ATT&CK coverage

Where the indexed rules land on the MITRE ATT&CK Enterprise matrix. Tiles are shaded by detection count; click one to see the rules.

fewer more

559techniques 15/ 15 tactics 46934rules in matrix 15unattributed

Reconnaissance TA0043

20 tech 125 rules

T1589 3 Gather Victim Identity Information

T1589.001 3 Credentials

T1589.002 2 Email Addresses

T1590 9 Gather Victim Network Information

T1590.001 2 Domain Properties

T1590.002 2 DNS

T1590.005 4 IP Addresses

T1591.004 2 Identify Roles

T1592 4 Gather Victim Host Information

T1592.001 2 Hardware

T1592.002 1 Software

T1592.004 4 Client Configurations

T1593 3 Search Open Websites/Domains

T1593.003 2 Code Repositories

T1595 36 Active Scanning

T1595.001 11 Scanning IP Blocks

T1595.002 16 Vulnerability Scanning

T1595.003 12 Wordlist Scanning

T1598 5 Phishing for Information

T1598.002 2 Spearphishing Attachment

Resource Development TA0042

23 tech 265 rules

T1583 4 Acquire Infrastructure

T1583.001 1 Domains

T1583.006 1 Web Services

T1584 10 Compromise Infrastructure

T1584.001 3 Domains

T1584.002 3 DNS Server

T1585 1 Establish Accounts

T1586 8 Compromise Accounts

T1586.003 36 Cloud Accounts

T1587 133 Develop Capabilities

T1587.001 16 Malware

T1587.002 1 Code Signing Certificates

T1587.003 1 Digital Certificates

T1587.004 4 Exploits

T1588 6 Obtain Capabilities

T1588.001 6 Malware

T1588.002 12 Tool

T1588.003 1 Code Signing Certificates

T1588.004 1 Digital Certificates

T1608 12 Stage Capabilities

T1608.001 3 Upload Malware

T1608.002 1 Upload Tool

T1608.003 1 Install Digital Certificate

Initial Access TA0001

20 tech 10875 rules

T1078 538 Valid Accounts

T1078.001 13 Default Accounts

T1078.002 35 Domain Accounts

T1078.003 25 Local Accounts

T1078.004 283 Cloud Accounts

T1091 11 Replication Through Removable Media

T1133 108 External Remote Services

T1189 166 Drive-by Compromise

T1190 7415 Exploit Public-Facing Application

T1195 70 Supply Chain Compromise

T1195.001 22 Compromise Software Dependencies and Development Tools

T1195.002 63 Compromise Software Supply Chain

T1199 14 Trusted Relationship

T1200 15 Hardware Additions

T1566 1843 Phishing

T1566.001 163 Spearphishing Attachment

T1193→ T1566.001 6 Spearphishing Attachment

T1566.002 79 Spearphishing Link

T1192→ T1566.002 4 Spearphishing Link

T1566.003 2 Spearphishing via Service

Execution TA0002

64 tech 4580 rules

T1047 168 Windows Management Instrumentation

T1053 117 Scheduled Task/Job

T1168→ T1053 1 Local Job Scheduling

T1053.002 19 At

T1053.003 48 Cron

T1053.005 120 Scheduled Task

T1053.006 11 Systemd Timers

T1053.007 4 Container Orchestration Job

T1059 1014 Command and Scripting Interpreter

T1059.001 521 PowerShell

T1086→ T1059.001 48 PowerShell

T1059.002 49 AppleScript

T1059.003 143 Windows Command Shell

T1059.004 369 Unix Shell

T1059.005 109 Visual Basic

T1059.006 97 Python

T1059.007 153 JavaScript

T1059.009 6 Cloud API

T1059.010 1 AutoHotKey & AutoIT

T1059.011 15 Lua

T1059.012 9 Hypervisor CLI

T1059.013 1 Container CLI/API

T1072 34 Software Deployment Tools

T1106 61 Native API

T1127 59 Trusted Developer Utilities Proxy Execution

T1127.001 22 MSBuild

T1129 30 Shared Modules

T1197 35 BITS Jobs

T1203 129 Exploitation for Client Execution

T1204 228 User Execution

T1204.001 31 Malicious Link

T1204.002 178 Malicious File

T1204.003 13 Malicious Image

T1204.004 11 Malicious Copy and Paste

T1204.005 1 Malicious Library

T1559 31 Inter-Process Communication

T1559.001 21 Component Object Model

T1559.002 1 Dynamic Data Exchange

T1173→ T1559.002 1 Dynamic Data Exchange

T1559.003 4 XPC Services

T1569 30 System Services

T1569.001 4 Launchctl

T1569.002 76 Service Execution

T1035→ T1569.002 7 Service Execution

T1574 177 Hijack Execution Flow

T1574.001 170 DLL

T1038→ T1574.001 10 DLL Search Order Hijacking

T1073→ T1574.001 8 DLL Side-Loading

T1574.002→ T1574.001 5 DLL Side-Loading

T1574.005 2 Executable Installer File Permissions Weakness

T1574.006 30 Dynamic Linker Hijacking

T1574.007 11 Path Interception by PATH Environment Variable

T1574.008 4 Path Interception by Search Order Hijacking

T1574.009 3 Path Interception by Unquoted Path

T1574.010 3 Services File Permissions Weakness

T1044→ T1574.010 3 File System Permissions Weakness

T1574.011 18 Services Registry Permissions Weakness

T1574.012 2 COR_PROFILER

T1574.013 2 KernelCallbackTable

T1574.014 1 AppDomainManager

T1609 35 Container Administration Command

T1610 38 Deploy Container

T1648 11 Serverless Execution

T1651 17 Cloud Administration Command

Persistence TA0003

116 tech 4249 rules

T1037 46 Boot or Logon Initialization Scripts

T1037.001 5 Logon Script (Windows)

T1037.002 3 Login Hook

T1037.004 13 RC Scripts

T1037.005 3 Startup Items

T1053 117 Scheduled Task/Job

T1168→ T1053 1 Local Job Scheduling

T1053.002 19 At

T1053.003 48 Cron

T1053.005 120 Scheduled Task

T1053.006 11 Systemd Timers

T1053.007 4 Container Orchestration Job

T1078 538 Valid Accounts

T1078.001 13 Default Accounts

T1078.002 35 Domain Accounts

T1078.003 25 Local Accounts

T1078.004 283 Cloud Accounts

T1098 388 Account Manipulation

T1098.001 55 Additional Cloud Credentials

T1098.002 10 Additional Email Delegate Permissions

T1098.003 92 Additional Cloud Roles

T1098.004 16 SSH Authorized Keys

T1098.005 26 Device Registration

T1098.006 23 Additional Container Cluster Roles

T1098.007 11 Additional Local or Domain Groups

T1112 334 Modify Registry

T1133 108 External Remote Services

T1136 92 Create Account

T1136.001 55 Local Account

T1136.002 17 Domain Account

T1136.003 51 Cloud Account

T1137 52 Office Application Startup

T1137.001 2 Office Template Macros

T1137.002 3 Office Test

T1137.003 1 Outlook Forms

T1137.004 2 Outlook Home Page

T1137.005 3 Outlook Rules

T1137.006 15 Add-ins

T1176 31 Software Extensions

T1176.001 10 Browser Extensions

T1197 35 BITS Jobs

T1205 6 Traffic Signaling

T1205.001 6 Port Knocking

T1505 89 Server Software Component

T1505.001 11 SQL Stored Procedures

T1505.002 4 Transport Agent

T1505.003 95 Web Shell

T1100→ T1505.003 7 Web Shell

T1505.004 16 IIS Components

T1505.005 1 Terminal Services DLL

T1505.006 1 vSphere Installation Bundles

T1525 5 Implant Internal Image

T1542 11 Pre-OS Boot

T1542.001 7 System Firmware

T1542.003 5 Bootkit

T1067→ T1542.003 1 Bootkit

T1542.005 1 TFTP Boot

T1543 155 Create or Modify System Process

T1543.001 15 Launch Agent

T1543.002 23 Systemd Service

T1543.003 120 Windows Service

T1031→ T1543.003 4 Modify Existing Service

T1050→ T1543.003 4 New Service

T1543.004 16 Launch Daemon

T1543.005 2 Container Service

T1546 164 Event Triggered Execution

T1546.001 10 Change Default File Association

T1546.002 9 Screensaver

T1546.003 22 Windows Management Instrumentation Event Subscription

T1084→ T1546.003 2 Windows Management Instrumentation Event Subscription

T1546.004 19 Unix Shell Configuration Modification

T1546.005 4 Trap

T1546.007 5 Netsh Helper DLL

T1546.008 9 Accessibility Features

T1015→ T1546.008 4 Accessibility Features

T1546.009 5 AppCert DLLs

T1546.010 3 AppInit DLLs

T1103→ T1546.010 3 AppInit DLLs

T1546.011 14 Application Shimming

T1138→ T1546.011 1 Application Shimming

T1546.012 10 Image File Execution Options Injection

T1183→ T1546.012 2 Image File Execution Options Injection

T1546.013 5 PowerShell Profile

T1546.014 4 Emond

T1546.015 24 Component Object Model Hijacking

T1122→ T1546.015 1 Component Object Model Hijacking

T1546.016 15 Installer Packages

T1546.017 3 Udev Rules

T1546.018 2 Python Startup Hooks

T1547 153 Boot or Logon Autostart Execution

T1547.001 103 Registry Run Keys / Startup Folder

T1060→ T1547.001 18 Registry Run Keys / Startup Folder

T1547.002 4 Authentication Package

T1547.003 3 Time Providers

T1547.004 5 Winlogon Helper DLL

T1547.005 7 Security Support Provider

T1547.006 42 Kernel Modules and Extensions

T1215→ T1547.006 1 Kernel Modules and Extensions

T1547.008 3 LSASS Driver

T1177→ T1547.008 1 LSASS Driver

T1547.009 8 Shortcut Modification

T1547.010 7 Port Monitors

T1547.012 11 Print Processors

T1547.013 5 XDG Autostart Entries

T1547.014 5 Active Setup

T1547.015 2 Login Items

T1554 27 Compromise Host Software Binary

T1556 110 Modify Authentication Process

T1556.002 6 Password Filter DLL

T1556.003 10 Pluggable Authentication Modules

T1556.004 2 Network Device Authentication

T1556.006 35 Multi-Factor Authentication

T1556.007 4 Hybrid Identity

T1556.008 1 Network Provider DLL

T1556.009 14 Conditional Access Policies

T1653 1 Power Settings

Privilege Escalation TA0004

106 tech 4515 rules

T1037 46 Boot or Logon Initialization Scripts

T1037.001 5 Logon Script (Windows)

T1037.002 3 Login Hook

T1037.004 13 RC Scripts

T1037.005 3 Startup Items

T1053 117 Scheduled Task/Job

T1168→ T1053 1 Local Job Scheduling

T1053.002 19 At

T1053.003 48 Cron

T1053.005 120 Scheduled Task

T1053.006 11 Systemd Timers

T1053.007 4 Container Orchestration Job

T1055 335 Process Injection

T1055.001 14 Dynamic-link Library Injection

T1055.002 5 Portable Executable Injection

T1055.003 5 Thread Execution Hijacking

T1055.004 4 Asynchronous Procedure Call

T1055.008 6 Ptrace System Calls

T1055.009 15 Proc Memory

T1055.011 1 Extra Window Memory Injection

T1055.012 12 Process Hollowing

T1093→ T1055.012 1 Process Hollowing

T1055.013 3 Process Doppelgänging

T1068 228 Exploitation for Privilege Escalation

T1078 538 Valid Accounts

T1078.001 13 Default Accounts

T1078.002 35 Domain Accounts

T1078.003 25 Local Accounts

T1078.004 283 Cloud Accounts

T1098 388 Account Manipulation

T1098.001 55 Additional Cloud Credentials

T1098.002 10 Additional Email Delegate Permissions

T1098.003 92 Additional Cloud Roles

T1098.004 16 SSH Authorized Keys

T1098.005 26 Device Registration

T1098.006 23 Additional Container Cluster Roles

T1098.007 11 Additional Local or Domain Groups

T1134 70 Access Token Manipulation

T1134.001 29 Token Impersonation/Theft

T1134.002 31 Create Process with Token

T1134.003 6 Make and Impersonate Token

T1134.004 12 Parent PID Spoofing

T1502→ T1134.004 1 Parent PID Spoofing

T1134.005 5 SID-History Injection

T1178→ T1134.005 1 SID-History Injection

T1484 162 Domain or Tenant Policy Modification

T1484.001 28 Group Policy Modification

T1484.002 17 Trust Modification

T1543 155 Create or Modify System Process

T1543.001 15 Launch Agent

T1543.002 23 Systemd Service

T1543.003 120 Windows Service

T1031→ T1543.003 4 Modify Existing Service

T1050→ T1543.003 4 New Service

T1543.004 16 Launch Daemon

T1543.005 2 Container Service

T1546 164 Event Triggered Execution

T1546.001 10 Change Default File Association

T1546.002 9 Screensaver

T1546.003 22 Windows Management Instrumentation Event Subscription

T1084→ T1546.003 2 Windows Management Instrumentation Event Subscription

T1546.004 19 Unix Shell Configuration Modification

T1546.005 4 Trap

T1546.007 5 Netsh Helper DLL

T1546.008 9 Accessibility Features

T1015→ T1546.008 4 Accessibility Features

T1546.009 5 AppCert DLLs

T1546.010 3 AppInit DLLs

T1103→ T1546.010 3 AppInit DLLs

T1546.011 14 Application Shimming

T1138→ T1546.011 1 Application Shimming

T1546.012 10 Image File Execution Options Injection

T1183→ T1546.012 2 Image File Execution Options Injection

T1546.013 5 PowerShell Profile

T1546.014 4 Emond

T1546.015 24 Component Object Model Hijacking

T1122→ T1546.015 1 Component Object Model Hijacking

T1546.016 15 Installer Packages

T1546.017 3 Udev Rules

T1546.018 2 Python Startup Hooks

T1547 153 Boot or Logon Autostart Execution

T1547.001 103 Registry Run Keys / Startup Folder

T1060→ T1547.001 18 Registry Run Keys / Startup Folder

T1547.002 4 Authentication Package

T1547.003 3 Time Providers

T1547.004 5 Winlogon Helper DLL

T1547.005 7 Security Support Provider

T1547.006 42 Kernel Modules and Extensions

T1215→ T1547.006 1 Kernel Modules and Extensions

T1547.008 3 LSASS Driver

T1177→ T1547.008 1 LSASS Driver

T1547.009 8 Shortcut Modification

T1547.010 7 Port Monitors

T1547.012 11 Print Processors

T1547.013 5 XDG Autostart Entries

T1547.014 5 Active Setup

T1547.015 2 Login Items

T1548 207 Abuse Elevation Control Mechanism

T1548.001 54 Setuid and Setgid

T1548.002 127 Bypass User Account Control

T1088→ T1548.002 7 Bypass User Account Control

T1548.003 79 Sudo and Sudo Caching

T1548.004 3 Elevated Execution with Prompt

T1548.005 7 Temporary Elevated Cloud Access

T1548.006 7 TCC Manipulation

T1611 71 Escape to Host

Stealth TA0005

134 tech 5349 rules

T1006 11 Direct Volume Access

T1014 46 Rootkit

T1027 923 Obfuscated Files or Information

T1027.001 10 Binary Padding

T1027.002 5 Software Packing

T1045→ T1027.002 3 Software Packing

T1027.003 5 Steganography

T1027.004 15 Compile After Delivery

T1500→ T1027.004 2 Compile After Delivery

T1027.005 7 Indicator Removal from Tools

T1066→ T1027.005 1 Indicator Removal from Tools

T1027.006 2 HTML Smuggling

T1027.007 1 Dynamic API Resolution

T1027.009 3 Embedded Payloads

T1027.010 38 Command Obfuscation

T1027.011 5 Fileless Storage

T1027.012 2 LNK Icon Smuggling

T1027.013 9 Encrypted/Encoded File

T1027.015 2 Compression

T1036 236 Masquerading

T1036.001 12 Invalid Code Signature

T1036.002 9 Right-to-Left Override

T1036.003 58 Rename Legitimate Utilities

T1036.004 18 Masquerade Task or Service

T1036.005 60 Match Legitimate Resource Name or Location

T1036.006 3 Space after Filename

T1036.007 6 Double File Extension

T1036.008 5 Masquerade File Type

T1036.009 7 Break Process Trees

T1055 335 Process Injection

T1055.001 14 Dynamic-link Library Injection

T1055.002 5 Portable Executable Injection

T1055.003 5 Thread Execution Hijacking

T1055.004 4 Asynchronous Procedure Call

T1055.008 6 Ptrace System Calls

T1055.009 15 Proc Memory

T1055.011 1 Extra Window Memory Injection

T1055.012 12 Process Hollowing

T1093→ T1055.012 1 Process Hollowing

T1055.013 3 Process Doppelgänging

T1070 132 Indicator Removal

T1070.003 25 Clear Command History

T1070.004 84 File Deletion

T1107→ T1070.004 6 File Deletion

T1070.005 5 Network Share Connection Removal

T1070.006 19 Timestomp

T1099→ T1070.006 2 Timestomp

T1070.008 13 Clear Mailbox Data

T1070.009 2 Clear Persistence

T1078 538 Valid Accounts

T1078.001 13 Default Accounts

T1078.002 35 Domain Accounts

T1078.003 25 Local Accounts

T1078.004 283 Cloud Accounts

T1127 59 Trusted Developer Utilities Proxy Execution

T1127.001 22 MSBuild

T1134 70 Access Token Manipulation

T1134.001 29 Token Impersonation/Theft

T1134.002 31 Create Process with Token

T1134.003 6 Make and Impersonate Token

T1134.004 12 Parent PID Spoofing

T1502→ T1134.004 1 Parent PID Spoofing

T1134.005 5 SID-History Injection

T1178→ T1134.005 1 SID-History Injection

T1140 104 Deobfuscate/Decode Files or Information

T1197 35 BITS Jobs

T1202 71 Indirect Command Execution

T1205 6 Traffic Signaling

T1205.001 6 Port Knocking

T1211 19 Exploitation for Stealth

T1216 23 System Script Proxy Execution

T1216.001 3 PubPrn

T1218 446 System Binary Proxy Execution

T1218.001 19 Compiled HTML File

T1223→ T1218.001 1 Compiled HTML File

T1218.002 9 Control Panel

T1196→ T1218.002 1 Control Panel Items

T1218.003 25 CMSTP

T1191→ T1218.003 2 CMSTP

T1218.004 21 InstallUtil

T1118→ T1218.004 3 InstallUtil

T1218.005 78 Mshta

T1170→ T1218.005 6 Mshta

T1218.007 50 Msiexec

T1218.008 18 Odbcconf

T1218.009 22 Regsvcs/Regasm

T1121→ T1218.009 1 Regsvcs/Regasm

T1218.010 70 Regsvr32

T1117→ T1218.010 3 Regsvr32

T1218.011 122 Rundll32

T1085→ T1218.011 6 Rundll32

T1218.012 3 Verclsid

T1218.013 3 Mavinject

T1218.014 15 MMC

T1220 20 XSL Script Processing

T1221 4 Template Injection

T1480 1 Execution Guardrails

T1497 23 Virtualization/Sandbox Evasion

T1497.001 11 System Checks

T1497.003 5 Time Based Checks

T1535 10 Unused/Unsupported Cloud Regions

T1542 11 Pre-OS Boot

T1542.001 7 System Firmware

T1542.003 5 Bootkit

T1067→ T1542.003 1 Bootkit

T1542.005 1 TFTP Boot

T1564 109 Hide Artifacts

T1564.001 46 Hidden Files and Directories

T1158→ T1564.001 4 Hidden Files and Directories

T1564.002 10 Hidden Users

T1564.003 17 Hidden Window

T1564.004 30 NTFS File Attributes

T1096→ T1564.004 4 NTFS File Attributes

T1564.006 6 Run Virtual Instance

T1564.008 9 Email Hiding Rules

T1574 177 Hijack Execution Flow

T1574.001 170 DLL

T1038→ T1574.001 10 DLL Search Order Hijacking

T1073→ T1574.001 8 DLL Side-Loading

T1574.002→ T1574.001 5 DLL Side-Loading

T1574.005 2 Executable Installer File Permissions Weakness

T1574.006 30 Dynamic Linker Hijacking

T1574.007 11 Path Interception by PATH Environment Variable

T1574.008 4 Path Interception by Search Order Hijacking

T1574.009 3 Path Interception by Unquoted Path

T1574.010 3 Services File Permissions Weakness

T1044→ T1574.010 3 File System Permissions Weakness

T1574.011 18 Services Registry Permissions Weakness

T1574.012 2 COR_PROFILER

T1574.013 2 KernelCallbackTable

T1574.014 1 AppDomainManager

T1620 47 Reflective Code Loading

T1622 4 Debugger Evasion

T1656→ T1684.001 1 Impersonation

Defense Impairment TA0112

65 tech 2198 rules

T1112 334 Modify Registry

T1207 14 Rogue Domain Controller

T1222 48 File and Directory Permissions Modification

T1222.001 25 Windows Permissions

T1222.002 33 Linux and Mac Permissions

T1484 162 Domain or Tenant Policy Modification

T1484.001 28 Group Policy Modification

T1484.002 17 Trust Modification

T1553 37 Subvert Trust Controls

T1553.001 12 Gatekeeper Bypass

T1553.002 5 Code Signing

T1553.003 6 SIP and Trust Provider Hijacking

T1553.004 19 Install Root Certificate

T1130→ T1553.004 4 Install Root Certificate

T1553.005 14 Mark-of-the-Web Bypass

T1553.006 2 Code Signing Policy Modification

T1556 110 Modify Authentication Process

T1556.002 6 Password Filter DLL

T1556.003 10 Pluggable Authentication Modules

T1556.004 2 Network Device Authentication

T1556.006 35 Multi-Factor Authentication

T1556.007 4 Hybrid Identity

T1556.008 1 Network Provider DLL

T1556.009 14 Conditional Access Policies

T1578 24 Modify Cloud Compute Infrastructure

T1578.002 6 Create Cloud Instance

T1578.003 1 Delete Cloud Instance

T1578.004 1 Revert Cloud Instance

T1578.005 19 Modify Cloud Compute Configurations

T1599 4 Network Boundary Bridging

T1599.001 1 Network Address Translation Traversal

T1600 1 Weaken Encryption

T1600.001 2 Reduce Key Space

T1601 1 Modify System Image

T1601.001 2 Patch System Image

T1647 11 Plist File Modification

T1547.011→ T1647 3 Plist Modification

T1666 1 Modify Cloud Resource Hierarchy

T1685 282 Disable or Modify Tools

T1054→ T1685 2 Indicator Blocking

T1089→ T1685 10 Disabling Security Tools

T1562→ T1685 350 Impair Defenses

T1562.001→ T1685 208 Disable or Modify Tools

T1562.006→ T1685 13 Indicator Blocking

T1685.001 40 Disable or Modify Windows Event Log

T1562.002→ T1685.001 5 Disable Windows Event Logging

T1685.002 22 Disable or Modify Cloud Log

T1562.008→ T1685.002 60 Disable or Modify Cloud Logs

T1685.004 4 Disable or Modify Linux Audit System Log

T1562.012→ T1685.004 2 Disable or Modify Linux Audit System

T1685.005 13 Clear Windows Event Logs

T1070.001→ T1685.005 15 Clear Windows Event Logs

T1685.006 4 Clear Linux or Mac System Logs

T1070.002→ T1685.006 15 Clear Linux or Mac System Logs

T1686 18 Disable or Modify System Firewall

T1562.004→ T1686 26 Disable or Modify System Firewall

T1686.001 12 Cloud Firewall

T1562.007→ T1686.001 35 Disable or Modify Cloud Firewall

T1686.002 2 Network Device Firewall

T1686.003 20 Windows Host Firewall

T1688 1 Safe Mode Boot

T1689 2 Downgrade Attack

T1562.010→ T1689 6 Downgrade Attack

T1690 3 Prevent Command History Logging

T1562.003→ T1690 9 Impair Command History Logging

Credential Access TA0006

65 tech 2322 rules

T1003 220 OS Credential Dumping

T1003.001 147 LSASS Memory

T1003.002 58 Security Account Manager

T1003.003 42 NTDS

T1003.004 21 LSA Secrets

T1003.005 15 Cached Domain Credentials

T1003.006 15 DCSync

T1003.007 9 Proc Filesystem

T1003.008 17 /etc/passwd and /etc/shadow

T1040 35 Network Sniffing

T1056 32 Input Capture

T1056.001 25 Keylogging

T1056.002 9 GUI Input Capture

T1179→ T1056.004 4 Hooking

T1110 255 Brute Force

T1110.001 51 Password Guessing

T1110.002 2 Password Cracking

T1110.003 79 Password Spraying

T1110.004 31 Credential Stuffing

T1111 2 Multi-Factor Authentication Interception

T1187 28 Forced Authentication

T1212 20 Exploitation for Credential Access

T1528 83 Steal Application Access Token

T1539 39 Steal Web Session Cookie

T1552 204 Unsecured Credentials

T1552.001 102 Credentials In Files

T1081→ T1552.001 7 Credentials in Files

T1552.002 8 Credentials in Registry

T1214→ T1552.002 2 Credentials in Registry

T1552.003 8 Shell History

T1552.004 34 Private Keys

T1552.005 21 Cloud Instance Metadata API

T1552.006 11 Group Policy Preferences

T1552.007 36 Container API

T1552.008 2 Chat Messages

T1555 115 Credentials from Password Stores

T1555.001 19 Keychain

T1555.003 32 Credentials from Web Browsers

T1555.004 20 Windows Credential Manager

T1555.005 4 Password Managers

T1555.006 8 Cloud Secrets Management Stores

T1556 110 Modify Authentication Process

T1556.002 6 Password Filter DLL

T1556.003 10 Pluggable Authentication Modules

T1556.004 2 Network Device Authentication

T1556.006 35 Multi-Factor Authentication

T1556.007 4 Hybrid Identity

T1556.008 1 Network Provider DLL

T1556.009 14 Conditional Access Policies

T1557 44 Adversary-in-the-Middle

T1557.001 20 Name Resolution Poisoning and SMB Relay

T1171→ T1557.001 1 LLMNR/NBT-NS Poisoning and Relay

T1557.002 5 ARP Cache Poisoning

T1557.003 2 DHCP Spoofing

T1558 58 Steal or Forge Kerberos Tickets

T1558.001 3 Golden Ticket

T1558.002 2 Silver Ticket

T1558.003 38 Kerberoasting

T1208→ T1558.003 1 Kerberoasting

T1558.004 9 AS-REP Roasting

T1558.005 4 Ccache Files

T1606 12 Forge Web Credentials

T1606.002 2 SAML Tokens

T1621 30 Multi-Factor Authentication Request Generation

T1649 37 Steal or Forge Authentication Certificates

Discovery TA0007

45 tech 1872 rules

T1007 23 System Service Discovery

T1010 2 Application Window Discovery

T1012 48 Query Registry

T1016 71 System Network Configuration Discovery

T1016.001 8 Internet Connection Discovery

T1018 83 Remote System Discovery

T1033 89 System Owner/User Discovery

T1040 35 Network Sniffing

T1046 80 Network Service Discovery

T1049 29 System Network Connections Discovery

T1057 42 Process Discovery

T1069 59 Permission Groups Discovery

T1069.001 40 Local Groups

T1069.002 51 Domain Groups

T1069.003 18 Cloud Groups

T1082 212 System Information Discovery

T1083 195 File and Directory Discovery

T1087 121 Account Discovery

T1087.001 39 Local Account

T1087.002 77 Domain Account

T1087.004 27 Cloud Account

T1120 9 Peripheral Device Discovery

T1124 12 System Time Discovery

T1135 32 Network Share Discovery

T1201 41 Password Policy Discovery

T1217 15 Browser Information Discovery

T1482 65 Domain Trust Discovery

T1497 23 Virtualization/Sandbox Evasion

T1497.001 11 System Checks

T1497.003 5 Time Based Checks

T1518 44 Software Discovery

T1518.001 21 Security Software Discovery

T1063→ T1518.001 3 Security Software Discovery

T1526 60 Cloud Service Discovery

T1538 4 Cloud Service Dashboard

T1580 34 Cloud Infrastructure Discovery

T1613 52 Container and Resource Discovery

T1614 46 System Location Discovery

T1614.001 6 System Language Discovery

T1615 17 Group Policy Discovery

T1619 7 Cloud Storage Object Discovery

T1622 4 Debugger Evasion

T1652 3 Device Driver Discovery

T1654 5 Log Enumeration

T1673 4 Virtual Machine Discovery

Lateral Movement TA0008

29 tech 1056 rules

T1021 175 Remote Services

T1021.001 60 Remote Desktop Protocol

T1076→ T1021.001 5 Remote Desktop Protocol

T1021.002 101 SMB/Windows Admin Shares

T1077→ T1021.002 6 Windows Admin Shares

T1021.003 38 Distributed Component Object Model

T1021.004 51 SSH

T1021.005 3 VNC

T1021.006 27 Windows Remote Management

T1028→ T1021.006 6 Windows Remote Management

T1021.007 18 Cloud Services

T1021.008 1 Direct Cloud VM Connections

T1072 34 Software Deployment Tools

T1080 3 Taint Shared Content

T1091 11 Replication Through Removable Media

T1210 229 Exploitation of Remote Services

T1534 2 Internal Spearphishing

T1550 92 Use Alternate Authentication Material

T1550.001 51 Application Access Token

T1527→ T1550.001 1 Application Access Token

T1550.002 15 Pass the Hash

T1075→ T1550.002 3 Pass the Hash

T1550.003 18 Pass the Ticket

T1097→ T1550.003 2 Pass the Ticket

T1550.004 6 Web Session Cookie

T1563 14 Remote Service Session Hijacking

T1563.001 10 SSH Hijacking

T1563.002 5 RDP Hijacking

T1570 69 Lateral Tool Transfer

Collection TA0009

38 tech 938 rules

T1005 231 Data from Local System

T1025 4 Data from Removable Media

T1039 10 Data from Network Shared Drive

T1056 32 Input Capture

T1056.001 25 Keylogging

T1056.002 9 GUI Input Capture

T1179→ T1056.004 4 Hooking

T1074 27 Data Staged

T1074.001 20 Local Data Staging

T1074.002 4 Remote Data Staging

T1113 37 Screen Capture

T1114 73 Email Collection

T1114.001 12 Local Email Collection

T1114.002 18 Remote Email Collection

T1114.003 18 Email Forwarding Rule

T1115 23 Clipboard Data

T1119 23 Automated Collection

T1123 18 Audio Capture

T1125 9 Video Capture

T1185 13 Browser Session Hijacking

T1213 80 Data from Information Repositories

T1213.002 8 Sharepoint

T1213.003 12 Code Repositories

T1213.006 2 Databases

T1530 73 Data from Cloud Storage

T1557 44 Adversary-in-the-Middle

T1557.001 20 Name Resolution Poisoning and SMB Relay

T1171→ T1557.001 1 LLMNR/NBT-NS Poisoning and Relay

T1557.002 5 ARP Cache Poisoning

T1557.003 2 DHCP Spoofing

T1560 25 Archive Collected Data

T1002→ T1560 7 Data Compressed

T1022→ T1560 3 Data Encrypted

T1560.001 39 Archive via Utility

T1560.002 4 Archive via Library

T1560.003 1 Archive via Custom Method

T1602 1 Data from Configuration Repository

T1602.002 1 Network Device Configuration Dump

Command and Control TA0011

38 tech 8685 rules

T1001 113 Data Obfuscation

T1001.002 3 Steganography

T1001.003 2 Protocol or Service Impersonation

T1008 9 Fallback Channels

T1071 1265 Application Layer Protocol

T1071.001 104 Web Protocols

T1071.002 2 File Transfer Protocols

T1071.003 7 Mail Protocols

T1071.004 56 DNS

T1090 72 Proxy

T1090.001 12 Internal Proxy

T1090.002 8 External Proxy

T1090.003 14 Multi-hop Proxy

T1188→ T1090.003 1 Multi-hop Proxy

T1090.004 1 Domain Fronting

T1092 1 Communication Through Removable Media

T1095 66 Non-Application Layer Protocol

T1102 69 Web Service

T1102.001 6 Dead Drop Resolver

T1102.002 19 Bidirectional Communication

T1102.003 2 One-Way Communication

T1105 408 Ingress Tool Transfer

T1132 9 Data Encoding

T1132.001 7 Standard Encoding

T1205 6 Traffic Signaling

T1205.001 6 Port Knocking

T1219 245 Remote Access Tools

T1219.002 53 Remote Desktop Software

T1568 5955 Dynamic Resolution

T1568.002 11 Domain Generation Algorithms

T1571 29 Non-Standard Port

T1065→ T1571 2 Uncommonly Used Port

T1572 76 Protocol Tunneling

T1573 34 Encrypted Channel

T1079→ T1573 1 Multilayer Encryption

T1573.001 1 Symmetric Cryptography

T1573.002 9 Asymmetric Cryptography

T1665 1 Hide Infrastructure

Exfiltration TA0010

18 tech 1239 rules

T1011 7 Exfiltration Over Other Network Medium

T1011.001 1 Exfiltration Over Bluetooth

T1020 43 Automated Exfiltration

T1020.001 1 Traffic Duplication

T1030 16 Data Transfer Size Limits

T1041 866 Exfiltration Over C2 Channel

T1048 71 Exfiltration Over Alternative Protocol

T1048.001 5 Exfiltration Over Symmetric Encrypted Non-C2 Protocol

T1048.002 6 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

T1048.003 25 Exfiltration Over Unencrypted Non-C2 Protocol

T1052 5 Exfiltration Over Physical Medium

T1052.001 4 Exfiltration over USB

T1537 51 Transfer Data to Cloud Account

T1567 89 Exfiltration Over Web Service

T1567.001 10 Exfiltration to Code Repository

T1567.002 35 Exfiltration to Cloud Storage

T1567.003 3 Exfiltration to Text Storage Sites

T1567.004 1 Exfiltration Over Webhook

Impact TA0040

28 tech 1247 rules

T1485 172 Data Destruction

T1485.001 5 Lifecycle-Triggered Deletion

T1486 419 Data Encrypted for Impact

T1489 96 Service Stop

T1490 118 Inhibit System Recovery

T1491 7 Defacement

T1491.001 4 Internal Defacement

T1491.002 1 External Defacement

T1495 2 Firmware Corruption

T1496 102 Resource Hijacking

T1496.001 2 Compute Hijacking

T1496.004 5 Cloud Service Hijacking

T1498 33 Network Denial of Service

T1498.001 2 Direct Network Flood

T1498.002 1 Reflection Amplification

T1499 70 Endpoint Denial of Service

T1499.001 1 OS Exhaustion Flood

T1499.002 2 Service Exhaustion Flood

T1499.003 2 Application Exhaustion Flood

T1499.004 4 Application or System Exploitation

T1529 45 System Shutdown/Reboot

T1531 83 Account Access Removal

T1561.001 6 Disk Content Wipe

T1561.002 3 Disk Structure Wipe

T1565 26 Data Manipulation

T1565.001 31 Stored Data Manipulation

T1565.002 3 Transmitted Data Manipulation

T1657 2 Financial Theft

Unattributed techniques

15 techniques

Techniques whose rules don't declare a tactic. They still appear in cross-source pivots, just not in the matrix above.

T1064 18 Scripting

T1043 10 Commonly Used Port

T1175 5 Component Object Model and Distributed COM

T1108 3 Redundant Access

T0018.000 1

T0137 1

T0853 1

T0890 1

T1034 1 Path Interception

T1201.007 1 Password Policy Discovery

T1313 1

T1358 1

T1377 1

T1471 1

T1636.003 1