1200km / attack & detection modules
Interactive ATT&CK
& ATLAS matrix
From an adversary technique to its local workspace. Explore tactics, open TTP pages, and follow the connected simulation, detection and telemetry evidence.
Explore the matrix
Enterprise, Mobile and ICS are ATT&CK domains. ATLAS is a separate AI-security framework. IoT/OT and cloud are explicitly labelled 1200km navigation views.
Platform, telemetry and simulation filters
The complete static matrices below work without JavaScript. Interactive filters load when available.
Scroll within each matrix to explore tactics, or choose the wrapped layout. Use each parent’s disclosure control to show its sub-techniques. Counts are unique techniques plus sub-techniques, not the number of tactic cells.
MITRE ATT&CK Enterprise 19.2 · 697 unique techniques and sub-techniques
Reconnaissance46 matching entries
2 sub-techniques
Resource Development50 matching entries
Initial Access22 matching entries
Execution64 matching entries
12 sub-techniques
3 sub-techniques
Persistence113 matching entries
14 sub-techniques
18 sub-techniques
9 sub-techniques
Privilege Escalation96 matching entries
14 sub-techniques
2 sub-techniques
18 sub-techniques
12 sub-techniques
Stealth148 matching entries
14 sub-techniques
12 sub-techniques
12 sub-techniques
18 sub-techniques
12 sub-techniques
3 sub-techniques
Defense Impairment56 matching entries
2 sub-techniques
2 sub-techniques
9 sub-techniques
Credential Access67 matching entries
9 sub-techniques
Discovery49 matching entries
3 sub-techniques
2 sub-techniques
Lateral Movement23 matching entries
Collection41 matching entries
Command and Control45 matching entries
2 sub-techniques
Exfiltration19 matching entries
1 sub-technique
Impact33 matching entries
1 sub-technique
2 sub-techniques
MITRE ATT&CK Mobile 19.2 · 124 unique techniques and sub-techniques
Initial Access11 matching entries
Execution5 matching entries
1 sub-technique
Persistence10 matching entries
1 sub-technique
Privilege Escalation5 matching entries
1 sub-technique
Defense Evasion33 matching entries
1 sub-technique
1 sub-technique
1 sub-technique
1 sub-technique
Credential Access10 matching entries
1 sub-technique
2 sub-techniques
1 sub-technique
Discovery13 matching entries
1 sub-technique
2 sub-techniques
Lateral Movement2 matching entries
Collection24 matching entries
2 sub-techniques
Command and Control17 matching entries
1 sub-technique
1 sub-technique
Exfiltration3 matching entries
1 sub-technique
Impact11 matching entries
1 sub-technique
MITRE ATT&CK ICS 19.2 · 97 unique techniques and sub-techniques
Initial Access12 matching entries
Execution10 matching entries
Persistence10 matching entries
Privilege Escalation2 matching entries
Evasion9 matching entries
Discovery8 matching entries
Lateral Movement11 matching entries
3 sub-techniques
Collection11 matching entries
Command and Control3 matching entries
Inhibit Response Function20 matching entries
2 sub-techniques
Impair Process Control8 matching entries
Impact12 matching entries
MITRE ATLAS 2026.09 · 208 unique techniques and sub-techniques
Reconnaissance18 matching entries
Resource Development29 matching entries
AI Attack Adaptation25 matching entries
Initial Access18 matching entries
AI Model Access4 matching entries
Execution13 matching entries
3 sub-techniques
Persistence20 matching entries
Privilege Escalation4 matching entries
Defense Evasion19 matching entries
Credential Access7 matching entries
Discovery17 matching entries
Lateral Movement9 matching entries
Collection8 matching entries
Command and Control5 matching entries
Exfiltration9 matching entries
Impact20 matching entries
Evidence, scope and source versions
- Documented candidate: at least one compatible procedure in the pinned catalog; not an executed, reviewed or fully integrated simulation. No catalog candidate: unsupported in the current evidence set, not technically impossible. Not assessed: ATLAS has reference pages, not an ATT&CK lab-coverage assessment.
- Telemetry filters use existing technique-to-collection mappings. A match is not proof that an individual rule detects the technique. ATLAS has no asserted telemetry mapping here.
- The IoT/OT view combines ICS with Enterprise Network Devices. It is not an official or exhaustive IoT matrix. Cloud selects explicit cloud/service platforms. Both retain source-domain boundaries.
- All active entries in the pinned datasets are represented. Revoked and deprecated ATT&CK entries remain excluded under the existing catalog policy.
ATT&CK 19.2 · ATLAS 2026.09 (data format 6.0.0) · imported 2026-09-28. Sources are pinned, not a live feed.
Pinned enterprise STIX · Pinned mobile STIX · Pinned ics STIX · Pinned ATLAS YAML · Versions and SHA-256 hashes · Simulation catalog provenance
MITRE Enterprise · MITRE Mobile · MITRE ICS · MITRE ATLAS · ATLAS attribution · Apache 2.0 license
ATT&CK is a registered trademark and ATLAS is a trademark of The MITRE Corporation. This independently built 1200km navigation module does not imply MITRE endorsement.