Thank you to Tidal Cyber and SOC Prime for becoming ATT&CK's first Benefactors. To join the cohort, or learn more about this program visit our Benefactors page.

PRE Matrix

Below are the tactics and techniques representing the MITRE ATT&CK^® Matrix for Enterprise covering preparatory techniques. The Matrix contains information for the PRE platform.

View on the ATT&CK^® Navigator

Version Permalink

Live Version

Resource Development

10 techniques

8 techniques

Active Scanning ₍₃₎

Gather Victim Host Information ₍₄₎

Gather Victim Identity Information ₍₃₎

Gather Victim Network Information ₍₆₎

Gather Victim Org Information ₍₄₎

Phishing for Information ₍₄₎

Search Closed Sources ₍₂₎

Search Open Technical Databases ₍₅₎

Search Open Websites/Domains ₍₃₎

Search Victim-Owned Websites

Acquire Infrastructure ₍₈₎

Compromise Accounts ₍₃₎

Compromise Infrastructure ₍₇₎

Develop Capabilities ₍₄₎

Establish Accounts ₍₃₎

Obtain Capabilities ₍₆₎

Stage Capabilities ₍₆₎

Resource Development

10 techniques

8 techniques

=	Active Scanning ₍₃₎
	Scanning IP Blocks Vulnerability Scanning Wordlist Scanning

=	Gather Victim Host Information ₍₄₎
	Hardware Software Firmware Client Configurations

=	Gather Victim Identity Information ₍₃₎
	Credentials Email Addresses Employee Names

=	Gather Victim Network Information ₍₆₎
	Domain Properties DNS Network Trust Dependencies Network Topology IP Addresses Network Security Appliances

=	Gather Victim Org Information ₍₄₎
	Determine Physical Locations Business Relationships Identify Business Tempo Identify Roles

=	Phishing for Information ₍₄₎
	Spearphishing Service Spearphishing Attachment Spearphishing Link Spearphishing Voice

=	Search Closed Sources ₍₂₎
	Threat Intel Vendors Purchase Technical Data

=	Search Open Technical Databases ₍₅₎
	DNS/Passive DNS WHOIS Digital Certificates CDNs Scan Databases

=	Search Open Websites/Domains ₍₃₎
	Social Media Search Engines Code Repositories

Search Victim-Owned Websites

=	Acquire Infrastructure ₍₈₎
	Domains DNS Server Virtual Private Server Server Botnet Web Services Serverless Malvertising

=	Compromise Accounts ₍₃₎
	Social Media Accounts Email Accounts Cloud Accounts

=	Compromise Infrastructure ₍₇₎
	Domains DNS Server Virtual Private Server Server Botnet Web Services Serverless

=	Develop Capabilities ₍₄₎
	Malware Code Signing Certificates Digital Certificates Exploits

=	Establish Accounts ₍₃₎
	Social Media Accounts Email Accounts Cloud Accounts

=	Obtain Capabilities ₍₆₎
	Malware Tool Code Signing Certificates Digital Certificates Exploits Vulnerabilities

=	Stage Capabilities ₍₆₎
	Upload Malware Upload Tool Install Digital Certificate Drive-by Target Link Target SEO Poisoning