Security Operations
MITRE ATT&CK Techniques
🔎
❓

Techniques

Curated Enterprise ATT&CK techniques with base risk and automation guidance.
IDNameTacticBase riskPlatformGuidance
T1003 OS Credential Dumping Credential Access
85 		Windows
T1003.001 LSASS Memory Credential Access
90 		Windows
T1003.002 Security Account Manager Credential Access
85 		Windows
T1003.004 LSA Secrets Credential Access
80 		Windows
T1003.008 NTDS Credential Access
90 		Windows
T1005 Data from Local System Collection
55 		Windows
T1007 System Service Discovery Discovery
35 		Windows
T1008 Fallback Channels Command and Control
50 		Windows, Network
T1012 Query Registry Discovery
35 		Windows
T1016 System Network Configuration Discovery Discovery
40 		Windows
T1018 Remote System Discovery Discovery
40 		Windows
T1020 Automated Exfiltration Exfiltration
65 		Windows, Network
T1021 Remote Services Lateral Movement
75 		Windows
T1021.001 Remote Desktop Protocol Lateral Movement
75 		Windows
T1021.002 SMB/Windows Admin Shares Lateral Movement
75 		Windows
T1021.003 Distributed Component Object Model Lateral Movement
70 		Windows
T1021.006 Windows Remote Management Lateral Movement
75 		Windows
T1027 Obfuscated Files or Information Defense Evasion
60 		Windows
T1027.010 Command Obfuscation Defense Evasion
60 		Windows
T1030 Data Transfer Size Limits Exfiltration
40 		Windows, Network
T1033 System Owner/User Discovery Discovery
40 		Windows
T1036 Masquerading Defense Evasion
55 		Windows
T1036.005 Match Legitimate Name or Location Defense Evasion
50 		Windows
T1039 Data from Network Shared Drive Collection
55 		Windows
T1041 Exfiltration Over C2 Channel Exfiltration
70 		Windows, Network
T1046 Network Service Discovery Discovery
40 		Windows
T1047 Windows Management Instrumentation Execution
65 		Windows
T1048 Exfiltration Over Alternative Protocol Exfiltration
70 		Windows, Network
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration
65 		Windows, Network
T1049 System Network Connections Discovery Discovery
40 		Windows
T1052 Exfiltration Over Physical Medium Exfiltration
40 		Windows
T1053 Scheduled Task/Job Execution
55 		Windows
T1053.005 Scheduled Task Execution
55 		Windows
T1055 Process Injection Privilege Escalation
75 		Windows
T1055.001 Dynamic-link Library Injection Privilege Escalation
75 		Windows
T1055.002 Portable Executable Injection Privilege Escalation
75 		Windows
T1055.012 Process Hollowing Defense Evasion
75 		Windows
T1056 Input Capture Credential Access
70 		Windows
T1056.001 Keylogging Credential Access
65 		Windows
T1057 Process Discovery Discovery
40 		Windows
T1059 Command and Scripting Interpreter Execution
65 		Windows
T1059.001 PowerShell Execution
70 		Windows
T1059.003 Windows Command Shell Execution
60 		Windows
T1059.005 Visual Basic Execution
55 		Windows
T1059.006 Python Execution
55 		Windows, Linux, macOS
T1059.007 JavaScript Execution
50 		Windows
T1068 Exploitation for Privilege Escalation Privilege Escalation
80 		Windows
T1069 Permission Groups Discovery Discovery
45 		Windows, Azure AD
T1069.002 Domain Groups Discovery
45 		Windows
T1070 Indicator Removal Defense Evasion
65 		Windows
T1070.001 Clear Windows Event Logs Defense Evasion
65 		Windows
T1070.004 File Deletion Defense Evasion
60 		Windows
T1070.006 Timestomp Defense Evasion
50 		Windows
T1071 Application Layer Protocol Command and Control
60 		Windows, Network
T1071.001 Web Protocols Command and Control
60 		Windows, Network
T1071.003 Mail Protocols Command and Control
55 		Windows, Office 365
T1071.004 DNS Command and Control
60 		Windows, Network
T1072 Software Deployment Tools Lateral Movement
70 		Windows, IaaS
T1078 Valid Accounts Initial Access
70 		Windows, Azure AD, Office 365
T1078.004 Cloud Accounts Initial Access
70 		Azure AD, Office 365
T1082 System Information Discovery Discovery
45 		Windows
T1083 File and Directory Discovery Discovery
40 		Windows
T1087 Account Discovery Discovery
45 		Windows, Azure AD
T1087.002 Domain Account Discovery
45 		Windows
T1090 Proxy Lateral Movement
55 		Windows, Network
T1090.002 External Proxy Command and Control
55 		Windows, Network
T1091 Replication Through Removable Media Initial Access
45 		Windows
T1095 Non-Application Layer Protocol Command and Control
55 		Windows, Network
T1102 Web Service Command and Control
55 		Windows, Network
T1105 Ingress Tool Transfer Command and Control
70 		Windows, Network
T1106 Native API Execution
55 		Windows
T1110 Brute Force Credential Access
70 		Windows, Azure AD
T1110.001 Password Guessing Credential Access
65 		Windows, Azure AD
T1110.002 Password Cracking Credential Access
65 		Windows
T1110.003 Password Spraying Credential Access
70 		Windows, Azure AD
T1112 Modify Registry Defense Evasion
50 		Windows
T1113 Screen Capture Collection
55 		Windows
T1114 Email Collection Collection
55 		Windows, Office 365
T1115 Clipboard Data Collection
50 		Windows
T1119 Automated Collection Collection
50 		Windows
T1120 Peripheral Device Discovery Discovery
30 		Windows
T1133 External Remote Services Initial Access
60 		Windows, Network
T1134 Access Token Manipulation Privilege Escalation
65 		Windows
T1134.001 Token Impersonation/Theft Privilege Escalation
65 		Windows
T1136 Create Account Persistence
55 		Windows, Azure AD
T1136.001 Local Account Persistence
50 		Windows
T1136.003 Cloud Account Persistence
55 		Azure AD, Office 365
T1140 Deobfuscate/Decode Files or Information Defense Evasion
55 		Windows
T1189 Drive-by Compromise Initial Access
55 		Windows
T1190 Exploit Public-Facing Application Initial Access
75 		Windows, IaaS, Network
T1200 Hardware Additions Initial Access
40 		Windows, Network
T1203 Exploitation for Client Execution Execution
70 		Windows
T1204 User Execution Execution
55 		Windows
T1204.002 Malicious File Execution
55 		Windows
T1210 Exploitation of Remote Services Lateral Movement
85 		Windows, Network
T1213 Data from Information Repositories Collection
55 		Windows, Office 365
T1218 System Binary Proxy Execution Defense Evasion
60 		Windows
T1218.005 Mshta Defense Evasion
60 		Windows
T1218.011 Rundll32 Defense Evasion
60 		Windows
T1482 Domain Trust Discovery Discovery
45 		Windows
T1485 Data Destruction Impact
85 		Windows
T1486 Data Encrypted for Impact Impact
95 		Windows
T1486.001 File and Directory Permissions Modification Impact
60 		Windows
T1489 Service Stop Impact
70 		Windows
T1490 Inhibit System Recovery Impact
90 		Windows
T1491 Defacement Impact
55 		Windows, Network
T1497 Virtualization/Sandbox Evasion Defense Evasion
40 		Windows
T1498 Network Denial of Service Impact
65 		Windows, Network
T1499 Endpoint Denial of Service Impact
70 		Windows
T1505.003 Web Shell Persistence
70 		Windows, Network
T1518 Software Discovery Discovery
40 		Windows
T1518.001 Security Software Discovery Discovery
45 		Windows
T1529 System Shutdown/Reboot Impact
55 		Windows
T1537 Transfer Data to Cloud Account Exfiltration
65 		Office 365, Azure AD
T1542 Pre-OS Boot Persistence
50 		Windows
T1543.003 Windows Service Persistence
65 		Windows
T1546 Event Triggered Execution Persistence
60 		Windows
T1546.011 Application Shimming Persistence
45 		Windows
T1547 Boot or Logon Autostart Execution Persistence
60 		Windows
T1547.001 Registry Run Keys / Startup Folder Persistence
60 		Windows
T1547.004 Winlogon Helper DLL Privilege Escalation
60 		Windows
T1547.009 Shortcut Modification Persistence
50 		Windows
T1548 Abuse Elevation Control Mechanism Privilege Escalation
65 		Windows
T1548.001 Setuid and Setgid Privilege Escalation
50 		Windows, Linux
T1548.002 Bypass User Account Control Privilege Escalation
60 		Windows
T1550 Use Alternate Authentication Material Lateral Movement
75 		Windows
T1550.002 Pass the Hash Lateral Movement
85 		Windows
T1550.003 Pass the Ticket Lateral Movement
80 		Windows
T1552 Unsecured Credentials Credential Access
70 		Windows
T1552.001 Credentials In Files Credential Access
65 		Windows
T1553 Subvert Trust Controls Defense Evasion
60 		Windows
T1555 Credentials from Password Stores Credential Access
75 		Windows
T1555.003 Credentials from Web Browsers Credential Access
70 		Windows
T1555.004 Windows Credential Manager Credential Access
70 		Windows
T1558 Steal or Forge Kerberos Tickets Credential Access
85 		Windows
T1558.003 Kerberoasting Credential Access
80 		Windows
T1558.004 AS-REP Roasting Credential Access
75 		Windows
T1559 Inter-Process Communication Execution
45 		Windows
T1560 Archive Collected Data Collection
55 		Windows
T1560.001 Archive via Utility Collection
55 		Windows
T1562 Impair Defenses Defense Evasion
70 		Windows
T1562.001 Disable or Modify Tools Defense Evasion
70 		Windows
T1562.004 Disable or Modify System Firewall Defense Evasion
65 		Windows
T1562.006 Indicator Blocking Defense Evasion
65 		Windows
T1563 Remote Service Session Hijacking Lateral Movement
70 		Windows
T1565 Data Manipulation Impact
60 		Windows, Office 365
T1566 Phishing Initial Access
60 		Windows, Office 365
T1566.001 Spearphishing Attachment Initial Access
60 		Windows, Office 365
T1566.002 Spearphishing Link Initial Access
60 		Windows, Office 365
T1567 Exfiltration Over Web Service Exfiltration
65 		Windows, Network
T1568 Dynamic Resolution Command and Control
50 		Windows, Network
T1569.002 Service Execution Execution
60 		Windows
T1570 Lateral Tool Transfer Lateral Movement
70 		Windows
T1572 Protocol Tunneling Command and Control
60 		Windows, Network
T1573 Encrypted Channel Command and Control
60 		Windows, Network
T1573.001 Symmetric Cryptography Command and Control
60 		Windows, Network
T1574 Hijack Execution Flow Persistence
65 		Windows
T1574.001 DLL Search Order Hijacking Persistence
65 		Windows
T1574.011 Services Registry Permissions Weakness Privilege Escalation
60 		Windows
T1583 Acquire Infrastructure Resource Development
30 		Windows, IaaS, Network
T1586 Compromise Accounts Resource Development
45 		Windows, IaaS
T1587 Develop Capabilities Resource Development
30 		Windows
T1588 Obtain Capabilities Resource Development
30 		Windows, IaaS
T1590 Gather Victim Network Information Reconnaissance
25 		Windows, IaaS
T1592 Gather Victim Host Information Reconnaissance
25 		Windows, IaaS
T1595 Active Scanning Reconnaissance
35 		Windows, IaaS, Network
T1615 Group Policy Discovery Discovery
35 		Windows
T1620 Reflective Code Loading Defense Evasion
65 		Windows
T1621 Multi-Factor Authentication Request Generation Credential Access
65 		Azure AD, Office 365