard

Cloud Infrastructure Discovery

Group Policy Discovery

Cloud Storage Object Discovery

Debugger Evasion

Device Driver Discovery

Log Enumeration

Virtual Machine Discovery

Local Storage Discovery

Lateral Movement

TA00086/7

Exploitation of Remote Services

Remote Service Session Hijacking

Remote Services

Remote Services

Use Alternate Authentication Material

Lateral Tool Transfer

Internal Spearphishing

Collection

TA000910/16

Data from Local System

Data from Local System

Adversary-in-the-Middle

Browser Session Hijacking

Archive Collected Data

Data from Information Repositories

Data from Cloud Storage

Data from Removable Media

Data from Removable Media

Data from Network Shared Drive

Data from Network Shared Drive

Automated Collection

Data from Configuration Repository

Command and Control

TA00119/13

Encrypted Channel

Non-Standard Port

Remote Access Tools

Data Obfuscation

Data Obfuscation

Fallback Channels

Fallback Channels

Protocol Tunneling

Traffic Signaling

Dynamic Resolution

Content Injection

Hide Infrastructure

Exfiltration

TA00109/16

Exfiltration Over C2 Channel

Exfiltration Over C2 Channel

Exfiltration Over Alternative Protocol

Exfiltration Over Alternative Protocol

Automated Exfiltration

Automated Exfiltration

Data Transfer Size Limits

Data Transfer Size Limits

Exfiltration Over Web Service

Exfiltration Over Other Network Medium

Exfiltration Over Other Network Medium

Scheduled Transfer

Scheduled Transfer

Exfiltration Over Physical Medium

Exfiltration Over Physical Medium

Transfer Data to Cloud Account

Impact

TA004011/15

Data Destruction

Data Manipulation

Data Encrypted for Impact

Resource Hijacking

Endpoint Denial of Service

Inhibit System Recovery

System Shutdown/Reboot

Network Denial of Service

Account Access Removal

Firmware Corruption

Financial Theft

Tactic Coverage

14 tactics

Reconnaissance2/12
Resource Development2/9
Initial Access7/9
Execution12/19
Persistence12/21
Privilege Escalation10/13
Defense Evasion0/0
Credential Access12/16
Discovery24/38
Lateral Movement6/7
Collection10/16
Command and Control9/13
Exfiltration9/16
Impact11/15

Legend:50+10–491–90