MITRE ATT&CK · CVEKit

LIVE

Top ATT&CK

50 · technique

Techniques

222

Sub-techniques

475

Mapped

153

Coverage

68.9%

CVE mappings

5.8k

Tactics

14

MITRE ATT&CK Matrix

drag to scroll →

Reconnaissance

TA00437/12

Active Scanning

Gather Victim Identity Information

Gather Victim Host Information

Gather Victim Network Information

Search Open Websites/Domains

Search Open Technical Databases

Search Closed Sources

Gather Victim Org Information

Search Victim-Owned Websites

Phishing for Information

Search Threat Vendor Data

Query Public AI Services

Resource Development

TA00425/9

Stage Capabilities

Obtain Capabilities

Acquire Infrastructure

Compromise Infrastructure

Develop Capabilities

Establish Accounts

Compromise Accounts

Generate Content

Initial Access

TA00019/11

Exploit Public-Facing Application

Drive-by Compromise

External Remote Services

Replication Through Removable Media

Supply Chain Compromise

Trusted Relationship

Hardware Additions

Content Injection

Privilege Escalation

TA000412/13

Exploitation for Privilege Escalation

Process Injection

Account Manipulation

Abuse Elevation Control Mechanism

Boot or Logon Autostart Execution

Scheduled Task/Job

Create or Modify System Process

Access Token Manipulation

Event Triggered Execution

Domain or Tenant Policy Modification

Boot or Logon Initialization Scripts

Defense Evasion

TA00050/0

no techniques

Credential Access

TA000615/17

OS Credential Dumping

Adversary-in-the-Middle

Unsecured Credentials

Steal Web Session Cookie

Network Sniffing

Exploitation for Credential Access

Multi-Factor Authentication Interception

Steal Application Access Token

Credentials from Password Stores

Forced Authentication

Modify Authentication Process

Steal or Forge Kerberos Tickets

Forge Web Credentials

Multi-Factor Authentication Request Generation

Steal or Forge Authentication Certificates

Discovery

TA000722/34

System Information Discovery

File and Directory Discovery

Remote System Discovery

Process Discovery

Virtualization/Sandbox Evasion

System Owner/User Discovery

Software Discovery

System Network Configuration Discovery

Network Service Discovery

Application Window Discovery

Account Discovery

System Network Connections Discovery

Network Sniffing

System Time Discovery

Network Share Discovery

System Location Discovery

Permission Groups Discovery

Peripheral Device Discovery

Domain Trust Discovery

System Service Discovery

Container and Resource Discovery

Password Policy Discovery

Browser Information Discovery

Cloud Service Discovery

Cloud Service Dashboard

Cloud Infrastructure Discovery

Group Policy Discovery

Cloud Storage Object Discovery

Debugger Evasion

Device Driver Discovery

Log Enumeration

Virtual Machine Discovery

Local Storage Discovery

Lateral Movement

TA00089/9

Remote Services

Replication Through Removable Media

Exploitation of Remote Services

Use Alternate Authentication Material

Remote Service Session Hijacking

Lateral Tool Transfer

Taint Shared Content

Software Deployment Tools

Internal Spearphishing

Collection

TA000915/17

Data from Local System

Adversary-in-the-Middle

Browser Session Hijacking

Data from Information Repositories

Archive Collected Data

Data from Cloud Storage

Email Collection

Automated Collection

Data from Network Shared Drive

Data from Removable Media

Data from Configuration Repository

Command and Control

TA001114/18

Ingress Tool Transfer

Encrypted Channel

Application Layer Protocol

Non-Application Layer Protocol

Data Obfuscation

Non-Standard Port

Protocol Tunneling

Remote Access Tools

Fallback Channels

Multi-Stage Channels

Dynamic Resolution

Communication Through Removable Media

Traffic Signaling

Content Injection

Hide Infrastructure

Exfiltration

TA00105/9

Exfiltration Over C2 Channel

Automated Exfiltration

Exfiltration Over Web Service

Exfiltration Over Alternative Protocol

Data Transfer Size Limits

Exfiltration Over Other Network Medium

Scheduled Transfer

Exfiltration Over Physical Medium

Transfer Data to Cloud Account

Impact

TA004012/15

Data Destruction

Resource Hijacking

Data Manipulation

Data Encrypted for Impact

Endpoint Denial of Service

Inhibit System Recovery

Network Denial of Service

System Shutdown/Reboot

Account Access Removal

Firmware Corruption

Financial Theft

Tactic Coverage

14 tactics

Reconnaissance7/12
Resource Development5/9
Initial Access9/11
Execution14/20
Persistence15/22
Privilege Escalation12/13
Defense Evasion0/0
Credential Access15/17
Discovery22/34
Lateral Movement9/9
Collection15/17
Command and Control14/18
Exfiltration5/9
Impact12/15

Legend:50+10–491–90