Loading interactive filters…
1200KM / index
Attack Simulations
Explore all active ATT&CK techniques by simulation feasibility, platforms, environments, tools, telemetry and detection evidence. Documented candidates are not live-validated simulations.
Explore the matrix
Interactive ATT&CK & ATLAS Matrix — browse Enterprise, Mobile, ICS and AI technique pages by tactic.
Complete reference directory
- T1001 Data Obfuscation
- T1001.001 Junk Data
- T1001.002 Steganography
- T1001.003 Protocol or Service Impersonation
- T1003 OS Credential Dumping
- T1003.001 LSASS Memory
- T1003.002 Security Account Manager
- T1003.003 NTDS
- T1003.004 LSA Secrets
- T1003.005 Cached Domain Credentials
- T1003.006 DCSync
- T1003.007 Proc Filesystem
- T1003.008 /etc/passwd and /etc/shadow
- T1005 Data from Local System
- T1006 Direct Volume Access
- T1007 System Service Discovery
- T1008 Fallback Channels
- T1010 Application Window Discovery
- T1011 Exfiltration Over Other Network Medium
- T1011.001 Exfiltration Over Bluetooth
- T1012 Query Registry
- T1014 Rootkit
- T1016 System Network Configuration Discovery
- T1016.001 Internet Connection Discovery
- T1016.002 Wi-Fi Discovery
- T1018 Remote System Discovery
- T1020 Automated Exfiltration
- T1020.001 Traffic Duplication
- T1021 Remote Services
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1021.003 Distributed Component Object Model
- T1021.004 SSH
- T1021.005 VNC
- T1021.006 Windows Remote Management
- T1021.007 Cloud Services
- T1021.008 Direct Cloud VM Connections
- T1025 Data from Removable Media
- T1027 Obfuscated Files or Information
- T1027.001 Binary Padding
- T1027.002 Software Packing
- T1027.003 Steganography
- T1027.004 Compile After Delivery
- T1027.005 Indicator Removal from Tools
- T1027.006 HTML Smuggling
- T1027.007 Dynamic API Resolution
- T1027.008 Stripped Payloads
- T1027.009 Embedded Payloads
- T1027.010 Command Obfuscation
- T1027.011 Fileless Storage
- T1027.012 LNK Icon Smuggling
- T1027.013 Encrypted/Encoded File
- T1027.014 Polymorphic Code
- T1027.015 Compression
- T1027.016 Junk Code Insertion
- T1027.017 SVG Smuggling
- T1027.018 Invisible Unicode
- T1029 Scheduled Transfer
- T1030 Data Transfer Size Limits
- T1033 System Owner/User Discovery
- T1036 Masquerading
- T1036.001 Invalid Code Signature
- T1036.002 Right-to-Left Override
- T1036.003 Rename Legitimate Utilities
- T1036.004 Masquerade Task or Service
- T1036.005 Match Legitimate Resource Name or Location
- T1036.006 Space after Filename
- T1036.007 Double File Extension
- T1036.008 Masquerade File Type
- T1036.009 Break Process Trees
- T1036.010 Masquerade Account Name
- T1036.011 Overwrite Process Arguments
- T1036.012 Browser Fingerprint
- T1037 Boot or Logon Initialization Scripts
- T1037.001 Logon Script (Windows)
- T1037.002 Login Hook
- T1037.003 Network Logon Script
- T1037.004 RC Scripts
- T1037.005 Startup Items
- T1039 Data from Network Shared Drive
- T1040 Network Sniffing
- T1041 Exfiltration Over C2 Channel
- T1046 Network Service Discovery
- T1047 Windows Management Instrumentation
- T1048 Exfiltration Over Alternative Protocol
- T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1049 System Network Connections Discovery
- T1052 Exfiltration Over Physical Medium
- T1052.001 Exfiltration over USB
- T1053 Scheduled Task/Job
- T1053.002 At
- T1053.003 Cron
- T1053.005 Scheduled Task
- T1053.006 Systemd Timers
- T1053.007 Container Orchestration Job
- T1055 Process Injection
- T1055.001 Dynamic-link Library Injection
- T1055.002 Portable Executable Injection
- T1055.003 Thread Execution Hijacking
- T1055.004 Asynchronous Procedure Call
- T1055.005 Thread Local Storage
- T1055.008 Ptrace System Calls
- T1055.009 Proc Memory
- T1055.011 Extra Window Memory Injection
- T1055.012 Process Hollowing
- T1055.013 Process Doppelgänging
- T1055.014 VDSO Hijacking
- T1055.015 ListPlanting
- T1056 Input Capture
- T1056.001 Keylogging
- T1056.002 GUI Input Capture
- T1056.003 Web Portal Capture
- T1056.004 Credential API Hooking
- T1057 Process Discovery
- T1059 Command and Scripting Interpreter
- T1059.001 PowerShell
- T1059.002 AppleScript
- T1059.003 Windows Command Shell
- T1059.004 Unix Shell
- T1059.005 Visual Basic
- T1059.006 Python
- T1059.007 JavaScript
- T1059.008 Network Device CLI
- T1059.009 Cloud API
- T1059.010 AutoHotKey & AutoIT
- T1059.011 Lua
- T1059.012 Hypervisor CLI
- T1059.013 Container CLI/API
- T1068 Exploitation for Privilege Escalation
- T1069 Permission Groups Discovery
- T1069.001 Local Groups
- T1069.002 Domain Groups
- T1069.003 Cloud Groups
- T1070 Indicator Removal
- T1070.003 Clear Command History
- T1070.004 File Deletion
- T1070.005 Network Share Connection Removal
- T1070.006 Timestomp
- T1070.007 Clear Network Connection History and Configurations
- T1070.008 Clear Mailbox Data
- T1070.009 Clear Persistence
- T1070.010 Relocate Malware
- T1071 Application Layer Protocol
- T1071.001 Web Protocols
- T1071.002 File Transfer Protocols
- T1071.003 Mail Protocols
- T1071.004 DNS
- T1071.005 Publish/Subscribe Protocols
- T1072 Software Deployment Tools
- T1074 Data Staged
- T1074.001 Local Data Staging
- T1074.002 Remote Data Staging
- T1078 Valid Accounts
- T1078.001 Default Accounts
- T1078.002 Domain Accounts
- T1078.003 Local Accounts
- T1078.004 Cloud Accounts
- T1080 Taint Shared Content
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1087 Account Discovery
- T1087.001 Local Account
- T1087.002 Domain Account
- T1087.003 Email Account
- T1087.004 Cloud Account
- T1090 Proxy
- T1090.001 Internal Proxy
- T1090.002 External Proxy
- T1090.003 Multi-hop Proxy
- T1090.004 Domain Fronting
- T1091 Replication Through Removable Media
- T1092 Communication Through Removable Media
- T1095 Non-Application Layer Protocol
- T1098 Account Manipulation
- T1098.001 Additional Cloud Credentials
- T1098.002 Additional Email Delegate Permissions
- T1098.003 Additional Cloud Roles
- T1098.004 SSH Authorized Keys
- T1098.005 Device Registration
- T1098.006 Additional Container Cluster Roles
- T1098.007 Additional Local or Domain Groups
- T1102 Web Service
- T1102.001 Dead Drop Resolver
- T1102.002 Bidirectional Communication
- T1102.003 One-Way Communication
- T1104 Multi-Stage Channels
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1110 Brute Force
- T1110.001 Password Guessing
- T1110.002 Password Cracking
- T1110.003 Password Spraying
- T1110.004 Credential Stuffing
- T1111 Multi-Factor Authentication Interception
- T1112 Modify Registry
- T1113 Screen Capture
- T1114 Email Collection
- T1114.001 Local Email Collection
- T1114.002 Remote Email Collection
- T1114.003 Email Forwarding Rule
- T1115 Clipboard Data
- T1119 Automated Collection
- T1120 Peripheral Device Discovery
- T1123 Audio Capture
- T1124 System Time Discovery
- T1125 Video Capture
- T1127 Trusted Developer Utilities Proxy Execution
- T1127.001 MSBuild
- T1127.002 ClickOnce
- T1127.003 JamPlus
- T1129 Shared Modules
- T1132 Data Encoding
- T1132.001 Standard Encoding
- T1132.002 Non-Standard Encoding
- T1133 External Remote Services
- T1134 Access Token Manipulation
- T1134.001 Token Impersonation/Theft
- T1134.002 Create Process with Token
- T1134.003 Make and Impersonate Token
- T1134.004 Parent PID Spoofing
- T1134.005 SID-History Injection
- T1135 Network Share Discovery
- T1136 Create Account
- T1136.001 Local Account
- T1136.002 Domain Account
- T1136.003 Cloud Account
- T1137 Office Application Startup
- T1137.001 Office Template Macros
- T1137.002 Office Test
- T1137.003 Outlook Forms
- T1137.004 Outlook Home Page
- T1137.005 Outlook Rules
- T1137.006 Add-ins
- T1140 Deobfuscate/Decode Files or Information
- T1176 Software Extensions
- T1176.001 Browser Extensions
- T1176.002 IDE Extensions
- T1185 Browser Session Hijacking
- T1187 Forced Authentication
- T1189 Drive-by Compromise
- T1190 Exploit Public-Facing Application
- T1195 Supply Chain Compromise
- T1195.001 Compromise Software Dependencies and Development Tools
- T1195.002 Compromise Software Supply Chain
- T1195.003 Compromise Hardware Supply Chain
- T1197 BITS Jobs
- T1199 Trusted Relationship
- T1200 Hardware Additions
- T1201 Password Policy Discovery
- T1202 Indirect Command Execution
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1204.003 Malicious Image
- T1204.004 Malicious Copy and Paste
- T1204.005 Malicious Library
- T1205 Traffic Signaling
- T1205.001 Port Knocking
- T1205.002 Socket Filters
- T1207 Rogue Domain Controller
- T1210 Exploitation of Remote Services
- T1211 Exploitation for Stealth
- T1212 Exploitation for Credential Access
- T1213 Data from Information Repositories
- T1213.001 Confluence
- T1213.002 Sharepoint
- T1213.003 Code Repositories
- T1213.004 Customer Relationship Management Software
- T1213.005 Messaging Applications
- T1213.006 Databases
- T1216 System Script Proxy Execution
- T1216.001 PubPrn
- T1216.002 SyncAppvPublishingServer
- T1217 Browser Information Discovery
- T1218 System Binary Proxy Execution
- T1218.001 Compiled HTML File
- T1218.002 Control Panel
- T1218.003 CMSTP
- T1218.004 InstallUtil
- T1218.005 Mshta
- T1218.007 Msiexec
- T1218.008 Odbcconf
- T1218.009 Regsvcs/Regasm
- T1218.010 Regsvr32
- T1218.011 Rundll32
- T1218.012 Verclsid
- T1218.013 Mavinject
- T1218.014 MMC
- T1218.015 Electron Applications
- T1219 Remote Access Tools
- T1219.001 IDE Tunneling
- T1219.002 Remote Desktop Software
- T1219.003 Remote Access Hardware
- T1220 XSL Script Processing
- T1221 Template Injection
- T1222 File and Directory Permissions Modification
- T1222.001 Windows Permissions
- T1222.002 Linux and Mac Permissions
- T1480 Execution Guardrails
- T1480.001 Environmental Keying
- T1480.002 Mutual Exclusion
- T1482 Domain Trust Discovery
- T1484 Domain or Tenant Policy Modification
- T1484.001 Group Policy Modification
- T1484.002 Trust Modification
- T1485 Data Destruction
- T1485.001 Lifecycle-Triggered Deletion
- T1486 Data Encrypted for Impact
- T1489 Service Stop
- T1490 Inhibit System Recovery
- T1491 Defacement
- T1491.001 Internal Defacement
- T1491.002 External Defacement
- T1495 Firmware Corruption
- T1496 Resource Hijacking
- T1496.001 Compute Hijacking
- T1496.002 Bandwidth Hijacking
- T1496.003 SMS Pumping
- T1496.004 Cloud Service Hijacking
- T1497 Virtualization/Sandbox Evasion
- T1497.001 System Checks
- T1497.002 User Activity Based Checks
- T1497.003 Time Based Checks
- T1498 Network Denial of Service
- T1498.001 Direct Network Flood
- T1498.002 Reflection Amplification
- T1499 Endpoint Denial of Service
- T1499.001 OS Exhaustion Flood
- T1499.002 Service Exhaustion Flood
- T1499.003 Application Exhaustion Flood
- T1499.004 Application or System Exploitation
- T1505 Server Software Component
- T1505.001 SQL Stored Procedures
- T1505.002 Transport Agent
- T1505.003 Web Shell
- T1505.004 IIS Components
- T1505.005 Terminal Services DLL
- T1505.006 vSphere Installation Bundles
- T1518 Software Discovery
- T1518.001 Security Software Discovery
- T1518.002 Backup Software Discovery
- T1525 Implant Internal Image
- T1526 Cloud Service Discovery
- T1528 Steal Application Access Token
- T1529 System Shutdown/Reboot
- T1530 Data from Cloud Storage
- T1531 Account Access Removal
- T1534 Internal Spearphishing
- T1535 Unused/Unsupported Cloud Regions
- T1537 Transfer Data to Cloud Account
- T1538 Cloud Service Dashboard
- T1539 Steal Web Session Cookie
- T1542 Pre-OS Boot
- T1542.001 System Firmware
- T1542.002 Component Firmware
- T1542.003 Bootkit
- T1542.004 ROMMONkit
- T1542.005 TFTP Boot
- T1543 Create or Modify System Process
- T1543.001 Launch Agent
- T1543.002 Systemd Service
- T1543.003 Windows Service
- T1543.004 Launch Daemon
- T1543.005 Container Service
- T1546 Event Triggered Execution
- T1546.001 Change Default File Association
- T1546.002 Screensaver
- T1546.003 Windows Management Instrumentation Event Subscription
- T1546.004 Unix Shell Configuration Modification
- T1546.005 Trap
- T1546.006 LC_LOAD_DYLIB Addition
- T1546.007 Netsh Helper DLL
- T1546.008 Accessibility Features
- T1546.009 AppCert DLLs
- T1546.010 AppInit DLLs
- T1546.011 Application Shimming
- T1546.012 Image File Execution Options Injection
- T1546.013 PowerShell Profile
- T1546.014 Emond
- T1546.015 Component Object Model Hijacking
- T1546.016 Installer Packages
- T1546.017 Udev Rules
- T1546.018 Python Startup Hooks
- T1547 Boot or Logon Autostart Execution
- T1547.001 Registry Run Keys / Startup Folder
- T1547.002 Authentication Package
- T1547.003 Time Providers
- T1547.004 Winlogon Helper DLL
- T1547.005 Security Support Provider
- T1547.006 Kernel Modules and Extensions
- T1547.007 Re-opened Applications
- T1547.008 LSASS Driver
- T1547.009 Shortcut Modification
- T1547.010 Port Monitors
- T1547.012 Print Processors
- T1547.013 XDG Autostart Entries
- T1547.014 Active Setup
- T1547.015 Login Items
- T1548 Abuse Elevation Control Mechanism
- T1548.001 Setuid and Setgid
- T1548.002 Bypass User Account Control
- T1548.003 Sudo and Sudo Caching
- T1548.004 Elevated Execution with Prompt
- T1548.005 Temporary Elevated Cloud Access
- T1548.006 TCC Manipulation
- T1550 Use Alternate Authentication Material
- T1550.001 Application Access Token
- T1550.002 Pass the Hash
- T1550.003 Pass the Ticket
- T1550.004 Web Session Cookie
- T1552 Unsecured Credentials
- T1552.001 Credentials In Files
- T1552.002 Credentials in Registry
- T1552.003 Shell History
- T1552.004 Private Keys
- T1552.005 Cloud Instance Metadata API
- T1552.006 Group Policy Preferences
- T1552.007 Container API
- T1552.008 Chat Messages
- T1553 Subvert Trust Controls
- T1553.001 Gatekeeper Bypass
- T1553.002 Code Signing
- T1553.003 SIP and Trust Provider Hijacking
- T1553.004 Install Root Certificate
- T1553.005 Mark-of-the-Web Bypass
- T1553.006 Code Signing Policy Modification
- T1554 Compromise Host Software Binary
- T1555 Credentials from Password Stores
- T1555.001 Keychain
- T1555.002 Securityd Memory
- T1555.003 Credentials from Web Browsers
- T1555.004 Windows Credential Manager
- T1555.005 Password Managers
- T1555.006 Cloud Secrets Management Stores
- T1556 Modify Authentication Process
- T1556.001 Domain Controller Authentication
- T1556.002 Password Filter DLL
- T1556.003 Pluggable Authentication Modules
- T1556.004 Network Device Authentication
- T1556.005 Reversible Encryption
- T1556.006 Multi-Factor Authentication
- T1556.007 Hybrid Identity
- T1556.008 Network Provider DLL
- T1556.009 Conditional Access Policies
- T1557 Adversary-in-the-Middle
- T1557.001 Name Resolution Poisoning and SMB Relay
- T1557.002 ARP Cache Poisoning
- T1557.003 DHCP Spoofing
- T1557.004 Evil Twin
- T1558 Steal or Forge Kerberos Tickets
- T1558.001 Golden Ticket
- T1558.002 Silver Ticket
- T1558.003 Kerberoasting
- T1558.004 AS-REP Roasting
- T1558.005 Ccache Files
- T1559 Inter-Process Communication
- T1559.001 Component Object Model
- T1559.002 Dynamic Data Exchange
- T1559.003 XPC Services
- T1560 Archive Collected Data
- T1560.001 Archive via Utility
- T1560.002 Archive via Library
- T1560.003 Archive via Custom Method
- T1561 Disk Wipe
- T1561.001 Disk Content Wipe
- T1561.002 Disk Structure Wipe
- T1563 Remote Service Session Hijacking
- T1563.001 SSH Hijacking
- T1563.002 RDP Hijacking
- T1564 Hide Artifacts
- T1564.001 Hidden Files and Directories
- T1564.002 Hidden Users
- T1564.003 Hidden Window
- T1564.004 NTFS File Attributes
- T1564.005 Hidden File System
- T1564.006 Run Virtual Instance
- T1564.007 VBA Stomping
- T1564.008 Email Hiding Rules
- T1564.009 Resource Forking
- T1564.010 Process Argument Spoofing
- T1564.011 Ignore Process Interrupts
- T1564.012 File/Path Exclusions
- T1564.013 Bind Mounts
- T1564.014 Extended Attributes
- T1565 Data Manipulation
- T1565.001 Stored Data Manipulation
- T1565.002 Transmitted Data Manipulation
- T1565.003 Runtime Data Manipulation
- T1566 Phishing
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1566.003 Spearphishing via Service
- T1566.004 Spearphishing Voice
- T1567 Exfiltration Over Web Service
- T1567.001 Exfiltration to Code Repository
- T1567.002 Exfiltration to Cloud Storage
- T1567.003 Exfiltration to Text Storage Sites
- T1567.004 Exfiltration Over Webhook
- T1568 Dynamic Resolution
- T1568.001 Fast Flux DNS
- T1568.002 Domain Generation Algorithms
- T1568.003 DNS Calculation
- T1569 System Services
- T1569.001 Launchctl
- T1569.002 Service Execution
- T1569.003 Systemctl
- T1570 Lateral Tool Transfer
- T1571 Non-Standard Port
- T1572 Protocol Tunneling
- T1573 Encrypted Channel
- T1573.001 Symmetric Cryptography
- T1573.002 Asymmetric Cryptography
- T1574 Hijack Execution Flow
- T1574.001 DLL
- T1574.004 Dylib Hijacking
- T1574.005 Executable Installer File Permissions Weakness
- T1574.006 Dynamic Linker Hijacking
- T1574.007 Path Interception by PATH Environment Variable
- T1574.008 Path Interception by Search Order Hijacking
- T1574.009 Path Interception by Unquoted Path
- T1574.010 Services File Permissions Weakness
- T1574.011 Services Registry Permissions Weakness
- T1574.012 COR_PROFILER
- T1574.013 KernelCallbackTable
- T1574.014 AppDomainManager
- T1578 Modify Cloud Compute Infrastructure
- T1578.001 Create Snapshot
- T1578.002 Create Cloud Instance
- T1578.003 Delete Cloud Instance
- T1578.004 Revert Cloud Instance
- T1578.005 Modify Cloud Compute Configurations
- T1580 Cloud Infrastructure Discovery
- T1583 Acquire Infrastructure
- T1583.001 Domains
- T1583.002 DNS Server
- T1583.003 Virtual Private Server
- T1583.004 Server
- T1583.005 Botnet
- T1583.006 Web Services
- T1583.007 Serverless
- T1583.008 Malvertising
- T1584 Compromise Infrastructure
- T1584.001 Domains
- T1584.002 DNS Server
- T1584.003 Virtual Private Server
- T1584.004 Server
- T1584.005 Botnet
- T1584.006 Web Services
- T1584.007 Serverless
- T1584.008 Network Devices
- T1585 Establish Accounts
- T1585.001 Social Media Accounts
- T1585.002 Email Accounts
- T1585.003 Cloud Accounts
- T1586 Compromise Accounts
- T1586.001 Social Media Accounts
- T1586.002 Email Accounts
- T1586.003 Cloud Accounts
- T1587 Develop Capabilities
- T1587.001 Malware
- T1587.002 Code Signing Certificates
- T1587.003 Digital Certificates
- T1587.004 Exploits
- T1588 Obtain Capabilities
- T1588.001 Malware
- T1588.002 Tool
- T1588.003 Code Signing Certificates
- T1588.004 Digital Certificates
- T1588.005 Exploits
- T1588.006 Vulnerabilities
- T1588.007 Artificial Intelligence
- T1589 Gather Victim Identity Information
- T1589.001 Credentials
- T1589.002 Email Addresses
- T1589.003 Employee Names
- T1590 Gather Victim Network Information
- T1590.001 Domain Properties
- T1590.002 DNS
- T1590.003 Network Trust Dependencies
- T1590.004 Network Topology
- T1590.005 IP Addresses
- T1590.006 Network Security Appliances
- T1591 Gather Victim Org Information
- T1591.001 Determine Physical Locations
- T1591.002 Business Relationships
- T1591.003 Identify Business Tempo
- T1591.004 Identify Roles
- T1592 Gather Victim Host Information
- T1592.001 Hardware
- T1592.002 Software
- T1592.003 Firmware
- T1592.004 Client Configurations
- T1593 Search Open Websites/Domains
- T1593.001 Social Media
- T1593.002 Search Engines
- T1593.003 Code Repositories
- T1594 Search Victim-Owned Websites
- T1595 Active Scanning
- T1595.001 Scanning IP Blocks
- T1595.002 Vulnerability Scanning
- T1595.003 Wordlist Scanning
- T1596 Search Open Technical Databases
- T1596.001 DNS/Passive DNS
- T1596.002 WHOIS
- T1596.003 Digital Certificates
- T1596.004 CDNs
- T1596.005 Scan Databases
- T1597 Search Closed Sources
- T1597.001 Threat Intel Vendors
- T1597.002 Purchase Technical Data
- T1598 Phishing for Information
- T1598.001 Spearphishing Service
- T1598.002 Spearphishing Attachment
- T1598.003 Spearphishing Link
- T1598.004 Spearphishing Voice
- T1599 Network Boundary Bridging
- T1599.001 Network Address Translation Traversal
- T1600 Weaken Encryption
- T1600.001 Reduce Key Space
- T1600.002 Disable Crypto Hardware
- T1601 Modify System Image
- T1601.001 Patch System Image
- T1601.002 Downgrade System Image
- T1602 Data from Configuration Repository
- T1602.001 SNMP (MIB Dump)
- T1602.002 Network Device Configuration Dump
- T1606 Forge Web Credentials
- T1606.001 Web Cookies
- T1606.002 SAML Tokens
- T1608 Stage Capabilities
- T1608.001 Upload Malware
- T1608.002 Upload Tool
- T1608.003 Install Digital Certificate
- T1608.004 Drive-by Target
- T1608.005 Link Target
- T1608.006 SEO Poisoning
- T1609 Container Administration Command
- T1610 Deploy Container
- T1611 Escape to Host
- T1612 Build Image on Host
- T1613 Container and Resource Discovery
- T1614 System Location Discovery
- T1614.001 System Language Discovery
- T1615 Group Policy Discovery
- T1619 Cloud Storage Object Discovery
- T1620 Reflective Code Loading
- T1621 Multi-Factor Authentication Request Generation
- T1622 Debugger Evasion
- T1647 Plist File Modification
- T1648 Serverless Execution
- T1649 Steal or Forge Authentication Certificates
- T1650 Acquire Access
- T1651 Cloud Administration Command
- T1652 Device Driver Discovery
- T1653 Power Settings
- T1654 Log Enumeration
- T1657 Financial Theft
- T1659 Content Injection
- T1665 Hide Infrastructure
- T1666 Modify Cloud Resource Hierarchy
- T1667 Email Bombing
- T1668 Exclusive Control
- T1669 Wi-Fi Networks
- T1671 Cloud Application Integration
- T1673 Virtual Machine Discovery
- T1674 Input Injection
- T1675 ESXi Administration Command
- T1677 Poisoned Pipeline Execution
- T1678 Delay Execution
- T1679 Selective Exclusion
- T1680 Local Storage Discovery
- T1681 Search Threat Vendor Data
- T1682 Query Public AI Services
- T1683 Generate Content
- T1683.001 Written Content
- T1683.002 Audio-Visual Content
- T1684 Social Engineering
- T1684.001 Impersonation
- T1684.002 Email Spoofing
- T1685 Disable or Modify Tools
- T1685.001 Disable or Modify Windows Event Log
- T1685.002 Disable or Modify Cloud Log
- T1685.003 Modify or Spoof Tool UI
- T1685.004 Disable or Modify Linux Audit System Log
- T1685.005 Clear Windows Event Logs
- T1685.006 Clear Linux or Mac System Logs
- T1686 Disable or Modify System Firewall
- T1686.001 Cloud Firewall
- T1686.002 Network Device Firewall
- T1686.003 Windows Host Firewall
- T1687 Exploitation for Defense Impairment
- T1688 Safe Mode Boot
- T1689 Downgrade Attack
- T1690 Prevent Command History Logging
- T0800 Activate Firmware Update Mode
- T0801 Monitor Process State
- T0802 Automated Collection
- T0806 Brute Force I/O
- T0807 Command-Line Interface
- T0809 Data Destruction
- T0811 Data from Information Repositories
- T0813 Denial of Control
- T0814 Denial of Service
- T0815 Denial of View
- T0816 Device Restart/Shutdown
- T0817 Drive-by Compromise
- T0819 Exploit Public-Facing Application
- T0820 Exploitation for Evasion
- T0821 Modify Controller Tasking
- T0822 External Remote Services
- T0823 Graphical User Interface
- T0826 Loss of Availability
- T0827 Loss of Control
- T0828 Loss of Productivity and Revenue
- T0829 Loss of View
- T0830 Adversary-in-the-Middle
- T0831 Manipulation of Control
- T0832 Manipulation of View
- T0834 Native API
- T0835 Manipulate I/O Image
- T0836 Modify Parameter
- T0837 Loss of Protection
- T0838 Modify Alarm Settings
- T0840 Network Connection Enumeration
- T0842 Network Sniffing
- T0843 Program Download
- T0843.001 Download All
- T0843.002 Online Edit
- T0843.003 Program Append
- T0845 Program Upload
- T0846 Remote System Discovery
- T0846.001 Port Scan
- T0846.002 Broadcast Discovery
- T0846.003 Multicast Discovery
- T0847 Replication Through Removable Media
- T0848 Rogue Master
- T0849 Masquerading
- T0851 Rootkit
- T0852 Screen Capture
- T0853 Scripting
- T0858 Change Operating Mode
- T0859 Valid Accounts
- T0860 Wireless Compromise
- T0861 Point & Tag Identification
- T0862 Supply Chain Compromise
- T0863 User Execution
- T0864 Transient Cyber Asset
- T0865 Spearphishing Attachment
- T0866 Exploitation of Remote Services
- T0867 Lateral Tool Transfer
- T0868 Detect Operating Mode
- T0869 Standard Application Layer Protocol
- T0871 Execution through API
- T0872 Indicator Removal on Host
- T0873 Project File Infection
- T0873.001 Siemens Project File Format
- T0874 Hooking
- T0877 I/O Image
- T0878 Alarm Suppression
- T0879 Damage to Property
- T0880 Loss of Safety
- T0881 Service Stop
- T0882 Theft of Operational Information
- T0883 Internet Accessible Device
- T0884 Connection Proxy
- T0885 Commonly Used Port
- T0886 Remote Services
- T0887 Wireless Sniffing
- T0888 Remote System Information Discovery
- T0889 Modify Program
- T0890 Exploitation for Privilege Escalation
- T0892 Change Credential
- T0893 Data from Local System
- T0894 System Binary Proxy Execution
- T0895 Autorun Image
- T1691 Block Operational Technology Message
- T1691.001 Command Message
- T1691.002 Reporting Message
- T1692 Unauthorized Message
- T1692.001 Command Message
- T1692.002 Reporting Message
- T1693 Modify Firmware
- T1693.001 System Firmware
- T1693.002 Module Firmware
- T1694 Insecure Credentials
- T1694.001 Default Credentials
- T1694.002 Hardcoded Credentials
- T1695 Block Communications
- T1695.001 Serial COM
- T1695.002 Ethernet
- T1695.003 Wi-Fi
- T1398 Boot or Logon Initialization Scripts
- T1404 Exploitation for Privilege Escalation
- T1406 Obfuscated Files or Information
- T1406.001 Steganography
- T1406.002 Software Packing
- T1407 Download New Code at Runtime
- T1409 Stored Application Data
- T1414 Clipboard Data
- T1417 Input Capture
- T1417.001 Keylogging
- T1417.002 GUI Input Capture
- T1418 Software Discovery
- T1418.001 Security Software Discovery
- T1420 File and Directory Discovery
- T1421 System Network Connections Discovery
- T1422 System Network Configuration Discovery
- T1422.001 Internet Connection Discovery
- T1422.002 Wi-Fi Discovery
- T1423 Network Service Scanning
- T1424 Process Discovery
- T1426 System Information Discovery
- T1428 Exploitation of Remote Services
- T1429 Audio Capture
- T1430 Location Tracking
- T1430.001 Remote Device Management Services
- T1430.002 Impersonate SS7 Nodes
- T1437 Application Layer Protocol
- T1437.001 Web Protocols
- T1451 SIM Card Swap
- T1453 Abuse Accessibility Features
- T1456 Drive-By Compromise
- T1458 Replication Through Removable Media
- T1461 Lockscreen Bypass
- T1464 Network Denial of Service
- T1471 Data Encrypted for Impact
- T1474 Supply Chain Compromise
- T1474.001 Compromise Software Dependencies and Development Tools
- T1474.002 Compromise Hardware Supply Chain
- T1474.003 Compromise Software Supply Chain
- T1481 Web Service
- T1481.001 Dead Drop Resolver
- T1481.002 Bidirectional Communication
- T1481.003 One-Way Communication
- T1509 Non-Standard Port
- T1512 Video Capture
- T1513 Screen Capture
- T1516 Input Injection
- T1517 Access Notifications
- T1521 Encrypted Channel
- T1521.001 Symmetric Cryptography
- T1521.002 Asymmetric Cryptography
- T1521.003 SSL Pinning
- T1532 Archive Collected Data
- T1533 Data from Local System
- T1541 Foreground Persistence
- T1544 Ingress Tool Transfer
- T1575 Native API
- T1577 Compromise Application Executable
- T1582 SMS Control
- T1603 Scheduled Task/Job
- T1604 Proxy Through Victim
- T1616 Call Control
- T1617 Hooking
- T1623 Command and Scripting Interpreter
- T1623.001 Unix Shell
- T1624 Event Triggered Execution
- T1624.001 Broadcast Receivers
- T1625 Hijack Execution Flow
- T1625.001 System Runtime API Hijacking
- T1626 Abuse Elevation Control Mechanism
- T1626.001 Device Administrator Permissions
- T1627 Execution Guardrails
- T1627.001 Geofencing
- T1628 Hide Artifacts
- T1628.001 Suppress Application Icon
- T1628.002 User Evasion
- T1628.003 Conceal Multimedia Files
- T1629 Impair Defenses
- T1629.001 Prevent Application Removal
- T1629.002 Device Lockout
- T1629.003 Disable or Modify Tools
- T1630 Indicator Removal on Host
- T1630.001 Uninstall Malicious Application
- T1630.002 File Deletion
- T1630.003 Disguise Root/Jailbreak Indicators
- T1631 Process Injection
- T1631.001 Ptrace System Calls
- T1632 Subvert Trust Controls
- T1632.001 Code Signing Policy Modification
- T1633 Virtualization/Sandbox Evasion
- T1633.001 System Checks
- T1634 Credentials from Password Store
- T1634.001 Keychain
- T1635 Steal Application Access Token
- T1635.001 URI Hijacking
- T1636 Protected User Data
- T1636.001 Calendar Entries
- T1636.002 Call Log
- T1636.003 Contact List
- T1636.004 SMS Messages
- T1636.005 Accounts
- T1637 Dynamic Resolution
- T1637.001 Domain Generation Algorithms
- T1638 Adversary-in-the-Middle
- T1639 Exfiltration Over Alternative Protocol
- T1639.001 Exfiltration Over Unencrypted Non-C2 Protocol
- T1640 Account Access Removal
- T1641 Data Manipulation
- T1641.001 Transmitted Data Manipulation
- T1642 Endpoint Denial of Service
- T1643 Generate Traffic from Victim
- T1644 Out of Band Data
- T1645 Compromise Client Software Binary
- T1646 Exfiltration Over C2 Channel
- T1655 Masquerading
- T1655.001 Match Legitimate Name or Location
- T1658 Exploitation for Client Execution
- T1660 Phishing
- T1661 Application Versioning
- T1662 Data Destruction
- T1663 Remote Access Software
- T1664 Exploitation for Initial Access
- T1670 Virtualization Solution
- T1676 Linked Devices
Connected ecosystem references
Explore the three modules
Attack Tools · Attack Simulations · Detection Rules · Telemetry · Tags
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.