MITRE ATT&CK® is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community.

With the creation of ATT&CK, MITRE is fulfilling its mission to solve problems for a safer world — by bringing communities together to develop more effective cybersecurity. ATT&CK is open and available to any person or organization for use at no charge.

ATT&CK Matrix for Enterprise

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Stealth Defense Impairment Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
12 techniques 9 techniques 11 techniques 20 techniques 22 techniques 13 techniques 30 techniques 18 techniques 17 techniques 34 techniques 9 techniques 17 techniques 18 techniques 9 techniques 15 techniques
Active Scanning (3)
=
Gather Victim Host Information (4)
=
Gather Victim Identity Information (3)
=
Gather Victim Network Information (6)
=
Gather Victim Org Information (4)
=
Phishing for Information (4)
=
Query Public AI Services
Search Closed Sources (2)
=
Search Open Technical Databases (5)
=
Search Open Websites/Domains (3)
=
Search Threat Vendor Data
Search Victim-Owned Websites
Acquire Access
Acquire Infrastructure (8)
=
Compromise Accounts (3)
=
Compromise Infrastructure (8)
=
Develop Capabilities (4)
=
Establish Accounts (3)
=
Generate Content (2)
=
Obtain Capabilities (7)
=
Stage Capabilities (6)
=
Content Injection
Drive-by Compromise
Exploit Public-Facing Application
External Remote Services
Hardware Additions
Phishing (4)
=
Replication Through Removable Media
Supply Chain Compromise (3)
=
Trusted Relationship
Valid Accounts (4)
=
Wi-Fi Networks
BITS Jobs
Cloud Administration Command
Command and Scripting Interpreter (13)
=
Container Administration Command
Deploy Container
ESXi Administration Command
Exploitation for Client Execution
Hijack Execution Flow (12)
=
Input Injection
Inter-Process Communication (3)
=
Native API
Poisoned Pipeline Execution
Scheduled Task/Job (5)
=
Serverless Execution
Shared Modules
Software Deployment Tools
System Services (3)
=
Trusted Developer Utilities Proxy Execution (3)
=
User Execution (5)
=
Windows Management Instrumentation
Account Manipulation (7)
=
BITS Jobs
Boot or Logon Autostart Execution (14)
=
Boot or Logon Initialization Scripts (5)
=
Cloud Application Integration
Compromise Host Software Binary
Create Account (3)
=
Create or Modify System Process (5)
=
Event Triggered Execution (18)
=
Exclusive Control
External Remote Services
Implant Internal Image
Modify Authentication Process (9)
=
Modify Registry
Office Application Startup (6)
=
Power Settings
Pre-OS Boot (5)
=
Scheduled Task/Job (5)
=
Server Software Component (6)
=
Software Extensions (2)
=
Traffic Signaling (2)
=
Valid Accounts (4)
=
Abuse Elevation Control Mechanism (6)
=
Access Token Manipulation (5)
=
Account Manipulation (7)
=
Boot or Logon Autostart Execution (14)
=
Boot or Logon Initialization Scripts (5)
=
Create or Modify System Process (5)
=
Domain or Tenant Policy Modification (2)
=
Escape to Host
Event Triggered Execution (18)
=
Exploitation for Privilege Escalation
Process Injection (12)
=
Scheduled Task/Job (5)
=
Valid Accounts (4)
=
Access Token Manipulation (5)
=
BITS Jobs
Build Image on Host
Debugger Evasion
Delay Execution
Deobfuscate/Decode Files or Information
Direct Volume Access
Execution Guardrails (2)
=
Exploitation for Stealth
Hide Artifacts (14)
=
Hijack Execution Flow (12)
=
Indicator Removal (8)
=
Indirect Command Execution
Masquerading (12)
=
Obfuscated Files or Information (18)
=
Pre-OS Boot (5)
=
Process Injection (12)
=
Reflective Code Loading
Rootkit
Selective Exclusion
Social Engineering (2)
=
System Binary Proxy Execution (14)
=
System Script Proxy Execution (2)
=
Template Injection
Traffic Signaling (2)
=
Trusted Developer Utilities Proxy Execution (3)
=
Unused/Unsupported Cloud Regions
Valid Accounts (4)
=
Virtualization/Sandbox Evasion (3)
=
XSL Script Processing
Disable or Modify System Firewall (3)
=
Disable or Modify Tools (6)
=
Domain or Tenant Policy Modification (2)
=
Downgrade Attack
Exploitation for Defense Impairment
File and Directory Permissions Modification (2)
=
Modify Authentication Process (9)
=
Modify Cloud Compute Infrastructure (5)
=
Modify Cloud Resource Hierarchy
Modify Registry
Modify System Image (2)
=
Network Boundary Bridging (1)
=
Plist File Modification
Prevent Command History Logging
Rogue Domain Controller
Safe Mode Boot
Subvert Trust Controls (6)
=
Weaken Encryption (2)
=
Adversary-in-the-Middle (4)
=
Brute Force (4)
=
Credentials from Password Stores (6)
=
Exploitation for Credential Access
Forced Authentication
Forge Web Credentials (2)
=
Input Capture (4)
=
Modify Authentication Process (9)
=
Multi-Factor Authentication Interception
Multi-Factor Authentication Request Generation
Network Sniffing
OS Credential Dumping (8)
=
Steal Application Access Token
Steal or Forge Authentication Certificates
Steal or Forge Kerberos Tickets (5)
=
Steal Web Session Cookie
Unsecured Credentials (8)
=
Account Discovery (4)
=
Application Window Discovery
Browser Information Discovery
Cloud Infrastructure Discovery
Cloud Service Dashboard
Cloud Service Discovery
Cloud Storage Object Discovery
Container and Resource Discovery
Debugger Evasion
Device Driver Discovery
Domain Trust Discovery
File and Directory Discovery
Group Policy Discovery
Local Storage Discovery
Log Enumeration
Network Service Discovery
Network Share Discovery
Network Sniffing
Password Policy Discovery
Peripheral Device Discovery
Permission Groups Discovery (3)
=
Process Discovery
Query Registry
Remote System Discovery
Software Discovery (2)
=
System Information Discovery
System Location Discovery (1)
=
System Network Configuration Discovery (2)
=
System Network Connections Discovery
System Owner/User Discovery
System Service Discovery
System Time Discovery
Virtual Machine Discovery
Virtualization/Sandbox Evasion (3)
=
Exploitation of Remote Services
Internal Spearphishing
Lateral Tool Transfer
Remote Service Session Hijacking (2)
=
Remote Services (8)
=
Replication Through Removable Media
Software Deployment Tools
Taint Shared Content
Use Alternate Authentication Material (4)
=
Adversary-in-the-Middle (4)
=
Archive Collected Data (3)
=
Audio Capture
Automated Collection
Browser Session Hijacking
Clipboard Data
Data from Cloud Storage
Data from Configuration Repository (2)
=
Data from Information Repositories (6)
=
Data from Local System
Data from Network Shared Drive
Data from Removable Media
Data Staged (2)
=
Email Collection (3)
=
Input Capture (4)
=
Screen Capture
Video Capture
Application Layer Protocol (5)
=
Communication Through Removable Media
Content Injection
Data Encoding (2)
=
Data Obfuscation (3)
=
Dynamic Resolution (3)
=
Encrypted Channel (2)
=
Fallback Channels
Hide Infrastructure
Ingress Tool Transfer
Multi-Stage Channels
Non-Application Layer Protocol
Non-Standard Port
Protocol Tunneling
Proxy (4)
=
Remote Access Tools (3)
=
Traffic Signaling (2)
=
Web Service (3)
=
Automated Exfiltration (1)
=
Data Transfer Size Limits
Exfiltration Over Alternative Protocol (3)
=
Exfiltration Over C2 Channel
Exfiltration Over Other Network Medium (1)
=
Exfiltration Over Physical Medium (1)
=
Exfiltration Over Web Service (4)
=
Scheduled Transfer
Transfer Data to Cloud Account
Account Access Removal
Data Destruction (1)
=
Data Encrypted for Impact
Data Manipulation (3)
=
Defacement (2)
=
Disk Wipe (2)
=
Email Bombing
Endpoint Denial of Service (4)
=
Financial Theft
Firmware Corruption
Inhibit System Recovery
Network Denial of Service (2)
=
Resource Hijacking (4)
=
Service Stop
System Shutdown/Reboot
Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Stealth Defense Impairment Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
12 techniques 9 techniques 11 techniques 20 techniques 22 techniques 13 techniques 30 techniques 18 techniques 17 techniques 34 techniques 9 techniques 17 techniques 18 techniques 9 techniques 15 techniques
=
Active Scanning (3)
=
Gather Victim Host Information (4)
=
Gather Victim Identity Information (3)
=
Gather Victim Network Information (6)
=
Gather Victim Org Information (4)
=
Phishing for Information (4)
Query Public AI Services
=
Search Closed Sources (2)
=
Search Open Technical Databases (5)
=
Search Open Websites/Domains (3)
Search Threat Vendor Data
Search Victim-Owned Websites
Acquire Access
=
Acquire Infrastructure (8)
=
Compromise Accounts (3)
=
Compromise Infrastructure (8)
=
Develop Capabilities (4)
=
Establish Accounts (3)
=
Generate Content (2)
=
Obtain Capabilities (7)
=
Stage Capabilities (6)
Content Injection
Drive-by Compromise
Exploit Public-Facing Application
External Remote Services
Hardware Additions
=
Phishing (4)
Replication Through Removable Media
=
Supply Chain Compromise (3)
Trusted Relationship
=
Valid Accounts (4)
Wi-Fi Networks
BITS Jobs
Cloud Administration Command
=
Command and Scripting Interpreter (13)
Container Administration Command
Deploy Container
ESXi Administration Command
Exploitation for Client Execution
=
Hijack Execution Flow (12)
Input Injection
=
Inter-Process Communication (3)
Native API
Poisoned Pipeline Execution
=
Scheduled Task/Job (5)
Serverless Execution
Shared Modules
Software Deployment Tools
=
System Services (3)
=
Trusted Developer Utilities Proxy Execution (3)
=
User Execution (5)
Windows Management Instrumentation
=
Account Manipulation (7)
BITS Jobs
=
Boot or Logon Autostart Execution (14)
=
Boot or Logon Initialization Scripts (5)
Cloud Application Integration
Compromise Host Software Binary
=
Create Account (3)
=
Create or Modify System Process (5)
=
Event Triggered Execution (18)
Exclusive Control
External Remote Services
Implant Internal Image
=
Modify Authentication Process (9)
Modify Registry
=
Office Application Startup (6)
Power Settings
=
Pre-OS Boot (5)
=
Scheduled Task/Job (5)
=
Server Software Component (6)
=
Software Extensions (2)
=
Traffic Signaling (2)
=
Valid Accounts (4)
=
Abuse Elevation Control Mechanism (6)
=
Access Token Manipulation (5)
=
Account Manipulation (7)
=
Boot or Logon Autostart Execution (14)
=
Boot or Logon Initialization Scripts (5)
=
Create or Modify System Process (5)
=
Domain or Tenant Policy Modification (2)
Escape to Host
=
Event Triggered Execution (18)
Exploitation for Privilege Escalation
=
Process Injection (12)
=
Scheduled Task/Job (5)
=
Valid Accounts (4)
=
Access Token Manipulation (5)
BITS Jobs
Build Image on Host
Debugger Evasion
Delay Execution
Deobfuscate/Decode Files or Information
Direct Volume Access
=
Execution Guardrails (2)
Exploitation for Stealth
=
Hide Artifacts (14)
=
Hijack Execution Flow (12)
=
Indicator Removal (8)
Indirect Command Execution
=
Masquerading (12)
=
Obfuscated Files or Information (18)
=
Pre-OS Boot (5)
=
Process Injection (12)
Reflective Code Loading
Rootkit
Selective Exclusion
=
Social Engineering (2)
=
System Binary Proxy Execution (14)
=
System Script Proxy Execution (2)
Template Injection
=
Traffic Signaling (2)
=
Trusted Developer Utilities Proxy Execution (3)
Unused/Unsupported Cloud Regions
=
Valid Accounts (4)
=
Virtualization/Sandbox Evasion (3)
XSL Script Processing
=
Disable or Modify System Firewall (3)
=
Disable or Modify Tools (6)
=
Domain or Tenant Policy Modification (2)
Downgrade Attack
Exploitation for Defense Impairment
=
File and Directory Permissions Modification (2)
=
Modify Authentication Process (9)
=
Modify Cloud Compute Infrastructure (5)
Modify Cloud Resource Hierarchy
Modify Registry
=
Modify System Image (2)
=
Network Boundary Bridging (1)
Plist File Modification
Prevent Command History Logging
Rogue Domain Controller
Safe Mode Boot
=
Subvert Trust Controls (6)
=
Weaken Encryption (2)
=
Adversary-in-the-Middle (4)
=
Brute Force (4)
=
Credentials from Password Stores (6)
Exploitation for Credential Access
Forced Authentication
=
Forge Web Credentials (2)
=
Input Capture (4)
=
Modify Authentication Process (9)
Multi-Factor Authentication Interception
Multi-Factor Authentication Request Generation
Network Sniffing
=
OS Credential Dumping (8)
Steal Application Access Token
Steal or Forge Authentication Certificates
=
Steal or Forge Kerberos Tickets (5)
Steal Web Session Cookie
=
Unsecured Credentials (8)
=
Account Discovery (4)
Application Window Discovery
Browser Information Discovery
Cloud Infrastructure Discovery
Cloud Service Dashboard
Cloud Service Discovery
Cloud Storage Object Discovery
Container and Resource Discovery
Debugger Evasion
Device Driver Discovery
Domain Trust Discovery
File and Directory Discovery
Group Policy Discovery
Local Storage Discovery
Log Enumeration
Network Service Discovery
Network Share Discovery
Network Sniffing
Password Policy Discovery
Peripheral Device Discovery
=
Permission Groups Discovery (3)
Process Discovery
Query Registry
Remote System Discovery
=
Software Discovery (2)
System Information Discovery
=
System Location Discovery (1)
=
System Network Configuration Discovery (2)
System Network Connections Discovery
System Owner/User Discovery
System Service Discovery
System Time Discovery
Virtual Machine Discovery
=
Virtualization/Sandbox Evasion (3)
Exploitation of Remote Services
Internal Spearphishing
Lateral Tool Transfer
=
Remote Service Session Hijacking (2)
=
Remote Services (8)
Replication Through Removable Media
Software Deployment Tools
Taint Shared Content
=
Use Alternate Authentication Material (4)
=
Adversary-in-the-Middle (4)
=
Archive Collected Data (3)
Audio Capture
Automated Collection
Browser Session Hijacking
Clipboard Data
Data from Cloud Storage
=
Data from Configuration Repository (2)
=
Data from Information Repositories (6)
Data from Local System
Data from Network Shared Drive
Data from Removable Media
=
Data Staged (2)
=
Email Collection (3)
=
Input Capture (4)
Screen Capture
Video Capture
=
Application Layer Protocol (5)
Communication Through Removable Media
Content Injection
=
Data Encoding (2)
=
Data Obfuscation (3)
=
Dynamic Resolution (3)
=
Encrypted Channel (2)
Fallback Channels
Hide Infrastructure
Ingress Tool Transfer
Multi-Stage Channels
Non-Application Layer Protocol
Non-Standard Port
Protocol Tunneling
=
Proxy (4)
=
Remote Access Tools (3)
=
Traffic Signaling (2)
=
Web Service (3)
=
Automated Exfiltration (1)
Data Transfer Size Limits
=
Exfiltration Over Alternative Protocol (3)
Exfiltration Over C2 Channel
=
Exfiltration Over Other Network Medium (1)
=
Exfiltration Over Physical Medium (1)
=
Exfiltration Over Web Service (4)
Scheduled Transfer
Transfer Data to Cloud Account
Account Access Removal
=
Data Destruction (1)
Data Encrypted for Impact
=
Data Manipulation (3)
=
Defacement (2)
=
Disk Wipe (2)
Email Bombing
=
Endpoint Denial of Service (4)
Financial Theft
Firmware Corruption
Inhibit System Recovery
=
Network Denial of Service (2)
=
Resource Hijacking (4)
Service Stop
System Shutdown/Reboot