MITRE ATT&CK
MITRE's knowledge base of adversary tactics and techniques, based on real-world observations. Search by ID or name, or open the mind map below: tactics, then techniques, then sub-techniques.
15 tactics · 706 techniques · 178 groups · 842 software · 44 mitigations. Technique counts include sub-techniques; the number beside a technique is how many sub-techniques it has. Revoked and deprecated entries are left out of the mind map and search.
Enterprise ATT&CK v20.0
TA0043 Reconnaissance 12 tech · 34 sub
open →T1595 Active Scanning 3 sub
open →T1592 Gather Victim Host Information 4 sub
open →T1589 Gather Victim Identity Information 3 sub
open →T1590 Gather Victim Network Information 6 sub
open →T1591 Gather Victim Org Information 4 sub
open →T1598 Phishing for Information 4 sub
open →- T1682 Query Public AI Services
T1597 Search Closed Sources 2 sub
open →T1596 Search Open Technical Databases 5 sub
open →T1593 Search Open Websites/Domains 3 sub
open →- T1681 Search Threat Vendor Data
- T1594 Search Victim-Owned Websites
TA0042 Resource Development 9 tech · 42 sub
open →- T1650 Acquire Access
T1586 Compromise Accounts 3 sub
open →T1587 Develop Capabilities 4 sub
open →T1585 Establish Accounts 3 sub
open →
TA0001 Initial Access 11 tech · 11 sub
open →TA0002 Execution 22 tech · 44 sub
open →- T1197 BITS Jobs
- T1651 Cloud Administration Command
T1059 Command and Scripting Interpreter 13 sub
open →- T1609 Container Administration Command
- T1610 Deploy Container
- T1699 Direct Prompt Injection
- T1675 ESXi Administration Command
- T1203 Exploitation for Client Execution
T1574 Hijack Execution Flow 12 sub
open →- T1574.001 DLL
- T1574.004 Dylib Hijacking
- T1574.005 Executable Installer File Permissions Weakness
- T1574.006 Dynamic Linker Hijacking
- T1574.007 Path Interception by PATH Environment Variable
- T1574.008 Path Interception by Search Order Hijacking
- T1574.009 Path Interception by Unquoted Path
- T1574.010 Services File Permissions Weakness
- T1574.011 Services Registry Permissions Weakness
- T1574.012 COR_PROFILER
- T1574.013 KernelCallbackTable
- T1574.014 AppDomainManager
- T1698 Indirect Prompt Injection
- T1674 Input Injection
T1559 Inter-Process Communication 3 sub
open →- T1106 Native API
- T1677 Poisoned Pipeline Execution
T1053 Scheduled Task/Job 5 sub
open →- T1648 Serverless Execution
- T1129 Shared Modules
- T1072 Software Deployment Tools
T1127 Trusted Developer Utilities Proxy Execution 3 sub
open →- T1047 Windows Management Instrumentation
TA0003 Persistence 22 tech · 91 sub
open →T1098 Account Manipulation 7 sub
open →- T1197 BITS Jobs
T1547 Boot or Logon Autostart Execution 14 sub
open →- T1547.001 Registry Run Keys / Startup Folder
- T1547.002 Authentication Package
- T1547.003 Time Providers
- T1547.004 Winlogon Helper DLL
- T1547.005 Security Support Provider
- T1547.006 Kernel Modules and Extensions
- T1547.007 Re-opened Applications
- T1547.008 LSASS Driver
- T1547.009 Shortcut Modification
- T1547.010 Port Monitors
- T1547.012 Print Processors
- T1547.013 XDG Autostart Entries
- T1547.014 Active Setup
- T1547.015 Login Items
T1037 Boot or Logon Initialization Scripts 5 sub
open →- T1671 Cloud Application Integration
- T1554 Compromise Host Software Binary
T1136 Create Account 3 sub
open →T1543 Create or Modify System Process 5 sub
open →T1546 Event Triggered Execution 18 sub
open →- T1546.001 Change Default File Association
- T1546.002 Screensaver
- T1546.003 Windows Management Instrumentation Event Subscription
- T1546.004 Unix Shell Configuration Modification
- T1546.005 Trap
- T1546.006 LC_LOAD_DYLIB Addition
- T1546.007 Netsh Helper DLL
- T1546.008 Accessibility Features
- T1546.009 AppCert DLLs
- T1546.010 AppInit DLLs
- T1546.011 Application Shimming
- T1546.012 Image File Execution Options Injection
- T1546.013 PowerShell Profile
- T1546.014 Emond
- T1546.015 Component Object Model Hijacking
- T1546.016 Installer Packages
- T1546.017 Udev Rules
- T1546.018 Python Startup Hooks
- T1668 Exclusive Control
- T1133 External Remote Services
- T1525 Implant Internal Image
T1556 Modify Authentication Process 9 sub
open →- T1556.001 Domain Controller Authentication
- T1556.002 Password Filter DLL
- T1556.003 Pluggable Authentication Modules
- T1556.004 Network Device Authentication
- T1556.005 Reversible Encryption
- T1556.006 Multi-Factor Authentication
- T1556.007 Hybrid Identity
- T1556.008 Network Provider DLL
- T1556.009 Conditional Access Policies
- T1112 Modify Registry
T1137 Office Application Startup 6 sub
open →- T1653 Power Settings
T1053 Scheduled Task/Job 5 sub
open →
TA0004 Privilege Escalation 13 tech · 83 sub
open →T1098 Account Manipulation 7 sub
open →T1547 Boot or Logon Autostart Execution 14 sub
open →- T1547.001 Registry Run Keys / Startup Folder
- T1547.002 Authentication Package
- T1547.003 Time Providers
- T1547.004 Winlogon Helper DLL
- T1547.005 Security Support Provider
- T1547.006 Kernel Modules and Extensions
- T1547.007 Re-opened Applications
- T1547.008 LSASS Driver
- T1547.009 Shortcut Modification
- T1547.010 Port Monitors
- T1547.012 Print Processors
- T1547.013 XDG Autostart Entries
- T1547.014 Active Setup
- T1547.015 Login Items
T1037 Boot or Logon Initialization Scripts 5 sub
open →T1543 Create or Modify System Process 5 sub
open →T1484 Domain or Tenant Policy Modification 2 sub
open →- T1611 Escape to Host
T1546 Event Triggered Execution 18 sub
open →- T1546.001 Change Default File Association
- T1546.002 Screensaver
- T1546.003 Windows Management Instrumentation Event Subscription
- T1546.004 Unix Shell Configuration Modification
- T1546.005 Trap
- T1546.006 LC_LOAD_DYLIB Addition
- T1546.007 Netsh Helper DLL
- T1546.008 Accessibility Features
- T1546.009 AppCert DLLs
- T1546.010 AppInit DLLs
- T1546.011 Application Shimming
- T1546.012 Image File Execution Options Injection
- T1546.013 PowerShell Profile
- T1546.014 Emond
- T1546.015 Component Object Model Hijacking
- T1546.016 Installer Packages
- T1546.017 Udev Rules
- T1546.018 Python Startup Hooks
- T1068 Exploitation for Privilege Escalation
T1055 Process Injection 12 sub
open →- T1055.001 Dynamic-link Library Injection
- T1055.002 Portable Executable Injection
- T1055.003 Thread Execution Hijacking
- T1055.004 Asynchronous Procedure Call
- T1055.005 Thread Local Storage
- T1055.008 Ptrace System Calls
- T1055.009 Proc Memory
- T1055.011 Extra Window Memory Injection
- T1055.012 Process Hollowing
- T1055.013 Process Doppelgänging
- T1055.014 VDSO Hijacking
- T1055.015 ListPlanting
T1053 Scheduled Task/Job 5 sub
open →
TA0005 Stealth 31 tech · 120 sub
open →T1696 Anti-Automation Evasion 2 sub
open →- T1197 BITS Jobs
- T1612 Build Image on Host
- T1622 Debugger Evasion
- T1678 Delay Execution
- T1140 Deobfuscate/Decode Files or Information
- T1006 Direct Volume Access
- T1211 Exploitation for Stealth
T1564 Hide Artifacts 14 sub
open →- T1564.001 Hidden Files and Directories
- T1564.002 Hidden Users
- T1564.003 Hidden Window
- T1564.004 NTFS File Attributes
- T1564.005 Hidden File System
- T1564.006 Run Virtual Instance
- T1564.007 VBA Stomping
- T1564.008 Email Hiding Rules
- T1564.009 Resource Forking
- T1564.010 Process Argument Spoofing
- T1564.011 Ignore Process Interrupts
- T1564.012 File/Path Exclusions
- T1564.013 Bind Mounts
- T1564.014 Extended Attributes
T1574 Hijack Execution Flow 12 sub
open →- T1574.001 DLL
- T1574.004 Dylib Hijacking
- T1574.005 Executable Installer File Permissions Weakness
- T1574.006 Dynamic Linker Hijacking
- T1574.007 Path Interception by PATH Environment Variable
- T1574.008 Path Interception by Search Order Hijacking
- T1574.009 Path Interception by Unquoted Path
- T1574.010 Services File Permissions Weakness
- T1574.011 Services Registry Permissions Weakness
- T1574.012 COR_PROFILER
- T1574.013 KernelCallbackTable
- T1574.014 AppDomainManager
- T1202 Indirect Command Execution
T1036 Masquerading 12 sub
open →- T1036.001 Invalid Code Signature
- T1036.002 Right-to-Left Override
- T1036.003 Rename Legitimate Utilities
- T1036.004 Masquerade Task or Service
- T1036.005 Match Legitimate Resource Name or Location
- T1036.006 Space after Filename
- T1036.007 Double File Extension
- T1036.008 Masquerade File Type
- T1036.009 Break Process Trees
- T1036.010 Masquerade Account Name
- T1036.011 Overwrite Process Arguments
- T1036.012 Browser Fingerprint
T1027 Obfuscated Files or Information 18 sub
open →- T1027.001 Binary Padding
- T1027.002 Software Packing
- T1027.003 Steganography
- T1027.004 Compile After Delivery
- T1027.005 Indicator Removal from Tools
- T1027.006 HTML Smuggling
- T1027.007 Dynamic API Resolution
- T1027.008 Stripped Payloads
- T1027.009 Embedded Payloads
- T1027.010 Command Obfuscation
- T1027.011 Fileless Storage
- T1027.012 LNK Icon Smuggling
- T1027.013 Encrypted/Encoded File
- T1027.014 Polymorphic Code
- T1027.015 Compression
- T1027.016 Junk Code Insertion
- T1027.017 SVG Smuggling
- T1027.018 Invisible Unicode
T1055 Process Injection 12 sub
open →- T1055.001 Dynamic-link Library Injection
- T1055.002 Portable Executable Injection
- T1055.003 Thread Execution Hijacking
- T1055.004 Asynchronous Procedure Call
- T1055.005 Thread Local Storage
- T1055.008 Ptrace System Calls
- T1055.009 Proc Memory
- T1055.011 Extra Window Memory Injection
- T1055.012 Process Hollowing
- T1055.013 Process Doppelgänging
- T1055.014 VDSO Hijacking
- T1055.015 ListPlanting
- T1620 Reflective Code Loading
- T1014 Rootkit
- T1679 Selective Exclusion
T1218 System Binary Proxy Execution 14 sub
open →- T1221 Template Injection
T1127 Trusted Developer Utilities Proxy Execution 3 sub
open →- T1535 Unused/Unsupported Cloud Regions
T1497 Virtualization/Sandbox Evasion 3 sub
open →- T1220 XSL Script Processing
TA0112 Defense Impairment 18 tech · 39 sub
open →T1686 Disable or Modify System Firewall 3 sub
open →T1685 Disable or Modify Tools 7 sub
open →T1484 Domain or Tenant Policy Modification 2 sub
open →- T1689 Downgrade Attack
- T1687 Exploitation for Defense Impairment
T1222 File and Directory Permissions Modification 2 sub
open →T1556 Modify Authentication Process 9 sub
open →- T1556.001 Domain Controller Authentication
- T1556.002 Password Filter DLL
- T1556.003 Pluggable Authentication Modules
- T1556.004 Network Device Authentication
- T1556.005 Reversible Encryption
- T1556.006 Multi-Factor Authentication
- T1556.007 Hybrid Identity
- T1556.008 Network Provider DLL
- T1556.009 Conditional Access Policies
T1578 Modify Cloud Compute Infrastructure 5 sub
open →- T1666 Modify Cloud Resource Hierarchy
- T1112 Modify Registry
- T1647 Plist File Modification
- T1690 Prevent Command History Logging
- T1207 Rogue Domain Controller
- T1688 Safe Mode Boot
TA0006 Credential Access 18 tech · 50 sub
open →T1557 Adversary-in-the-Middle 4 sub
open →- T1212 Exploitation for Credential Access
- T1187 Forced Authentication
T1556 Modify Authentication Process 9 sub
open →- T1556.001 Domain Controller Authentication
- T1556.002 Password Filter DLL
- T1556.003 Pluggable Authentication Modules
- T1556.004 Network Device Authentication
- T1556.005 Reversible Encryption
- T1556.006 Multi-Factor Authentication
- T1556.007 Hybrid Identity
- T1556.008 Network Provider DLL
- T1556.009 Conditional Access Policies
- T1111 Multi-Factor Authentication Interception
- T1621 Multi-Factor Authentication Request Generation
- T1040 Network Sniffing
- T1528 Steal Application Access Token
- T1697 Steal Application Specific Passwords
- T1539 Steal Web Session Cookie
- T1649 Steal or Forge Authentication Certificates
T1558 Steal or Forge Kerberos Tickets 5 sub
open →
TA0007 Discovery 34 tech · 15 sub
open →T1087 Account Discovery 4 sub
open →- T1010 Application Window Discovery
- T1217 Browser Information Discovery
- T1580 Cloud Infrastructure Discovery
- T1538 Cloud Service Dashboard
- T1526 Cloud Service Discovery
- T1619 Cloud Storage Object Discovery
- T1613 Container and Resource Discovery
- T1622 Debugger Evasion
- T1652 Device Driver Discovery
- T1482 Domain Trust Discovery
- T1083 File and Directory Discovery
- T1615 Group Policy Discovery
- T1680 Local Storage Discovery
- T1654 Log Enumeration
- T1046 Network Service Discovery
- T1135 Network Share Discovery
- T1040 Network Sniffing
- T1201 Password Policy Discovery
- T1120 Peripheral Device Discovery
T1069 Permission Groups Discovery 3 sub
open →- T1057 Process Discovery
- T1012 Query Registry
- T1018 Remote System Discovery
T1518 Software Discovery 2 sub
open →- T1082 System Information Discovery
T1016 System Network Configuration Discovery 2 sub
open →- T1049 System Network Connections Discovery
- T1033 System Owner/User Discovery
- T1007 System Service Discovery
- T1124 System Time Discovery
- T1673 Virtual Machine Discovery
T1497 Virtualization/Sandbox Evasion 3 sub
open →
TA0008 Lateral Movement 9 tech · 14 sub
open →- T1210 Exploitation of Remote Services
- T1534 Internal Spearphishing
- T1570 Lateral Tool Transfer
- T1091 Replication Through Removable Media
- T1072 Software Deployment Tools
- T1080 Taint Shared Content
T1550 Use Alternate Authentication Material 4 sub
open →
TA0009 Collection 17 tech · 24 sub
open →T1557 Adversary-in-the-Middle 4 sub
open →T1560 Archive Collected Data 3 sub
open →- T1123 Audio Capture
- T1119 Automated Collection
- T1185 Browser Session Hijacking
- T1115 Clipboard Data
- T1530 Data from Cloud Storage
T1602 Data from Configuration Repository 2 sub
open →T1213 Data from Information Repositories 6 sub
open →- T1005 Data from Local System
- T1039 Data from Network Shared Drive
- T1025 Data from Removable Media
T1114 Email Collection 3 sub
open →- T1113 Screen Capture
- T1125 Video Capture
TA0011 Command and Control 18 tech · 27 sub
open →T1071 Application Layer Protocol 5 sub
open →- T1092 Communication Through Removable Media
- T1659 Content Injection
T1001 Data Obfuscation 3 sub
open →T1568 Dynamic Resolution 3 sub
open →T1573 Encrypted Channel 2 sub
open →- T1008 Fallback Channels
- T1665 Hide Infrastructure
- T1105 Ingress Tool Transfer
- T1104 Multi-Stage Channels
- T1095 Non-Application Layer Protocol
- T1571 Non-Standard Port
- T1572 Protocol Tunneling
T1219 Remote Access Tools 3 sub
open →
TA0010 Exfiltration 10 tech · 10 sub
open →- T1700 AI-Enabled Exfiltration
- T1030 Data Transfer Size Limits
T1048 Exfiltration Over Alternative Protocol 3 sub
open →- T1041 Exfiltration Over C2 Channel
- T1029 Scheduled Transfer
- T1537 Transfer Data to Cloud Account
TA0040 Impact 15 tech · 18 sub
open →- T1531 Account Access Removal
- T1486 Data Encrypted for Impact
T1565 Data Manipulation 3 sub
open →- T1667 Email Bombing
T1499 Endpoint Denial of Service 4 sub
open →- T1657 Financial Theft
- T1495 Firmware Corruption
- T1490 Inhibit System Recovery
T1498 Network Denial of Service 2 sub
open →T1496 Resource Hijacking 4 sub
open →- T1489 Service Stop
- T1529 System Shutdown/Reboot