Skip to content

Threat actors

178 groups tracked by MITRE ATT&CK, the 227 techniques they use and the 622 tools they share. Origins are quoted from MITRE’s own descriptions.

Techniques by tactic

Reconnaissance

Gather Victim Identity Information Phishing for Information Active Scanning Gather Victim Org Information Search Open Websites/Domains Gather Victim Network Information Search Victim-Owned Websites Gather Victim Host Information Search Open Technical Databases Query Public AI Services Search Threat Vendor Data Search Closed Sources

Resource Development

Obtain Capabilities Acquire Infrastructure Stage Capabilities Develop Capabilities Establish Accounts Compromise Infrastructure Compromise Accounts Generate Content Acquire Access

Initial Access

Phishing Valid Accounts Exploit Public-Facing Application Drive-by Compromise External Remote Services Supply Chain Compromise Trusted Relationship Replication Through Removable Media Content Injection Hardware Additions Wi-Fi Networks

Execution

Command and Scripting Interpreter User Execution Scheduled Task/Job Windows Management Instrumentation Exploitation for Client Execution Hijack Execution Flow Native API System Services Inter-Process Communication Software Deployment Tools BITS Jobs Deploy Container Poisoned Pipeline Execution Cloud Administration Command Shared Modules ESXi Administration Command Input Injection Container Administration Command Serverless Execution Trusted Developer Utilities Proxy Execution Indirect Prompt Injection Direct Prompt Injection

Persistence

Valid Accounts Boot or Logon Autostart Execution Scheduled Task/Job Server Software Component Create or Modify System Process Modify Registry External Remote Services Create Account Event Triggered Execution Account Manipulation Modify Authentication Process Boot or Logon Initialization Scripts Office Application Startup BITS Jobs Traffic Signaling Pre-OS Boot Software Extensions Compromise Host Software Binary Implant Internal Image Cloud Application Integration Exclusive Control Power Settings

Privilege Escalation

Valid Accounts Boot or Logon Autostart Execution Scheduled Task/Job Create or Modify System Process Process Injection Exploitation for Privilege Escalation Event Triggered Execution Account Manipulation Abuse Elevation Control Mechanism Access Token Manipulation Boot or Logon Initialization Scripts Domain or Tenant Policy Modification Escape to Host

Stealth

Obfuscated Files or Information Masquerading Valid Accounts Indicator Removal System Binary Proxy Execution Deobfuscate/Decode Files or Information Hijack Execution Flow Hide Artifacts Process Injection Social Engineering Virtualization/Sandbox Evasion Access Token Manipulation Execution Guardrails Template Injection Rootkit Reflective Code Loading BITS Jobs Traffic Signaling Pre-OS Boot Delay Execution Direct Volume Access Indirect Command Execution XSL Script Processing Exploitation for Stealth Selective Exclusion Debugger Evasion System Script Proxy Execution Unused/Unsupported Cloud Regions Build Image on Host Trusted Developer Utilities Proxy Execution Anti-Automation Evasion

Defense Impairment

Disable or Modify Tools Subvert Trust Controls Modify Registry Disable or Modify System Firewall Modify Authentication Process File and Directory Permissions Modification Domain or Tenant Policy Modification Prevent Command History Logging Modify Cloud Compute Infrastructure Network Boundary Bridging Exploitation for Defense Impairment Modify Cloud Resource Hierarchy Weaken Encryption Downgrade Attack Rogue Domain Controller Plist File Modification Modify System Image Safe Mode Boot

Credential Access

OS Credential Dumping Credentials from Password Stores Input Capture Brute Force Unsecured Credentials Modify Authentication Process Adversary-in-the-Middle Steal Web Session Cookie Network Sniffing Steal or Forge Kerberos Tickets Steal Application Access Token Multi-Factor Authentication Interception Multi-Factor Authentication Request Generation Steal or Forge Authentication Certificates Forced Authentication Exploitation for Credential Access Steal Application Specific Passwords Forge Web Credentials

Discovery

System Information Discovery File and Directory Discovery System Network Configuration Discovery Remote System Discovery Account Discovery Process Discovery System Owner/User Discovery System Network Connections Discovery Network Service Discovery Software Discovery Permission Groups Discovery Query Registry System Service Discovery Network Share Discovery System Time Discovery Domain Trust Discovery Virtualization/Sandbox Evasion Local Storage Discovery Peripheral Device Discovery Network Sniffing Browser Information Discovery System Location Discovery Log Enumeration Application Window Discovery Cloud Infrastructure Discovery Password Policy Discovery Container and Resource Discovery Group Policy Discovery Device Driver Discovery Virtual Machine Discovery Cloud Storage Object Discovery Cloud Service Discovery Cloud Service Dashboard Debugger Evasion

Lateral Movement

Remote Services Lateral Tool Transfer Use Alternate Authentication Material Exploitation of Remote Services Software Deployment Tools Replication Through Removable Media Internal Spearphishing Taint Shared Content Remote Service Session Hijacking

Collection

Archive Collected Data Data from Local System Data Staged Input Capture Email Collection Automated Collection Screen Capture Data from Information Repositories Data from Network Shared Drive Adversary-in-the-Middle Data from Cloud Storage Data from Removable Media Clipboard Data Video Capture Audio Capture Data from Configuration Repository Browser Session Hijacking

Command and Control

Ingress Tool Transfer Application Layer Protocol Proxy Web Service Encrypted Channel Remote Access Tools Non-Standard Port Protocol Tunneling Data Encoding Dynamic Resolution Non-Application Layer Protocol Data Obfuscation Fallback Channels Traffic Signaling Multi-Stage Channels Hide Infrastructure Content Injection Communication Through Removable Media

Exfiltration

Exfiltration Over Web Service Exfiltration Over C2 Channel Exfiltration Over Alternative Protocol Automated Exfiltration Data Transfer Size Limits Transfer Data to Cloud Account Exfiltration Over Physical Medium Scheduled Transfer Exfiltration Over Other Network Medium AI-Enabled Exfiltration

Impact

Data Encrypted for Impact Financial Theft Data Destruction Disk Wipe Service Stop Inhibit System Recovery Defacement Resource Hijacking System Shutdown/Reboot Data Manipulation Account Access Removal Email Bombing Endpoint Denial of Service Network Denial of Service Firmware Corruption