MITRE ATT&CK Enterprise Technique Index

All 697 ATT&CK Enterprise techniques and sub-techniques. Each page includes the technique overview, tactics, platforms, and counts of detection strategies, mitigations, threat groups, software, and campaigns tracked in the interactive matrix.

• Data Obfuscation (T1001) — Command and Control
  • Junk Data (T1001.001)
  • Steganography (T1001.002)
  • Protocol or Service Impersonation (T1001.003)
• OS Credential Dumping (T1003) — Credential Access
  • LSASS Memory (T1003.001)
  • Security Account Manager (T1003.002)
  • NTDS (T1003.003)
  • LSA Secrets (T1003.004)
  • Cached Domain Credentials (T1003.005)
  • DCSync (T1003.006)
  • Proc Filesystem (T1003.007)
  • /etc/passwd and /etc/shadow (T1003.008)
• Data from Local System (T1005) — Collection
• Direct Volume Access (T1006) — Stealth
• System Service Discovery (T1007) — Discovery
• Fallback Channels (T1008) — Command and Control
• Application Window Discovery (T1010) — Discovery
• Exfiltration Over Other Network Medium (T1011) — Exfiltration
  • Exfiltration Over Bluetooth (T1011.001)
• Query Registry (T1012) — Discovery
• Rootkit (T1014) — Stealth
• System Network Configuration Discovery (T1016) — Discovery
  • Internet Connection Discovery (T1016.001)
  • Wi-Fi Discovery (T1016.002)
• Remote System Discovery (T1018) — Discovery
• Automated Exfiltration (T1020) — Exfiltration
  • Traffic Duplication (T1020.001)
• Remote Services (T1021) — Lateral Movement
  • Remote Desktop Protocol (T1021.001)
  • SMB/Windows Admin Shares (T1021.002)
  • Distributed Component Object Model (T1021.003)
  • SSH (T1021.004)
  • VNC (T1021.005)
  • Windows Remote Management (T1021.006)
  • Cloud Services (T1021.007)
  • Direct Cloud VM Connections (T1021.008)
• Data from Removable Media (T1025) — Collection
• Obfuscated Files or Information (T1027) — Stealth
  • Binary Padding (T1027.001)
  • Software Packing (T1027.002)
  • Steganography (T1027.003)
  • Compile After Delivery (T1027.004)
  • Indicator Removal from Tools (T1027.005)
  • HTML Smuggling (T1027.006)
  • Dynamic API Resolution (T1027.007)
  • Stripped Payloads (T1027.008)
  • Embedded Payloads (T1027.009)
  • Command Obfuscation (T1027.010)
  • Fileless Storage (T1027.011)
  • LNK Icon Smuggling (T1027.012)
  • Encrypted/Encoded File (T1027.013)
  • Polymorphic Code (T1027.014)
  • Compression (T1027.015)
  • Junk Code Insertion (T1027.016)
  • SVG Smuggling (T1027.017)
  • Invisible Unicode (T1027.018)
• Scheduled Transfer (T1029) — Exfiltration
• Data Transfer Size Limits (T1030) — Exfiltration
• System Owner/User Discovery (T1033) — Discovery
• Masquerading (T1036) — Stealth
  • Invalid Code Signature (T1036.001)
  • Right-to-Left Override (T1036.002)
  • Rename Legitimate Utilities (T1036.003)
  • Masquerade Task or Service (T1036.004)
  • Match Legitimate Resource Name or Location (T1036.005)
  • Space after Filename (T1036.006)
  • Double File Extension (T1036.007)
  • Masquerade File Type (T1036.008)
  • Break Process Trees (T1036.009)
  • Masquerade Account Name (T1036.010)
  • Overwrite Process Arguments (T1036.011)
  • Browser Fingerprint (T1036.012)
• Boot or Logon Initialization Scripts (T1037) — Persistence, Privilege Escalation
  • Logon Script (Windows) (T1037.001)
  • Login Hook (T1037.002)
  • Network Logon Script (T1037.003)
  • RC Scripts (T1037.004)
  • Startup Items (T1037.005)
• Data from Network Shared Drive (T1039) — Collection
• Network Sniffing (T1040) — Credential Access, Discovery
• Exfiltration Over C2 Channel (T1041) — Exfiltration
• Network Service Discovery (T1046) — Discovery
• Windows Management Instrumentation (T1047) — Execution
• Exfiltration Over Alternative Protocol (T1048) — Exfiltration
  • Exfiltration Over Symmetric Encrypted Non-C2 Protocol (T1048.001)
  • Exfiltration Over Asymmetric Encrypted Non-C2 Protocol (T1048.002)
  • Exfiltration Over Unencrypted Non-C2 Protocol (T1048.003)
• System Network Connections Discovery (T1049) — Discovery
• Exfiltration Over Physical Medium (T1052) — Exfiltration
  • Exfiltration over USB (T1052.001)
• Scheduled Task/Job (T1053) — Execution, Persistence, Privilege Escalation
  • At (T1053.002)
  • Cron (T1053.003)
  • Scheduled Task (T1053.005)
  • Systemd Timers (T1053.006)
  • Container Orchestration Job (T1053.007)
• Process Injection (T1055) — Stealth, Privilege Escalation
  • Dynamic-link Library Injection (T1055.001)
  • Portable Executable Injection (T1055.002)
  • Thread Execution Hijacking (T1055.003)
  • Asynchronous Procedure Call (T1055.004)
  • Thread Local Storage (T1055.005)
  • Ptrace System Calls (T1055.008)
  • Proc Memory (T1055.009)
  • Extra Window Memory Injection (T1055.011)
  • Process Hollowing (T1055.012)
  • Process Doppelgänging (T1055.013)
  • VDSO Hijacking (T1055.014)
  • ListPlanting (T1055.015)
• Input Capture (T1056) — Collection, Credential Access
  • Keylogging (T1056.001)
  • GUI Input Capture (T1056.002)
  • Web Portal Capture (T1056.003)
  • Credential API Hooking (T1056.004)
• Process Discovery (T1057) — Discovery
• Command and Scripting Interpreter (T1059) — Execution
  • PowerShell (T1059.001)
  • AppleScript (T1059.002)
  • Windows Command Shell (T1059.003)
  • Unix Shell (T1059.004)
  • Visual Basic (T1059.005)
  • Python (T1059.006)
  • JavaScript (T1059.007)
  • Network Device CLI (T1059.008)
  • Cloud API (T1059.009)
  • AutoHotKey & AutoIT (T1059.010)
  • Lua (T1059.011)
  • Hypervisor CLI (T1059.012)
  • Container CLI/API (T1059.013)
• Exploitation for Privilege Escalation (T1068) — Privilege Escalation
• Permission Groups Discovery (T1069) — Discovery
  • Local Groups (T1069.001)
  • Domain Groups (T1069.002)
  • Cloud Groups (T1069.003)
• Indicator Removal (T1070) — Stealth
  • Clear Command History (T1070.003)
  • File Deletion (T1070.004)
  • Network Share Connection Removal (T1070.005)
  • Timestomp (T1070.006)
  • Clear Network Connection History and Configurations (T1070.007)
  • Clear Mailbox Data (T1070.008)
  • Clear Persistence (T1070.009)
  • Relocate Malware (T1070.010)
• Application Layer Protocol (T1071) — Command and Control
  • Web Protocols (T1071.001)
  • File Transfer Protocols (T1071.002)
  • Mail Protocols (T1071.003)
  • DNS (T1071.004)
  • Publish/Subscribe Protocols (T1071.005)
• Software Deployment Tools (T1072) — Execution, Lateral Movement
• Data Staged (T1074) — Collection
  • Local Data Staging (T1074.001)
  • Remote Data Staging (T1074.002)
• Valid Accounts (T1078) — Stealth, Persistence, Privilege Escalation, Initial Access
  • Default Accounts (T1078.001)
  • Domain Accounts (T1078.002)
  • Local Accounts (T1078.003)
  • Cloud Accounts (T1078.004)
• Taint Shared Content (T1080) — Lateral Movement
• System Information Discovery (T1082) — Discovery
• File and Directory Discovery (T1083) — Discovery
• Account Discovery (T1087) — Discovery
  • Local Account (T1087.001)
  • Domain Account (T1087.002)
  • Email Account (T1087.003)
  • Cloud Account (T1087.004)
• Proxy (T1090) — Command and Control
  • Internal Proxy (T1090.001)
  • External Proxy (T1090.002)
  • Multi-hop Proxy (T1090.003)
  • Domain Fronting (T1090.004)
• Replication Through Removable Media (T1091) — Lateral Movement, Initial Access
• Communication Through Removable Media (T1092) — Command and Control
• Non-Application Layer Protocol (T1095) — Command and Control
• Account Manipulation (T1098) — Persistence, Privilege Escalation
  • Additional Cloud Credentials (T1098.001)
  • Additional Email Delegate Permissions (T1098.002)
  • Additional Cloud Roles (T1098.003)
  • SSH Authorized Keys (T1098.004)
  • Device Registration (T1098.005)
  • Additional Container Cluster Roles (T1098.006)
  • Additional Local or Domain Groups (T1098.007)
• Web Service (T1102) — Command and Control
  • Dead Drop Resolver (T1102.001)
  • Bidirectional Communication (T1102.002)
  • One-Way Communication (T1102.003)
• Multi-Stage Channels (T1104) — Command and Control
• Ingress Tool Transfer (T1105) — Command and Control
• Native API (T1106) — Execution
• Brute Force (T1110) — Credential Access
  • Password Guessing (T1110.001)
  • Password Cracking (T1110.002)
  • Password Spraying (T1110.003)
  • Credential Stuffing (T1110.004)
• Multi-Factor Authentication Interception (T1111) — Credential Access
• Modify Registry (T1112) — Defense Impairment, Persistence
• Screen Capture (T1113) — Collection
• Email Collection (T1114) — Collection
  • Local Email Collection (T1114.001)
  • Remote Email Collection (T1114.002)
  • Email Forwarding Rule (T1114.003)
• Clipboard Data (T1115) — Collection
• Automated Collection (T1119) — Collection
• Peripheral Device Discovery (T1120) — Discovery
• Audio Capture (T1123) — Collection
• System Time Discovery (T1124) — Discovery
• Video Capture (T1125) — Collection
• Trusted Developer Utilities Proxy Execution (T1127) — Stealth, Execution
  • MSBuild (T1127.001)
  • ClickOnce (T1127.002)
  • JamPlus (T1127.003)
• Shared Modules (T1129) — Execution
• Data Encoding (T1132) — Command and Control
  • Standard Encoding (T1132.001)
  • Non-Standard Encoding (T1132.002)
• External Remote Services (T1133) — Persistence, Initial Access
• Access Token Manipulation (T1134) — Stealth, Privilege Escalation
  • Token Impersonation/Theft (T1134.001)
  • Create Process with Token (T1134.002)
  • Make and Impersonate Token (T1134.003)
  • Parent PID Spoofing (T1134.004)
  • SID-History Injection (T1134.005)
• Network Share Discovery (T1135) — Discovery
• Create Account (T1136) — Persistence
  • Local Account (T1136.001)
  • Domain Account (T1136.002)
  • Cloud Account (T1136.003)
• Office Application Startup (T1137) — Persistence
  • Office Template Macros (T1137.001)
  • Office Test (T1137.002)
  • Outlook Forms (T1137.003)
  • Outlook Home Page (T1137.004)
  • Outlook Rules (T1137.005)
  • Add-ins (T1137.006)
• Deobfuscate/Decode Files or Information (T1140) — Stealth
• Software Extensions (T1176) — Persistence
  • Browser Extensions (T1176.001)
  • IDE Extensions (T1176.002)
• Browser Session Hijacking (T1185) — Collection
• Forced Authentication (T1187) — Credential Access
• Drive-by Compromise (T1189) — Initial Access
• Exploit Public-Facing Application (T1190) — Initial Access
• Supply Chain Compromise (T1195) — Initial Access
  • Compromise Software Dependencies and Development Tools (T1195.001)
  • Compromise Software Supply Chain (T1195.002)
  • Compromise Hardware Supply Chain (T1195.003)
• BITS Jobs (T1197) — Stealth, Persistence, Execution
• Trusted Relationship (T1199) — Initial Access
• Hardware Additions (T1200) — Initial Access
• Password Policy Discovery (T1201) — Discovery
• Indirect Command Execution (T1202) — Stealth
• Exploitation for Client Execution (T1203) — Execution
• User Execution (T1204) — Execution
  • Malicious Link (T1204.001)
  • Malicious File (T1204.002)
  • Malicious Image (T1204.003)
  • Malicious Copy and Paste (T1204.004)
  • Malicious Library (T1204.005)
• Traffic Signaling (T1205) — Stealth, Persistence, Command and Control
  • Port Knocking (T1205.001)
  • Socket Filters (T1205.002)
• Rogue Domain Controller (T1207) — Defense Impairment
• Exploitation of Remote Services (T1210) — Lateral Movement
• Exploitation for Stealth (T1211) — Stealth
• Exploitation for Credential Access (T1212) — Credential Access
• Data from Information Repositories (T1213) — Collection
  • Confluence (T1213.001)
  • Sharepoint (T1213.002)
  • Code Repositories (T1213.003)
  • Customer Relationship Management Software (T1213.004)
  • Messaging Applications (T1213.005)
  • Databases (T1213.006)
• System Script Proxy Execution (T1216) — Stealth
  • PubPrn (T1216.001)
  • SyncAppvPublishingServer (T1216.002)
• Browser Information Discovery (T1217) — Discovery
• System Binary Proxy Execution (T1218) — Stealth
  • Compiled HTML File (T1218.001)
  • Control Panel (T1218.002)
  • CMSTP (T1218.003)
  • InstallUtil (T1218.004)
  • Mshta (T1218.005)
  • Msiexec (T1218.007)
  • Odbcconf (T1218.008)
  • Regsvcs/Regasm (T1218.009)
  • Regsvr32 (T1218.010)
  • Rundll32 (T1218.011)
  • Verclsid (T1218.012)
  • Mavinject (T1218.013)
  • MMC (T1218.014)
  • Electron Applications (T1218.015)
• Remote Access Tools (T1219) — Command and Control
  • IDE Tunneling (T1219.001)
  • Remote Desktop Software (T1219.002)
  • Remote Access Hardware (T1219.003)
• XSL Script Processing (T1220) — Stealth
• Template Injection (T1221) — Stealth
• File and Directory Permissions Modification (T1222) — Defense Impairment
  • Windows Permissions (T1222.001)
  • Linux and Mac Permissions (T1222.002)
• Execution Guardrails (T1480) — Stealth
  • Environmental Keying (T1480.001)
  • Mutual Exclusion (T1480.002)
• Domain Trust Discovery (T1482) — Discovery
• Domain or Tenant Policy Modification (T1484) — Defense Impairment, Privilege Escalation
  • Group Policy Modification (T1484.001)
  • Trust Modification (T1484.002)
• Data Destruction (T1485) — Impact
  • Lifecycle-Triggered Deletion (T1485.001)
• Data Encrypted for Impact (T1486) — Impact
• Service Stop (T1489) — Impact
• Inhibit System Recovery (T1490) — Impact
• Defacement (T1491) — Impact
  • Internal Defacement (T1491.001)
  • External Defacement (T1491.002)
• Firmware Corruption (T1495) — Impact
• Resource Hijacking (T1496) — Impact
  • Compute Hijacking (T1496.001)
  • Bandwidth Hijacking (T1496.002)
  • SMS Pumping (T1496.003)
  • Cloud Service Hijacking (T1496.004)
• Virtualization/Sandbox Evasion (T1497) — Stealth, Discovery
  • System Checks (T1497.001)
  • User Activity Based Checks (T1497.002)
  • Time Based Checks (T1497.003)
• Network Denial of Service (T1498) — Impact
  • Direct Network Flood (T1498.001)
  • Reflection Amplification (T1498.002)
• Endpoint Denial of Service (T1499) — Impact
  • OS Exhaustion Flood (T1499.001)
  • Service Exhaustion Flood (T1499.002)
  • Application Exhaustion Flood (T1499.003)
  • Application or System Exploitation (T1499.004)
• Server Software Component (T1505) — Persistence
  • SQL Stored Procedures (T1505.001)
  • Transport Agent (T1505.002)
  • Web Shell (T1505.003)
  • IIS Components (T1505.004)
  • Terminal Services DLL (T1505.005)
  • vSphere Installation Bundles (T1505.006)
• Software Discovery (T1518) — Discovery
  • Security Software Discovery (T1518.001)
  • Backup Software Discovery (T1518.002)
• Implant Internal Image (T1525) — Persistence
• Cloud Service Discovery (T1526) — Discovery
• Steal Application Access Token (T1528) — Credential Access
• System Shutdown/Reboot (T1529) — Impact
• Data from Cloud Storage (T1530) — Collection
• Account Access Removal (T1531) — Impact
• Internal Spearphishing (T1534) — Lateral Movement
• Unused/Unsupported Cloud Regions (T1535) — Stealth
• Transfer Data to Cloud Account (T1537) — Exfiltration
• Cloud Service Dashboard (T1538) — Discovery
• Steal Web Session Cookie (T1539) — Credential Access
• Pre-OS Boot (T1542) — Stealth, Persistence
  • System Firmware (T1542.001)
  • Component Firmware (T1542.002)
  • Bootkit (T1542.003)
  • ROMMONkit (T1542.004)
  • TFTP Boot (T1542.005)
• Create or Modify System Process (T1543) — Persistence, Privilege Escalation
  • Launch Agent (T1543.001)
  • Systemd Service (T1543.002)
  • Windows Service (T1543.003)
  • Launch Daemon (T1543.004)
  • Container Service (T1543.005)
• Event Triggered Execution (T1546) — Privilege Escalation, Persistence
  • Change Default File Association (T1546.001)
  • Screensaver (T1546.002)
  • Windows Management Instrumentation Event Subscription (T1546.003)
  • Unix Shell Configuration Modification (T1546.004)
  • Trap (T1546.005)
  • LC_LOAD_DYLIB Addition (T1546.006)
  • Netsh Helper DLL (T1546.007)
  • Accessibility Features (T1546.008)
  • AppCert DLLs (T1546.009)
  • AppInit DLLs (T1546.010)
  • Application Shimming (T1546.011)
  • Image File Execution Options Injection (T1546.012)
  • PowerShell Profile (T1546.013)
  • Emond (T1546.014)
  • Component Object Model Hijacking (T1546.015)
  • Installer Packages (T1546.016)
  • Udev Rules (T1546.017)
  • Python Startup Hooks (T1546.018)
• Boot or Logon Autostart Execution (T1547) — Persistence, Privilege Escalation
  • Registry Run Keys / Startup Folder (T1547.001)
  • Authentication Package (T1547.002)
  • Time Providers (T1547.003)
  • Winlogon Helper DLL (T1547.004)
  • Security Support Provider (T1547.005)
  • Kernel Modules and Extensions (T1547.006)
  • Re-opened Applications (T1547.007)
  • LSASS Driver (T1547.008)
  • Shortcut Modification (T1547.009)
  • Port Monitors (T1547.010)
  • Print Processors (T1547.012)
  • XDG Autostart Entries (T1547.013)
  • Active Setup (T1547.014)
  • Login Items (T1547.015)
• Abuse Elevation Control Mechanism (T1548) — Privilege Escalation
  • Setuid and Setgid (T1548.001)
  • Bypass User Account Control (T1548.002)
  • Sudo and Sudo Caching (T1548.003)
  • Elevated Execution with Prompt (T1548.004)
  • Temporary Elevated Cloud Access (T1548.005)
  • TCC Manipulation (T1548.006)
• Use Alternate Authentication Material (T1550) — Lateral Movement
  • Application Access Token (T1550.001)
  • Pass the Hash (T1550.002)
  • Pass the Ticket (T1550.003)
  • Web Session Cookie (T1550.004)
• Unsecured Credentials (T1552) — Credential Access
  • Credentials In Files (T1552.001)
  • Credentials in Registry (T1552.002)
  • Shell History (T1552.003)
  • Private Keys (T1552.004)
  • Cloud Instance Metadata API (T1552.005)
  • Group Policy Preferences (T1552.006)
  • Container API (T1552.007)
  • Chat Messages (T1552.008)
• Subvert Trust Controls (T1553) — Defense Impairment
  • Gatekeeper Bypass (T1553.001)
  • Code Signing (T1553.002)
  • SIP and Trust Provider Hijacking (T1553.003)
  • Install Root Certificate (T1553.004)
  • Mark-of-the-Web Bypass (T1553.005)
  • Code Signing Policy Modification (T1553.006)
• Compromise Host Software Binary (T1554) — Persistence
• Credentials from Password Stores (T1555) — Credential Access
  • Keychain (T1555.001)
  • Securityd Memory (T1555.002)
  • Credentials from Web Browsers (T1555.003)
  • Windows Credential Manager (T1555.004)
  • Password Managers (T1555.005)
  • Cloud Secrets Management Stores (T1555.006)
• Modify Authentication Process (T1556) — Defense Impairment, Persistence, Credential Access
  • Domain Controller Authentication (T1556.001)
  • Password Filter DLL (T1556.002)
  • Pluggable Authentication Modules (T1556.003)
  • Network Device Authentication (T1556.004)
  • Reversible Encryption (T1556.005)
  • Multi-Factor Authentication (T1556.006)
  • Hybrid Identity (T1556.007)
  • Network Provider DLL (T1556.008)
  • Conditional Access Policies (T1556.009)
• Adversary-in-the-Middle (T1557) — Credential Access, Collection
  • Name Resolution Poisoning and SMB Relay (T1557.001)
  • ARP Cache Poisoning (T1557.002)
  • DHCP Spoofing (T1557.003)
  • Evil Twin (T1557.004)
• Steal or Forge Kerberos Tickets (T1558) — Credential Access
  • Golden Ticket (T1558.001)
  • Silver Ticket (T1558.002)
  • Kerberoasting (T1558.003)
  • AS-REP Roasting (T1558.004)
  • Ccache Files (T1558.005)
• Inter-Process Communication (T1559) — Execution
  • Component Object Model (T1559.001)
  • Dynamic Data Exchange (T1559.002)
  • XPC Services (T1559.003)
• Archive Collected Data (T1560) — Collection
  • Archive via Utility (T1560.001)
  • Archive via Library (T1560.002)
  • Archive via Custom Method (T1560.003)
• Disk Wipe (T1561) — Impact
  • Disk Content Wipe (T1561.001)
  • Disk Structure Wipe (T1561.002)
• Remote Service Session Hijacking (T1563) — Lateral Movement
  • SSH Hijacking (T1563.001)
  • RDP Hijacking (T1563.002)
• Hide Artifacts (T1564) — Stealth
  • Hidden Files and Directories (T1564.001)
  • Hidden Users (T1564.002)
  • Hidden Window (T1564.003)
  • NTFS File Attributes (T1564.004)
  • Hidden File System (T1564.005)
  • Run Virtual Instance (T1564.006)
  • VBA Stomping (T1564.007)
  • Email Hiding Rules (T1564.008)
  • Resource Forking (T1564.009)
  • Process Argument Spoofing (T1564.010)
  • Ignore Process Interrupts (T1564.011)
  • File/Path Exclusions (T1564.012)
  • Bind Mounts (T1564.013)
  • Extended Attributes (T1564.014)
• Data Manipulation (T1565) — Impact
  • Stored Data Manipulation (T1565.001)
  • Transmitted Data Manipulation (T1565.002)
  • Runtime Data Manipulation (T1565.003)
• Phishing (T1566) — Initial Access
  • Spearphishing Attachment (T1566.001)
  • Spearphishing Link (T1566.002)
  • Spearphishing via Service (T1566.003)
  • Spearphishing Voice (T1566.004)
• Exfiltration Over Web Service (T1567) — Exfiltration
  • Exfiltration to Code Repository (T1567.001)
  • Exfiltration to Cloud Storage (T1567.002)
  • Exfiltration to Text Storage Sites (T1567.003)
  • Exfiltration Over Webhook (T1567.004)
• Dynamic Resolution (T1568) — Command and Control
  • Fast Flux DNS (T1568.001)
  • Domain Generation Algorithms (T1568.002)
  • DNS Calculation (T1568.003)
• System Services (T1569) — Execution
  • Launchctl (T1569.001)
  • Service Execution (T1569.002)
  • Systemctl (T1569.003)
• Lateral Tool Transfer (T1570) — Lateral Movement
• Non-Standard Port (T1571) — Command and Control
• Protocol Tunneling (T1572) — Command and Control
• Encrypted Channel (T1573) — Command and Control
  • Symmetric Cryptography (T1573.001)
  • Asymmetric Cryptography (T1573.002)
• Hijack Execution Flow (T1574) — Stealth, Execution
  • DLL (T1574.001)
  • Dylib Hijacking (T1574.004)
  • Executable Installer File Permissions Weakness (T1574.005)
  • Dynamic Linker Hijacking (T1574.006)
  • Path Interception by PATH Environment Variable (T1574.007)
  • Path Interception by Search Order Hijacking (T1574.008)
  • Path Interception by Unquoted Path (T1574.009)
  • Services File Permissions Weakness (T1574.010)
  • Services Registry Permissions Weakness (T1574.011)
  • COR_PROFILER (T1574.012)
  • KernelCallbackTable (T1574.013)
  • AppDomainManager (T1574.014)
• Modify Cloud Compute Infrastructure (T1578) — Defense Impairment
  • Create Snapshot (T1578.001)
  • Create Cloud Instance (T1578.002)
  • Delete Cloud Instance (T1578.003)
  • Revert Cloud Instance (T1578.004)
  • Modify Cloud Compute Configurations (T1578.005)
• Cloud Infrastructure Discovery (T1580) — Discovery
• Acquire Infrastructure (T1583) — Resource Development
  • Domains (T1583.001)
  • DNS Server (T1583.002)
  • Virtual Private Server (T1583.003)
  • Server (T1583.004)
  • Botnet (T1583.005)
  • Web Services (T1583.006)
  • Serverless (T1583.007)
  • Malvertising (T1583.008)
• Compromise Infrastructure (T1584) — Resource Development
  • Domains (T1584.001)
  • DNS Server (T1584.002)
  • Virtual Private Server (T1584.003)
  • Server (T1584.004)
  • Botnet (T1584.005)
  • Web Services (T1584.006)
  • Serverless (T1584.007)
  • Network Devices (T1584.008)
• Establish Accounts (T1585) — Resource Development
  • Social Media Accounts (T1585.001)
  • Email Accounts (T1585.002)
  • Cloud Accounts (T1585.003)
• Compromise Accounts (T1586) — Resource Development
  • Social Media Accounts (T1586.001)
  • Email Accounts (T1586.002)
  • Cloud Accounts (T1586.003)
• Develop Capabilities (T1587) — Resource Development
  • Malware (T1587.001)
  • Code Signing Certificates (T1587.002)
  • Digital Certificates (T1587.003)
  • Exploits (T1587.004)
• Obtain Capabilities (T1588) — Resource Development
  • Malware (T1588.001)
  • Tool (T1588.002)
  • Code Signing Certificates (T1588.003)
  • Digital Certificates (T1588.004)
  • Exploits (T1588.005)
  • Vulnerabilities (T1588.006)
  • Artificial Intelligence (T1588.007)
• Gather Victim Identity Information (T1589) — Reconnaissance
  • Credentials (T1589.001)
  • Email Addresses (T1589.002)
  • Employee Names (T1589.003)
• Gather Victim Network Information (T1590) — Reconnaissance
  • Domain Properties (T1590.001)
  • DNS (T1590.002)
  • Network Trust Dependencies (T1590.003)
  • Network Topology (T1590.004)
  • IP Addresses (T1590.005)
  • Network Security Appliances (T1590.006)
• Gather Victim Org Information (T1591) — Reconnaissance
  • Determine Physical Locations (T1591.001)
  • Business Relationships (T1591.002)
  • Identify Business Tempo (T1591.003)
  • Identify Roles (T1591.004)
• Gather Victim Host Information (T1592) — Reconnaissance
  • Hardware (T1592.001)
  • Software (T1592.002)
  • Firmware (T1592.003)
  • Client Configurations (T1592.004)
• Search Open Websites/Domains (T1593) — Reconnaissance
  • Social Media (T1593.001)
  • Search Engines (T1593.002)
  • Code Repositories (T1593.003)
• Search Victim-Owned Websites (T1594) — Reconnaissance
• Active Scanning (T1595) — Reconnaissance
  • Scanning IP Blocks (T1595.001)
  • Vulnerability Scanning (T1595.002)
  • Wordlist Scanning (T1595.003)
• Search Open Technical Databases (T1596) — Reconnaissance
  • DNS/Passive DNS (T1596.001)
  • WHOIS (T1596.002)
  • Digital Certificates (T1596.003)
  • CDNs (T1596.004)
  • Scan Databases (T1596.005)
• Search Closed Sources (T1597) — Reconnaissance
  • Threat Intel Vendors (T1597.001)
  • Purchase Technical Data (T1597.002)
• Phishing for Information (T1598) — Reconnaissance
  • Spearphishing Service (T1598.001)
  • Spearphishing Attachment (T1598.002)
  • Spearphishing Link (T1598.003)
  • Spearphishing Voice (T1598.004)
• Network Boundary Bridging (T1599) — Defense Impairment
  • Network Address Translation Traversal (T1599.001)
• Weaken Encryption (T1600) — Defense Impairment
  • Reduce Key Space (T1600.001)
  • Disable Crypto Hardware (T1600.002)
• Modify System Image (T1601) — Defense Impairment
  • Patch System Image (T1601.001)
  • Downgrade System Image (T1601.002)
• Data from Configuration Repository (T1602) — Collection
  • SNMP (MIB Dump) (T1602.001)
  • Network Device Configuration Dump (T1602.002)
• Forge Web Credentials (T1606) — Credential Access
  • Web Cookies (T1606.001)
  • SAML Tokens (T1606.002)
• Stage Capabilities (T1608) — Resource Development
  • Upload Malware (T1608.001)
  • Upload Tool (T1608.002)
  • Install Digital Certificate (T1608.003)
  • Drive-by Target (T1608.004)
  • Link Target (T1608.005)
  • SEO Poisoning (T1608.006)
• Container Administration Command (T1609) — Execution
• Deploy Container (T1610) — Execution
• Escape to Host (T1611) — Privilege Escalation
• Build Image on Host (T1612) — Stealth
• Container and Resource Discovery (T1613) — Discovery
• System Location Discovery (T1614) — Discovery
  • System Language Discovery (T1614.001)
• Group Policy Discovery (T1615) — Discovery
• Cloud Storage Object Discovery (T1619) — Discovery
• Reflective Code Loading (T1620) — Stealth
• Multi-Factor Authentication Request Generation (T1621) — Credential Access
• Debugger Evasion (T1622) — Stealth, Discovery
• Plist File Modification (T1647) — Defense Impairment
• Serverless Execution (T1648) — Execution
• Steal or Forge Authentication Certificates (T1649) — Credential Access
• Acquire Access (T1650) — Resource Development
• Cloud Administration Command (T1651) — Execution
• Device Driver Discovery (T1652) — Discovery
• Power Settings (T1653) — Persistence
• Log Enumeration (T1654) — Discovery
• Financial Theft (T1657) — Impact
• Content Injection (T1659) — Initial Access, Command and Control
• Hide Infrastructure (T1665) — Command and Control
• Modify Cloud Resource Hierarchy (T1666) — Defense Impairment
• Email Bombing (T1667) — Impact
• Exclusive Control (T1668) — Persistence
• Wi-Fi Networks (T1669) — Initial Access
• Cloud Application Integration (T1671) — Persistence
• Virtual Machine Discovery (T1673) — Discovery
• Input Injection (T1674) — Execution
• ESXi Administration Command (T1675) — Execution
• Poisoned Pipeline Execution (T1677) — Execution
• Delay Execution (T1678) — Stealth
• Selective Exclusion (T1679) — Stealth
• Local Storage Discovery (T1680) — Discovery
• Search Threat Vendor Data (T1681) — Reconnaissance
• Query Public AI Services (T1682) — Reconnaissance
• Generate Content (T1683) — Resource Development
  • Written Content (T1683.001)
  • Audio-Visual Content (T1683.002)
• Social Engineering (T1684) — Stealth
  • Impersonation (T1684.001)
  • Email Spoofing (T1684.002)
• Disable or Modify Tools (T1685) — Defense Impairment
  • Disable or Modify Windows Event Log (T1685.001)
  • Disable or Modify Cloud Log (T1685.002)
  • Modify or Spoof Tool UI (T1685.003)
  • Disable or Modify Linux Audit System Log (T1685.004)
  • Clear Windows Event Logs (T1685.005)
  • Clear Linux or Mac System Logs (T1685.006)
• Disable or Modify System Firewall (T1686) — Defense Impairment
  • Cloud Firewall (T1686.001)
  • Network Device Firewall (T1686.002)
  • Windows Host Firewall (T1686.003)
• Exploitation for Defense Impairment (T1687) — Defense Impairment
• Safe Mode Boot (T1688) — Defense Impairment
• Downgrade Attack (T1689) — Defense Impairment
• Prevent Command History Logging (T1690) — Defense Impairment

Explore

• Interactive ATT&CK matrix
• Guide
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan