Adversarial Tactics, Techniques & Common Knowledge

Welcome to ATT&CK

MITRE’s Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK™) is a curated knowledge base and model for cyber adversary behavior, reflecting the various phases of an adversary’s lifecycle and the platforms they are known to target. ATT&CK is useful for understanding security risk against known adversary behavior, for planning security improvements, and verifying defenses work as expected.

PRE-ATT&CK   |   ATT&CK for Enterprise   |   ATT&CK Mobile Profile

ATT&CK for Enterprise

ATT&CK for Enterprise is an adversary behavior model that describes the actions an adversary may take while operating within an enterprise network.

• Introduction and Overview
• All Techniques
• Cyber Analytics Repository
• ATT&CK expressed in STIX
• Related Efforts
• Using the API
• Contribute or contact us

Enterprise Platform Coverage

The MITRE ATT&CK Matrix™ is a visualization of the tactics and techniques. It aligns individual techniques under the tactics in which they can be applied.

• Windows Technique Matrix
• Mac Technique Matrix
• Linux Technique Matrix

News and Updates

• July 2017
• April 2017

See Past Updates for previous changes.

ATT&CK Matrix for Enterprise

The full ATT&CK Matrix below includes techniques spanning Windows, Mac, and Linux platforms and can be used to navigate through the threat models.

Persistence	.bash_profile and .bashrc	Accessibility Features	AppInit DLLs	Application Shimming	Authentication Package	Bootkit	Change Default File Association	Component Firmware	Component Object Model Hijacking	Cron Job	DLL Search Order Hijacking	Dylib Hijacking	External Remote Services	File System Permissions Weakness	Hidden Files and Directories	Hypervisor	LC_LOAD_DYLIB Addition	Launch Agent	Launch Daemon	Launchctl	Local Port Monitor	Login Item	Logon Scripts	Modify Existing Service	Netsh Helper DLL	New Service	Office Application Startup	Path Interception	Plist Modification	Rc.common	Re-opened Applications	Redundant Access	Registry Run Keys / Start Folder	Scheduled Task	Security Support Provider	Service Registry Permissions Weakness	Shortcut Modification	Startup Items	System Firmware	Trap	Valid Accounts	Web Shell	Windows Management Instrumentation Event Subscription	Winlogon Helper DLL
Privilege Escalation	Access Token Manipulation	Accessibility Features	AppInit DLLs	Application Shimming	Bypass User Account Control	DLL Injection	DLL Search Order Hijacking	Dylib Hijacking	Exploitation of Vulnerability	File System Permissions Weakness	Launch Daemon	Local Port Monitor	New Service	Path Interception	Plist Modification	Scheduled Task	Service Registry Permissions Weakness	Setuid and Setgid	Startup Items	Sudo	Valid Accounts	Web Shell
Defense Evasion	Access Token Manipulation	Binary Padding	Bypass User Account Control	Clear Command History	Code Signing	Component Firmware	Component Object Model Hijacking	DLL Injection	DLL Search Order Hijacking	DLL Side-Loading	Deobfuscate/Decode Files or Information	Disabling Security Tools	Exploitation of Vulnerability	File Deletion	File System Logical Offsets	Gatekeeper Bypass	HISTCONTROL	Hidden Files and Directories	Hidden Users	Hidden Window	Indicator Blocking	Indicator Removal from Tools	Indicator Removal on Host	Install Root Certificate	InstallUtil	LC_MAIN Hijacking	Launchctl	Masquerading	Modify Registry	NTFS Extended Attributes	Network Share Connection Removal	Obfuscated Files or Information	Plist Modification	Process Hollowing	Redundant Access	Regsvcs/Regasm	Regsvr32	Rootkit	Rundll32	Scripting	Software Packing	Space after Filename	Timestomp	Trusted Developer Utilities	Valid Accounts
Credential Access	Account Manipulation	Bash History	Brute Force	Create Account	Credential Dumping	Credentials in Files	Exploitation of Vulnerability	Input Capture	Input Prompt	Keychain	Network Sniffing	Private Keys	Securityd Memory	Two-Factor Authentication Interception
Discovery	Account Discovery	Application Window Discovery	File and Directory Discovery	Network Service Scanning	Network Share Discovery	Peripheral Device Discovery	Permission Groups Discovery	Process Discovery	Query Registry	Remote System Discovery	Security Software Discovery	System Information Discovery	System Network Configuration Discovery	System Network Connections Discovery	System Owner/User Discovery	System Service Discovery	System Time Discovery
Lateral Movement	AppleScript	Application Deployment Software	Exploitation of Vulnerability	Logon Scripts	Pass the Hash	Pass the Ticket	Remote Desktop Protocol	Remote File Copy	Remote Services	Replication Through Removable Media	Shared Webroot	Taint Shared Content	Third-party Software	Windows Admin Shares	Windows Remote Management
Execution	AppleScript	Application Shimming	Command-Line Interface	Execution through API	Execution through Module Load	Graphical User Interface	InstallUtil	Launchctl	PowerShell	Process Hollowing	Regsvcs/Regasm	Regsvr32	Rundll32	Scheduled Task	Scripting	Service Execution	Source	Space after Filename	Third-party Software	Trap	Trusted Developer Utilities	Windows Management Instrumentation	Windows Remote Management
Collection	Audio Capture	Automated Collection	Clipboard Data	Data Staged	Data from Local System	Data from Network Shared Drive	Data from Removable Media	Email Collection	Input Capture	Screen Capture	Video Capture
Exfiltration	Automated Exfiltration	Data Compressed	Data Encrypted	Data Transfer Size Limits	Exfiltration Over Alternative Protocol	Exfiltration Over Command and Control Channel	Exfiltration Over Other Network Medium	Exfiltration Over Physical Medium	Scheduled Transfer
Command and Control	Commonly Used Port	Communication Through Removable Media	Connection Proxy	Custom Command and Control Protocol	Custom Cryptographic Protocol	Data Encoding	Data Obfuscation	Fallback Channels	Multi-Stage Channels	Multiband Communication	Multilayer Encryption	Remote File Copy	Standard Application Layer Protocol	Standard Cryptographic Protocol	Standard Non-Application Layer Protocol	Uncommonly Used Port	Web Service