1200KM / index
Simulation and Detection Tag Index
Linked facets for environments, platforms, tactics, providers, source evidence, anomaly types and original Sigma metadata.
anomaly
- Autocorrelation Anomaly · 2 pages
- Burst Anomaly · 9 pages
- Cascading Anomaly · 1 pages
- Categorical-Distribution Anomaly · 4 pages
- Category-Combination Anomaly · 6 pages
- Change-Point Anomaly · 1 pages
- Collective Anomaly · 1 pages
- Conditional Anomaly · 5 pages
- Count Anomaly · 1 pages
- Cross-View Anomaly · 1 pages
- Distribution-Shift Anomaly · 3 pages
- Drought or Silence Anomaly · 1 pages
- Duration Anomaly · 1 pages
- Edge Anomaly · 18 pages
- Emerging Anomaly · 1 pages
- Entropy Anomaly · 2 pages
- Fan-Out Anomaly · 6 pages
- Graph-Evolution Anomaly · 3 pages
- Graph-Path-Length Anomaly · 2 pages
- Inter-Arrival-Time Anomaly · 2 pages
- Level-Shift Anomaly · 4 pages
- Missing-Correspondence Anomaly · 2 pages
- Multivariate Combination Anomaly · 5 pages
- Novel-Category Anomaly · 8 pages
- Peer-Group Anomaly · 11 pages
- Periodicity Anomaly · 2 pages
- Persistent Anomaly · 2 pages
- Phase Anomaly · 1 pages
- Population Anomaly · 1 pages
- Rare-Category Anomaly · 8 pages
- Rate Anomaly · 4 pages
- Ratio or Proportion Anomaly · 3 pages
- Self-Baseline Anomaly · 3 pages
- Sequence-Order Anomaly · 3 pages
- Subgraph Anomaly · 1 pages
- Subsequence Anomaly · 1 pages
- Synchronization Anomaly · 2 pages
- Tail Anomaly · 5 pages
- Temporal-Context Anomaly · 4 pages
- Transition Anomaly · 9 pages
- Volume Anomaly · 8 pages
constraint
- device_or_emulator_and_sensor_access_required · 124 pages
- disposable_tenant_and_cost_controls · 125 pages
- isolated_authorized_lab · 918 pages
- ot_fixture_and_process_safety_review · 97 pages
- potential_disruption_requires_individual_review · 137 pages
- procedure_review_required · 918 pages
- some_candidates_require_elevation · 174 pages
- telemetry_configuration_required · 918 pages
detection-evidence
- guidance_only · 528 pages
- rule_source_available · 390 pages
domain
- enterprise · 1394 pages
- ics · 194 pages
- mobile · 248 pages
environment
- cloud · 302 pages
- cloud-hosted-endpoint · 1119 pages
- containers · 134 pages
- external-services · 201 pages
- ics-ot · 194 pages
- identity · 120 pages
- mobile · 250 pages
- network-infrastructure · 280 pages
- onprem · 1201 pages
- saas · 164 pages
- virtualization · 312 pages
evidence
- atomic_test · 7 pages
- attack_uses · 98 pages
- editorial_capability · 14 pages
executor
- bash · 62 pages
- command_prompt · 161 pages
- manual · 12 pages
- powershell · 234 pages
- sh · 126 pages
level
- subtechnique · 540 pages
- technique · 378 pages
logsource-category
- antivirus · 6 pages
- application · 56 pages
- create_remote_thread · 10 pages
- create_stream_hash · 6 pages
- database · 1 pages
- dns · 7 pages
- dns_query · 22 pages
- driver_load · 10 pages
- file_access · 7 pages
- file_change · 1 pages
- file_delete · 11 pages
- file_event · 142 pages
- file_executable_detected · 1 pages
- file_rename · 1 pages
- image_load · 97 pages
- network_connection · 54 pages
- pipe_created · 16 pages
- process_access · 23 pages
- process_creation · 1234 pages
- process_tampering · 1 pages
- proxy · 29 pages
- ps_classic_provider_start · 1 pages
- ps_classic_start · 9 pages
- ps_module · 31 pages
- ps_script · 150 pages
- raw_access_thread · 1 pages
- registry_delete · 9 pages
- registry_event · 32 pages
- registry_set · 175 pages
- sysmon_error · 1 pages
- sysmon_status · 1 pages
- webserver · 13 pages
- wmi_event · 3 pages
logsource-product
- aws · 48 pages
- azure · 114 pages
- bitbucket · 14 pages
- cisco · 15 pages
- django · 1 pages
- fortigate · 6 pages
- gcp · 13 pages
- github · 14 pages
- huawei · 1 pages
- juniper · 1 pages
- jvm · 5 pages
- kubernetes · 12 pages
- linux · 190 pages
- m365 · 17 pages
- macos · 63 pages
- nodejs · 1 pages
- okta · 9 pages
- opencanary · 24 pages
- python · 1 pages
- rpc_firewall · 9 pages
- ruby_on_rails · 1 pages
- spring · 2 pages
- sql · 1 pages
- velocity · 1 pages
- windows · 2152 pages
- zeek · 17 pages
logsource-service
- aaa · 13 pages
- activitylogs · 28 pages
- apache · 2 pages
- application · 16 pages
- applocker · 1 pages
- appxdeployment-server · 2 pages
- audit · 44 pages
- auditd · 52 pages
- auditlogs · 36 pages
- bgp · 3 pages
- bits-client · 7 pages
- capi2 · 1 pages
- certificateservicesclient-lifecycle-system · 1 pages
- clamav · 1 pages
- cloudtrail · 48 pages
- codeintegrity-operational · 2 pages
- cron · 1 pages
- dce_rpc · 3 pages
- dns · 4 pages
- dns-client · 5 pages
- dns-server · 2 pages
- driver-framework · 1 pages
- event · 6 pages
- exchange · 1 pages
- firewall-as · 8 pages
- gcp.audit · 7 pages
- google_workspace.admin · 3 pages
- google_workspace.login · 3 pages
- guacamole · 1 pages
- http · 2 pages
- iis-configuration · 4 pages
- kerberos · 1 pages
- ldap · 1 pages
- ldp · 1 pages
- microsoft-servicebus-client · 1 pages
- msexchange-management · 7 pages
- nginx · 1 pages
- ntlm · 3 pages
- okta · 9 pages
- openssh · 1 pages
- pim · 7 pages
- powershell-classic · 3 pages
- rdp · 1 pages
- riskdetection · 19 pages
- security · 139 pages
- security-mitigations · 2 pages
- signinlogs · 24 pages
- smb_files · 6 pages
- smbclient-security · 1 pages
- smbserver-connectivity · 1 pages
- sshd · 1 pages
- syslog · 2 pages
- system · 55 pages
- taskscheduler · 3 pages
- terminalservices-localsessionmanager · 1 pages
- threat_detection · 1 pages
- threat_management · 11 pages
- vsftpd · 1 pages
- windefend · 15 pages
- wmi · 1 pages
method
platform
- Android · 280 pages
- azure-ad · 8 pages
- Containers · 150 pages
- ESXi · 289 pages
- google-workspace · 1 pages
- IaaS · 283 pages
- iaas:aws · 17 pages
- iaas:azure · 10 pages
- iaas:gcp · 5 pages
- Identity Provider · 138 pages
- iOS · 209 pages
- Linux · 810 pages
- macOS · 807 pages
- Network Devices · 248 pages
- Office Suite · 205 pages
- PRE · 206 pages
- SaaS · 193 pages
- Windows · 1101 pages
provider
- Active Directory domain controllers · 10 pages
- Analyst-curated STIX repositories · 1 pages
- Android dumpsys · 11 pages
- Android logcat · 11 pages
- Apple Endpoint Security clients · 11 pages
- Application audit instrumentation · 3 pages
- Application audit logs · 3 pages
- Authorized CA inventory exports · 1 pages
- Authorized intelligence feeds / STIX repositories · 2 pages
- Authorized provider/account-owner audit exports · 1 pages
- Authorized sample repositories / STIX analysis reports · 2 pages
- AWS CloudTrail · 21 pages
- AWS CloudTrail for S3 · 6 pages
- AWS VPC Flow Logs · 5 pages
- Azure Monitor Activity Log · 21 pages
- Azure storage resource logs · 6 pages
- Certificate Transparency logs / monitors · 1 pages
- Cloud identity service audit · 3 pages
- CloudTrail in an owned lab account · 1 pages
- Controller, HMI and historian exports · 20 pages
- Docker Engine events · 3 pages
- Google Cloud Audit Logs · 27 pages
- Independent lab sensors / safety records · 20 pages
- Instrumented test application · 11 pages
- ISC BIND dig · 1 pages
- Kubernetes API audit · 5 pages
- Linux Audit · 13 pages
- Linux Audit plus inventory snapshots · 13 pages
- Managed Kubernetes audit exports · 2 pages
- Microsoft Entra sign-in logs · 3 pages
- Microsoft Sysmon · 16 pages
- Nmap XML reports · 1 pages
- OPC UA audit-capable servers · 20 pages
- OpenTelemetry-compatible log pipelines · 3 pages
- osquery · 13 pages
- Platform-permitted public-content exports · 1 pages
- PowerShell Script Block Logging · 2 pages
- RDAP registries/registrars · 2 pages
- Suricata EVE · 10 pages
- Sysmon process events · 2 pages
- Windows Security auditing · 20 pages
- YARA · 2 pages
- Zeek · 10 pages
- Zeek DNS logs · 1 pages
- Zeek protocol observations · 1 pages
rule-status
- experimental · 204 pages
- stable · 75 pages
- test · 2512 pages
severity
- critical · 64 pages
- high · 1290 pages
- informational · 22 pages
- low · 253 pages
- medium · 1162 pages
sigma-tag
- attack.collection · 108 pages
- attack.command-and-control · 233 pages
- attack.credential-access · 335 pages
- attack.defense-impairment · 348 pages
- attack.discovery · 227 pages
- attack.ds0005 · 1 pages
- attack.execution · 716 pages
- attack.exfiltration · 70 pages
- attack.g0020 · 1 pages
- attack.g0022 · 1 pages
- attack.g0032 · 1 pages
- attack.g0046 · 1 pages
- attack.g0047 · 1 pages
- attack.g0060 · 1 pages
- attack.g0069 · 4 pages
- attack.g0080 · 1 pages
- attack.g0091 · 1 pages
- attack.impact · 114 pages
- attack.initial-access · 202 pages
- attack.lateral-movement · 139 pages
- attack.persistence · 672 pages
- attack.privilege-escalation · 622 pages
- attack.reconnaissance · 17 pages
- attack.resource-development · 30 pages
- attack.s0002 · 10 pages
- attack.s0005 · 6 pages
- attack.s0029 · 11 pages
- attack.s0039 · 1 pages
- attack.s0040 · 1 pages
- attack.s0106 · 1 pages
- attack.s0108 · 2 pages
- attack.s0111 · 2 pages
- attack.s0139 · 4 pages
- attack.s0190 · 7 pages
- attack.s0195 · 1 pages
- attack.s0246 · 1 pages
- attack.s0349 · 1 pages
- attack.s0363 · 1 pages
- attack.s0402 · 1 pages
- attack.s0404 · 2 pages
- attack.s0482 · 1 pages
- attack.s0508 · 2 pages
- attack.stealth · 843 pages
- attack.t1001.003 · 2 pages
- attack.t1003 · 33 pages
- attack.t1003.001 · 73 pages
- attack.t1003.002 · 28 pages
- attack.t1003.003 · 23 pages
- attack.t1003.004 · 12 pages
- attack.t1003.005 · 8 pages
- attack.t1003.006 · 7 pages
- attack.t1005 · 12 pages
- attack.t1006 · 1 pages
- attack.t1007 · 8 pages
- attack.t1008 · 4 pages
- attack.t1010 · 1 pages
- attack.t1012 · 9 pages
- attack.t1014 · 1 pages
- attack.t1016 · 9 pages
- attack.t1018 · 16 pages
- attack.t1020 · 8 pages
- attack.t1021 · 10 pages
- attack.t1021.001 · 15 pages
- attack.t1021.002 · 36 pages
- attack.t1021.003 · 13 pages
- attack.t1021.004 · 5 pages
- attack.t1021.005 · 1 pages
- attack.t1021.006 · 10 pages
- attack.t1021.007 · 1 pages
- attack.t1027 · 87 pages
- attack.t1027.001 · 3 pages
- attack.t1027.002 · 1 pages
- attack.t1027.003 · 5 pages
- attack.t1027.004 · 5 pages
- attack.t1027.005 · 4 pages
- attack.t1027.009 · 1 pages
- attack.t1027.010 · 8 pages
- attack.t1027.011 · 1 pages
- attack.t1030 · 2 pages
- attack.t1033 · 29 pages
- attack.t1036 · 38 pages
- attack.t1036.002 · 3 pages
- attack.t1036.003 · 26 pages
- attack.t1036.004 · 1 pages
- attack.t1036.005 · 14 pages
- attack.t1036.006 · 1 pages
- attack.t1036.007 · 3 pages
- attack.t1037.001 · 3 pages
- attack.t1037.005 · 1 pages
- attack.t1039 · 2 pages
- attack.t1040 · 9 pages
- attack.t1041 · 2 pages
- attack.t1046 · 19 pages
- attack.t1047 · 47 pages
- attack.t1048 · 9 pages
- attack.t1048.001 · 1 pages
- attack.t1048.003 · 8 pages
- attack.t1049 · 7 pages
- attack.t1053 · 9 pages
- attack.t1053.002 · 8 pages
- attack.t1053.003 · 6 pages
- attack.t1053.005 · 31 pages
- attack.t1055 · 24 pages
- attack.t1055.001 · 6 pages
- attack.t1055.003 · 2 pages
- attack.t1055.009 · 2 pages
- attack.t1055.011 · 1 pages
- attack.t1055.012 · 4 pages
- attack.t1056 · 2 pages
- attack.t1056.001 · 3 pages
- attack.t1056.002 · 3 pages
- attack.t1057 · 6 pages
- attack.t1059 · 75 pages
- attack.t1059.001 · 179 pages
- attack.t1059.002 · 7 pages
- attack.t1059.003 · 27 pages
- attack.t1059.004 · 15 pages
- attack.t1059.005 · 23 pages
- attack.t1059.006 · 4 pages
- attack.t1059.007 · 21 pages
- attack.t1059.009 · 3 pages
- attack.t1059.012 · 9 pages
- attack.t1068 · 15 pages
- attack.t1069 · 3 pages
- attack.t1069.001 · 15 pages
- attack.t1069.002 · 14 pages
- attack.t1069.003 · 1 pages
- attack.t1070 · 20 pages
- attack.t1070.003 · 9 pages
- attack.t1070.004 · 13 pages
- attack.t1070.005 · 4 pages
- attack.t1070.006 · 5 pages
- attack.t1071 · 5 pages
- attack.t1071.001 · 31 pages
- attack.t1071.003 · 1 pages
- attack.t1071.004 · 10 pages
- attack.t1072 · 4 pages
- attack.t1074 · 2 pages
- attack.t1074.001 · 4 pages
- attack.t1078 · 55 pages
- attack.t1078.001 · 3 pages
- attack.t1078.002 · 5 pages
- attack.t1078.003 · 5 pages
- attack.t1078.004 · 40 pages
- attack.t1082 · 31 pages
- attack.t1083 · 22 pages
- attack.t1087 · 15 pages
- attack.t1087.001 · 12 pages
- attack.t1087.002 · 20 pages
- attack.t1087.004 · 3 pages
- attack.t1090 · 21 pages
- attack.t1090.001 · 6 pages
- attack.t1090.002 · 2 pages
- attack.t1090.003 · 3 pages
- attack.t1091 · 1 pages
- attack.t1095 · 3 pages
- attack.t1098 · 31 pages
- attack.t1098.001 · 3 pages
- attack.t1098.003 · 7 pages
- attack.t1098.005 · 1 pages
- attack.t1102 · 13 pages
- attack.t1102.001 · 4 pages
- attack.t1102.002 · 3 pages
- attack.t1102.003 · 2 pages
- attack.t1105 · 70 pages
- attack.t1106 · 11 pages
- attack.t1110 · 25 pages
- attack.t1110.001 · 3 pages
- attack.t1110.002 · 1 pages
- attack.t1112 · 78 pages
- attack.t1113 · 9 pages
- attack.t1114 · 4 pages
- attack.t1114.001 · 1 pages
- attack.t1114.003 · 2 pages
- attack.t1115 · 7 pages
- attack.t1119 · 4 pages
- attack.t1120 · 2 pages
- attack.t1123 · 6 pages
- attack.t1124 · 3 pages
- attack.t1125 · 1 pages
- attack.t1127 · 19 pages
- attack.t1127.001 · 1 pages
- attack.t1129 · 1 pages
- attack.t1132.001 · 4 pages
- attack.t1133 · 19 pages
- attack.t1134 · 2 pages
- attack.t1134.001 · 9 pages
- attack.t1134.002 · 6 pages
- attack.t1134.003 · 3 pages
- attack.t1134.004 · 1 pages
- attack.t1134.005 · 1 pages
- attack.t1135 · 4 pages
- attack.t1136 · 3 pages
- attack.t1136.001 · 14 pages
- attack.t1136.002 · 3 pages
- attack.t1136.003 · 3 pages
- attack.t1137 · 8 pages
- attack.t1137.002 · 2 pages
- attack.t1137.003 · 1 pages
- attack.t1137.006 · 4 pages
- attack.t1140 · 14 pages
- attack.t1176.001 · 2 pages
- attack.t1185 · 2 pages
- attack.t1187 · 7 pages
- attack.t1189 · 3 pages
- attack.t1190 · 46 pages
- attack.t1195 · 1 pages
- attack.t1195.001 · 2 pages
- attack.t1195.002 · 3 pages
- attack.t1197 · 15 pages
- attack.t1199 · 1 pages
- attack.t1200 · 3 pages
- attack.t1201 · 5 pages
- attack.t1202 · 39 pages
- attack.t1203 · 17 pages
- attack.t1204 · 7 pages
- attack.t1204.001 · 4 pages
- attack.t1204.002 · 27 pages
- attack.t1204.004 · 6 pages
- attack.t1207 · 2 pages
- attack.t1210 · 7 pages
- attack.t1211 · 4 pages
- attack.t1212 · 4 pages
- attack.t1213 · 7 pages
- attack.t1213.003 · 5 pages
- attack.t1216 · 13 pages
- attack.t1216.001 · 2 pages
- attack.t1217 · 4 pages
- attack.t1218 · 135 pages
- attack.t1218.001 · 5 pages
- attack.t1218.002 · 1 pages
- attack.t1218.003 · 7 pages
- attack.t1218.005 · 7 pages
- attack.t1218.007 · 9 pages
- attack.t1218.008 · 8 pages
- attack.t1218.009 · 4 pages
- attack.t1218.010 · 17 pages
- attack.t1218.011 · 27 pages
- attack.t1218.013 · 2 pages
- attack.t1218.014 · 2 pages
- attack.t1219 · 6 pages
- attack.t1219.002 · 41 pages
- attack.t1220 · 5 pages
- attack.t1221 · 1 pages
- attack.t1222 · 2 pages
- attack.t1222.001 · 3 pages
- attack.t1222.002 · 4 pages
- attack.t1482 · 17 pages
- attack.t1484 · 1 pages
- attack.t1484.001 · 6 pages
- attack.t1484.002 · 1 pages
- attack.t1485 · 19 pages
- attack.t1486 · 10 pages
- attack.t1489 · 19 pages
- attack.t1490 · 23 pages
- attack.t1491.001 · 4 pages
- attack.t1495 · 1 pages
- attack.t1496 · 13 pages
- attack.t1497.001 · 3 pages
- attack.t1498 · 2 pages
- attack.t1499 · 1 pages
- attack.t1499.001 · 1 pages
- attack.t1499.004 · 3 pages
- attack.t1505 · 1 pages
- attack.t1505.001 · 1 pages
- attack.t1505.002 · 3 pages
- attack.t1505.003 · 23 pages
- attack.t1505.004 · 5 pages
- attack.t1505.005 · 1 pages
- attack.t1518 · 4 pages
- attack.t1518.001 · 7 pages
- attack.t1525 · 1 pages
- attack.t1526 · 3 pages
- attack.t1528 · 14 pages
- attack.t1529 · 8 pages
- attack.t1531 · 9 pages
- attack.t1537 · 6 pages
- attack.t1539 · 2 pages
- attack.t1542.001 · 2 pages
- attack.t1542.003 · 1 pages
- attack.t1543 · 9 pages
- attack.t1543.001 · 2 pages
- attack.t1543.002 · 2 pages
- attack.t1543.003 · 38 pages
- attack.t1543.004 · 2 pages
- attack.t1546 · 7 pages
- attack.t1546.001 · 5 pages
- attack.t1546.002 · 4 pages
- attack.t1546.003 · 11 pages
- attack.t1546.004 · 1 pages
- attack.t1546.007 · 4 pages
- attack.t1546.008 · 6 pages
- attack.t1546.009 · 2 pages
- attack.t1546.010 · 1 pages
- attack.t1546.011 · 6 pages
- attack.t1546.012 · 2 pages
- attack.t1546.013 · 3 pages
- attack.t1546.014 · 1 pages
- attack.t1546.015 · 8 pages
- attack.t1547 · 7 pages
- attack.t1547.001 · 31 pages
- attack.t1547.002 · 1 pages
- attack.t1547.003 · 1 pages
- attack.t1547.004 · 3 pages
- attack.t1547.005 · 1 pages
- attack.t1547.006 · 1 pages
- attack.t1547.008 · 1 pages
- attack.t1547.009 · 4 pages
- attack.t1547.010 · 4 pages
- attack.t1547.014 · 1 pages
- attack.t1547.015 · 1 pages
- attack.t1548 · 22 pages
- attack.t1548.001 · 1 pages
- attack.t1548.002 · 56 pages
- attack.t1548.003 · 1 pages
- attack.t1550 · 4 pages
- attack.t1550.001 · 4 pages
- attack.t1550.002 · 5 pages
- attack.t1550.003 · 4 pages
- attack.t1552 · 12 pages
- attack.t1552.001 · 20 pages
- attack.t1552.002 · 4 pages
- attack.t1552.003 · 3 pages
- attack.t1552.004 · 6 pages
- attack.t1552.006 · 5 pages
- attack.t1552.007 · 4 pages
- attack.t1553 · 2 pages
- attack.t1553.001 · 1 pages
- attack.t1553.002 · 1 pages
- attack.t1553.003 · 1 pages
- attack.t1553.004 · 10 pages
- attack.t1553.005 · 6 pages
- attack.t1554 · 5 pages
- attack.t1555 · 8 pages
- attack.t1555.001 · 1 pages
- attack.t1555.003 · 7 pages
- attack.t1555.004 · 4 pages
- attack.t1555.005 · 1 pages
- attack.t1556 · 12 pages
- attack.t1556.002 · 3 pages
- attack.t1556.004 · 1 pages
- attack.t1556.006 · 3 pages
- attack.t1557 · 9 pages
- attack.t1557.001 · 10 pages
- attack.t1557.003 · 1 pages
- attack.t1558 · 5 pages
- attack.t1558.003 · 15 pages
- attack.t1559.001 · 3 pages
- attack.t1559.002 · 1 pages
- attack.t1560 · 2 pages
- attack.t1560.001 · 13 pages
- attack.t1561.001 · 1 pages
- attack.t1561.002 · 1 pages
- attack.t1563.002 · 2 pages
- attack.t1564 · 10 pages
- attack.t1564.001 · 7 pages
- attack.t1564.002 · 4 pages
- attack.t1564.003 · 8 pages
- attack.t1564.004 · 22 pages
- attack.t1564.006 · 2 pages
- attack.t1565 · 3 pages
- attack.t1565.001 · 6 pages
- attack.t1565.002 · 2 pages
- attack.t1566 · 11 pages
- attack.t1566.001 · 19 pages
- attack.t1566.002 · 3 pages
- attack.t1567 · 11 pages
- attack.t1567.001 · 2 pages
- attack.t1567.002 · 13 pages
- attack.t1568 · 1 pages
- attack.t1568.002 · 2 pages
- attack.t1569 · 1 pages
- attack.t1569.001 · 1 pages
- attack.t1569.002 · 39 pages
- attack.t1570 · 4 pages
- attack.t1571 · 5 pages
- attack.t1572 · 23 pages
- attack.t1573 · 4 pages
- attack.t1574 · 5 pages
- attack.t1574.001 · 80 pages
- attack.t1574.005 · 2 pages
- attack.t1574.006 · 2 pages
- attack.t1574.007 · 2 pages
- attack.t1574.008 · 1 pages
- attack.t1574.011 · 11 pages
- attack.t1574.012 · 2 pages
- attack.t1578 · 1 pages
- attack.t1578.003 · 1 pages
- attack.t1580 · 1 pages
- attack.t1584 · 3 pages
- attack.t1586 · 2 pages
- attack.t1586.003 · 1 pages
- attack.t1587 · 3 pages
- attack.t1587.001 · 7 pages
- attack.t1588 · 2 pages
- attack.t1588.001 · 1 pages
- attack.t1588.002 · 9 pages
- attack.t1589 · 1 pages
- attack.t1589.002 · 1 pages
- attack.t1590 · 2 pages
- attack.t1590.001 · 1 pages
- attack.t1590.002 · 1 pages
- attack.t1591.004 · 2 pages
- attack.t1592.004 · 3 pages
- attack.t1593.003 · 2 pages
- attack.t1595 · 3 pages
- attack.t1595.002 · 1 pages
- attack.t1599.001 · 1 pages
- attack.t1606 · 1 pages
- attack.t1608 · 2 pages
- attack.t1608.003 · 1 pages
- attack.t1609 · 3 pages
- attack.t1611 · 2 pages
- attack.t1613 · 1 pages
- attack.t1614.001 · 2 pages
- attack.t1615 · 5 pages
- attack.t1619 · 1 pages
- attack.t1620 · 2 pages
- attack.t1621 · 2 pages
- attack.t1622 · 1 pages
- attack.t1649 · 4 pages
- attack.t1653 · 1 pages
- attack.t1685 · 156 pages
- attack.t1685.001 · 26 pages
- attack.t1685.002 · 3 pages
- attack.t1685.004 · 1 pages
- attack.t1685.005 · 6 pages
- attack.t1685.006 · 4 pages
- attack.t1686 · 7 pages
- attack.t1686.001 · 5 pages
- attack.t1686.003 · 17 pages
- attack.t1689 · 1 pages
- attack.t1690 · 1 pages
- car.2013-01-002 · 1 pages
- car.2013-02-003 · 1 pages
- car.2013-03-001 · 1 pages
- car.2013-05-002 · 2 pages
- car.2013-05-004 · 2 pages
- car.2013-05-009 · 3 pages
- car.2013-07-001 · 3 pages
- car.2013-07-002 · 7 pages
- car.2013-08-001 · 2 pages
- car.2013-09-005 · 5 pages
- car.2014-04-003 · 1 pages
- car.2014-11-003 · 2 pages
- car.2014-11-008 · 2 pages
- car.2015-04-001 · 2 pages
- car.2016-03-001 · 7 pages
- car.2016-03-002 · 2 pages
- car.2016-04-002 · 6 pages
- car.2016-04-005 · 1 pages
- car.2019-04-001 · 8 pages
- car.2019-04-004 · 2 pages
- car.2022-03-001 · 3 pages
- cve.2017-5638 · 1 pages
- cve.2020-1599 · 1 pages
- cve.2021-1675 · 1 pages
- cve.2021-21551 · 1 pages
- cve.2021-26084 · 1 pages
- cve.2021-35211 · 1 pages
- cve.2021-36934 · 1 pages
- cve.2021-42278 · 1 pages
- cve.2021-42287 · 1 pages
- cve.2022-26134 · 2 pages
- cve.2022-30190 · 2 pages
- cve.2022-41120 · 1 pages
- cve.2023-23397 · 1 pages
- stp.1k · 1 pages
- stp.1u · 3 pages
- stp.2a · 1 pages
- stp.4u · 1 pages
simulation
- can_simulate · 336 pages
- cannot_simulate_yet · 582 pages
tactic
- collection · 76 pages
- command-and-control · 65 pages
- credential-access · 77 pages
- defense-evasion · 33 pages
- defense-impairment · 56 pages
- discovery · 70 pages
- evasion · 9 pages
- execution · 79 pages
- exfiltration · 22 pages
- impact · 56 pages
- impair-process-control · 8 pages
- inhibit-response-function · 20 pages
- initial-access · 45 pages
- lateral-movement · 36 pages
- persistence · 133 pages
- privilege-escalation · 103 pages
- reconnaissance · 46 pages
- resource-development · 50 pages
- stealth · 148 pages
telemetry-category
- Application and service audit · 3 pages
- Cloud control plane · 21 pages
- Cloud storage · 6 pages
- Container runtime · 3 pages
- Endpoint activity · 16 pages
- External context and intelligence · 5 pages
- Host state and inventory · 13 pages
- Identity and SaaS · 3 pages
- Industrial operations and physical process · 20 pages
- Kubernetes · 2 pages
- Mobile lab instrumentation · 11 pages
- Network and protocol telemetry · 12 pages
- Sample analysis and intelligence · 2 pages
- Script and command execution · 2 pages
- Windows and directory audit · 20 pages
telemetry-kind
- attack_component · 113 pages
- proposed_input · 26 pages
tool-kind
- attack_tool · 97 pages
- curated_tool · 18 pages
- selected_framework · 1 pages
visibility
- no_standard_source_mapping · 17 pages
- outside_target_visibility · 45 pages
- source_mapped · 856 pages
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.