ATT&CKMatrix

Enterprise matrix

Shade shows how many procedure examples MITRE documents for a technique, counting its sub-techniques. The number on the right is the sub-technique count. Scroll the matrix sideways to see all 15 tactics.

none1 to 78 to 4041 to 173more than 173

Reconnaissance12 techniques

Active Scanning3 Gather Victim Host Information4 Gather Victim Identity Information3 Gather Victim Network Information6 Gather Victim Org Information4 Phishing for Information4 Query Public AI Services Search Closed Sources2 Search Open Technical Databases5 Search Open Websites/Domains3 Search Threat Vendor Data Search Victim-Owned Websites

Resource Development9 techniques

Acquire Access Acquire Infrastructure8 Compromise Accounts3 Compromise Infrastructure8 Develop Capabilities4 Establish Accounts3 Generate Content2 Obtain Capabilities7 Stage Capabilities6

Initial Access11 techniques

Content Injection Drive-by Compromise Exploit Public-Facing Application External Remote Services Hardware Additions Phishing4 Replication Through Removable Media Supply Chain Compromise3 Trusted Relationship Valid Accounts4 Wi-Fi Networks

Privilege Escalation13 techniques

Abuse Elevation Control Mechanism6 Access Token Manipulation5 Account Manipulation7 Boot or Logon Autostart Execution14 Boot or Logon Initialization Scripts5 Create or Modify System Process5 Domain or Tenant Policy Modification2 Escape to Host Event Triggered Execution18 Exploitation for Privilege Escalation Process Injection12 Scheduled Task/Job5 Valid Accounts4

Defense Impairment18 techniques

Disable or Modify System Firewall3 Disable or Modify Tools6 Domain or Tenant Policy Modification2 Downgrade Attack Exploitation for Defense Impairment File and Directory Permissions Modification2 Modify Authentication Process9 Modify Cloud Compute Infrastructure5 Modify Cloud Resource Hierarchy Modify Registry Modify System Image2 Network Boundary Bridging1 Plist File Modification Prevent Command History Logging Rogue Domain Controller Safe Mode Boot Subvert Trust Controls6 Weaken Encryption2

Credential Access17 techniques

Adversary-in-the-Middle4 Brute Force4 Credentials from Password Stores6 Exploitation for Credential Access Forced Authentication Forge Web Credentials2 Input Capture4 Modify Authentication Process9 Multi-Factor Authentication Interception Multi-Factor Authentication Request Generation Network Sniffing OS Credential Dumping8 Steal Application Access Token Steal or Forge Authentication Certificates Steal or Forge Kerberos Tickets5 Steal Web Session Cookie Unsecured Credentials8

Discovery34 techniques

Account Discovery4 Application Window Discovery Browser Information Discovery Cloud Infrastructure Discovery Cloud Service Dashboard Cloud Service Discovery Cloud Storage Object Discovery Container and Resource Discovery Debugger Evasion Device Driver Discovery Domain Trust Discovery File and Directory Discovery Group Policy Discovery Local Storage Discovery Log Enumeration Network Service Discovery Network Share Discovery Network Sniffing Password Policy Discovery Peripheral Device Discovery Permission Groups Discovery3 Process Discovery Query Registry Remote System Discovery Software Discovery2 System Information Discovery System Location Discovery1 System Network Configuration Discovery2 System Network Connections Discovery System Owner/User Discovery System Service Discovery System Time Discovery Virtual Machine Discovery Virtualization/Sandbox Evasion3

Lateral Movement9 techniques

Exploitation of Remote Services Internal Spearphishing Lateral Tool Transfer Remote Service Session Hijacking2 Remote Services8 Replication Through Removable Media Software Deployment Tools Taint Shared Content Use Alternate Authentication Material4

Collection17 techniques

Adversary-in-the-Middle4 Archive Collected Data3 Audio Capture Automated Collection Browser Session Hijacking Clipboard Data Data from Cloud Storage Data from Configuration Repository2 Data from Information Repositories6 Data from Local System Data from Network Shared Drive Data from Removable Media Data Staged2 Email Collection3 Input Capture4 Screen Capture Video Capture

Command and Control18 techniques

Application Layer Protocol5 Communication Through Removable Media Content Injection Data Encoding2 Data Obfuscation3 Dynamic Resolution3 Encrypted Channel2 Fallback Channels Hide Infrastructure Ingress Tool Transfer Multi-Stage Channels Non-Application Layer Protocol Non-Standard Port Protocol Tunneling Proxy4 Remote Access Tools3 Traffic Signaling2 Web Service3

Exfiltration9 techniques

Automated Exfiltration1 Data Transfer Size Limits Exfiltration Over Alternative Protocol3 Exfiltration Over C2 Channel Exfiltration Over Other Network Medium1 Exfiltration Over Physical Medium1 Exfiltration Over Web Service4 Scheduled Transfer Transfer Data to Cloud Account

Impact15 techniques

Account Access Removal Data Destruction1 Data Encrypted for Impact Data Manipulation3 Defacement2 Disk Wipe2 Email Bombing Endpoint Denial of Service4 Financial Theft Firmware Corruption Inhibit System Recovery Network Denial of Service2 Resource Hijacking4 Service Stop System Shutdown/Reboot

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.