1. Home
  2. Matrices
  3. Enterprise
  4. Network

Network Matrix

Below are the tactics and techniques representing the MITRE ATT&CK® Network platform. The techniques below are known to target network devices such as routers, switches, and load balancers. The Matrix contains information for the Network platform.

View on the ATT&CK® Navigator
Version Permalink
Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
2 techniques 2 techniques 10 techniques 4 techniques 11 techniques 6 techniques 11 techniques 1 techniques 4 techniques 7 techniques 2 techniques 4 techniques
Exploit Public-Facing Application
Valid Accounts (2)
=
Command and Scripting Interpreter (3)
=
Software Deployment Tools
Account Manipulation (1)
=
Boot or Logon Autostart Execution
Boot or Logon Initialization Scripts (1)
=
Create Account (1)
=
Modify Authentication Process (1)
=
Power Settings
Pre-OS Boot (3)
=
Server Software Component (1)
=
Traffic Signaling (1)
=
Valid Accounts (2)
=
Account Manipulation (1)
=
Boot or Logon Autostart Execution
Boot or Logon Initialization Scripts (1)
=
Valid Accounts (2)
=
Direct Volume Access
Impair Defenses (3)
=
Indicator Removal (3)
=
Modify Authentication Process (1)
=
Modify System Image (2)
=
Network Boundary Bridging (1)
=
Obfuscated Files or Information (1)
=
Pre-OS Boot (3)
=
Traffic Signaling (1)
=
Valid Accounts (2)
=
Weaken Encryption (2)
=
Adversary-in-the-Middle (1)
=
Brute Force (4)
=
Input Capture (1)
=
Modify Authentication Process (1)
=
Network Sniffing
Unsecured Credentials (1)
=
File and Directory Discovery
Network Service Discovery
Network Sniffing
Password Policy Discovery
Process Discovery
Remote System Discovery
System Information Discovery
System Network Configuration Discovery
System Network Connections Discovery
System Owner/User Discovery
System Time Discovery
Software Deployment Tools
Adversary-in-the-Middle (1)
=
Data from Configuration Repository (2)
=
Data from Local System
Input Capture (1)
=
Application Layer Protocol (5)
=
Encrypted Channel (2)
=
Hide Infrastructure
Ingress Tool Transfer
Non-Application Layer Protocol
Proxy (3)
=
Traffic Signaling (1)
=
Automated Exfiltration (1)
=
Exfiltration Over Alternative Protocol (1)
=
Disk Wipe (2)
=
Firmware Corruption
Inhibit System Recovery
System Shutdown/Reboot
Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
2 techniques 2 techniques 10 techniques 4 techniques 11 techniques 6 techniques 11 techniques 1 techniques 4 techniques 7 techniques 2 techniques 4 techniques
Exploit Public-Facing Application
=
Valid Accounts (2)
=
Command and Scripting Interpreter (3)
Software Deployment Tools
=
Account Manipulation (1)
Boot or Logon Autostart Execution
=
Boot or Logon Initialization Scripts (1)
=
Create Account (1)
=
Modify Authentication Process (1)
Power Settings
=
Pre-OS Boot (3)
=
Server Software Component (1)
=
Traffic Signaling (1)
=
Valid Accounts (2)
=
Account Manipulation (1)
Boot or Logon Autostart Execution
=
Boot or Logon Initialization Scripts (1)
=
Valid Accounts (2)
Direct Volume Access
=
Impair Defenses (3)
=
Indicator Removal (3)
=
Modify Authentication Process (1)
=
Modify System Image (2)
=
Network Boundary Bridging (1)
=
Obfuscated Files or Information (1)
=
Pre-OS Boot (3)
=
Traffic Signaling (1)
=
Valid Accounts (2)
=
Weaken Encryption (2)
=
Adversary-in-the-Middle (1)
=
Brute Force (4)
=
Input Capture (1)
=
Modify Authentication Process (1)
Network Sniffing
=
Unsecured Credentials (1)
File and Directory Discovery
Network Service Discovery
Network Sniffing
Password Policy Discovery
Process Discovery
Remote System Discovery
System Information Discovery
System Network Configuration Discovery
System Network Connections Discovery
System Owner/User Discovery
System Time Discovery
Software Deployment Tools
=
Adversary-in-the-Middle (1)
=
Data from Configuration Repository (2)
Data from Local System
=
Input Capture (1)
=
Application Layer Protocol (5)
=
Encrypted Channel (2)
Hide Infrastructure
Ingress Tool Transfer
Non-Application Layer Protocol
=
Proxy (3)
=
Traffic Signaling (1)
=
Automated Exfiltration (1)
=
Exfiltration Over Alternative Protocol (1)
=
Disk Wipe (2)
Firmware Corruption
Inhibit System Recovery
System Shutdown/Reboot