Gold Open Source
ExplorePackagesVulnerabilitiesCWEsMCP ServersScan
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Certified Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/MITRE ATT&CK
Adversary Tactics & Techniques

MITRE ATT&CK

The full ATT&CK matrix — 41 adversary tactics, 378 techniques and 540 sub-techniques, each with mapped mitigations, and the groups and software that use them.

GroupsThreat actors & APTsSoftwareMalware & toolsCampaignsIntrusion campaigns
TA0001Initial Access11 techniquesTA0002Execution20 techniquesTA0003Persistence22 techniquesTA0004Privilege Escalation13 techniquesTA0005Stealth30 techniquesTA0006Credential Access17 techniquesTA0007Discovery34 techniquesTA0008Lateral Movement9 techniquesTA0009Collection17 techniquesTA0010Exfiltration9 techniquesTA0011Command and Control18 techniquesTA0027Initial Access8 techniquesTA0028Persistence8 techniquesTA0029Privilege Escalation3 techniquesTA0030Defense Evasion17 techniquesTA0031Credential Access6 techniquesTA0032Discovery8 techniquesTA0033Lateral Movement2 techniquesTA0034Impact10 techniquesTA0035Collection15 techniquesTA0036Exfiltration2 techniquesTA0037Command and Control9 techniquesTA0038Network Effects0 techniquesTA0039Remote Service Effects0 techniquesTA0040Impact15 techniquesTA0041Execution4 techniquesTA0042Resource Development9 techniquesTA0043Reconnaissance12 techniquesTA0100Collection11 techniquesTA0101Command and Control3 techniquesTA0102Discovery5 techniquesTA0103Evasion7 techniquesTA0104Execution10 techniquesTA0105Impact12 techniquesTA0106Impair Process Control4 techniquesTA0107Inhibit Response Function13 techniquesTA0108Initial Access12 techniquesTA0109Lateral Movement6 techniquesTA0110Persistence5 techniquesTA0111Privilege Escalation2 techniquesTA0112Defense Impairment18 techniques

378 techniques · 540 sub-techniques

Initial AccessTA0001 · 11

T1078 · 4 subValid Accounts
001Default Accounts002Domain Accounts003Local Accounts004Cloud Accounts
T1091Replication Through Removable Media
T1133External Remote Services
T1189Drive-by Compromise
T1190Exploit Public-Facing Application
T1195 · 3 subSupply Chain Compromise
001Compromise Software Dependencies and Development Tools002Compromise Software Supply Chain003Compromise Hardware Supply Chain
T1199Trusted Relationship
T1200Hardware Additions
T1566 · 4 subPhishing
001Spearphishing Attachment002Spearphishing Link003Spearphishing via Service004Spearphishing Voice
T1659Content Injection
T1669Wi-Fi Networks

ExecutionTA0002 · 20

T1047Windows Management Instrumentation
T1053 · 5 subScheduled Task/Job
002At003Cron005Scheduled Task006Systemd Timers007Container Orchestration Job
T1059 · 13 subCommand and Scripting Interpreter
001PowerShell002AppleScript003Windows Command Shell004Unix Shell005Visual Basic006Python007JavaScript008Network Device CLI009Cloud API010AutoHotKey & AutoIT011Lua012Hypervisor CLI013Container CLI/API
T1072Software Deployment Tools
T1106Native API
T1127 · 3 subTrusted Developer Utilities Proxy Execution
001MSBuild002ClickOnce003JamPlus
T1129Shared Modules
T1197BITS Jobs
T1203Exploitation for Client Execution
T1204 · 5 subUser Execution
001Malicious Link002Malicious File003Malicious Image004Malicious Copy and Paste005Malicious Library
T1559 · 3 subInter-Process Communication
001Component Object Model002Dynamic Data Exchange003XPC Services
T1569 · 3 subSystem Services
001Launchctl002Service Execution003Systemctl
T1574 · 12 subHijack Execution Flow
001DLL004Dylib Hijacking005Executable Installer File Permissions Weakness006Dynamic Linker Hijacking007Path Interception by PATH Environment Variable008Path Interception by Search Order Hijacking009Path Interception by Unquoted Path010Services File Permissions Weakness011Services Registry Permissions Weakness012COR_PROFILER013KernelCallbackTable014AppDomainManager
T1609Container Administration Command
T1610Deploy Container
T1648Serverless Execution
T1651Cloud Administration Command
T1674Input Injection
T1675ESXi Administration Command
T1677Poisoned Pipeline Execution

PersistenceTA0003 · 22

T1037 · 5 subBoot or Logon Initialization Scripts
001Logon Script (Windows)002Login Hook003Network Logon Script004RC Scripts005Startup Items
T1053 · 5 subScheduled Task/Job
002At003Cron005Scheduled Task006Systemd Timers007Container Orchestration Job
T1078 · 4 subValid Accounts
001Default Accounts002Domain Accounts003Local Accounts004Cloud Accounts
T1098 · 7 subAccount Manipulation
001Additional Cloud Credentials002Additional Email Delegate Permissions003Additional Cloud Roles004SSH Authorized Keys005Device Registration006Additional Container Cluster Roles007Additional Local or Domain Groups
T1112Modify Registry
T1133External Remote Services
T1136 · 3 subCreate Account
001Local Account002Domain Account003Cloud Account
T1137 · 6 subOffice Application Startup
001Office Template Macros002Office Test003Outlook Forms004Outlook Home Page005Outlook Rules006Add-ins
T1176 · 2 subSoftware Extensions
001Browser Extensions002IDE Extensions
T1197BITS Jobs
T1205 · 2 subTraffic Signaling
001Port Knocking002Socket Filters
T1505 · 6 subServer Software Component
001SQL Stored Procedures002Transport Agent003Web Shell004IIS Components005Terminal Services DLL006vSphere Installation Bundles
T1525Implant Internal Image
T1542 · 5 subPre-OS Boot
001System Firmware002Component Firmware003Bootkit004ROMMONkit005TFTP Boot
T1543 · 5 subCreate or Modify System Process
001Launch Agent002Systemd Service003Windows Service004Launch Daemon005Container Service
T1546 · 18 subEvent Triggered Execution
001Change Default File Association002Screensaver003Windows Management Instrumentation Event Subscription004Unix Shell Configuration Modification005Trap006LC_LOAD_DYLIB Addition007Netsh Helper DLL008Accessibility Features009AppCert DLLs010AppInit DLLs011Application Shimming012Image File Execution Options Injection013PowerShell Profile014Emond015Component Object Model Hijacking016Installer Packages017Udev Rules018Python Startup Hooks
T1547 · 14 subBoot or Logon Autostart Execution
001Registry Run Keys / Startup Folder002Authentication Package003Time Providers004Winlogon Helper DLL005Security Support Provider006Kernel Modules and Extensions007Re-opened Applications008LSASS Driver009Shortcut Modification010Port Monitors012Print Processors013XDG Autostart Entries014Active Setup015Login Items
T1554Compromise Host Software Binary
T1556 · 9 subModify Authentication Process
001Domain Controller Authentication002Password Filter DLL003Pluggable Authentication Modules004Network Device Authentication005Reversible Encryption006Multi-Factor Authentication007Hybrid Identity008Network Provider DLL009Conditional Access Policies
T1653Power Settings
T1668Exclusive Control
T1671Cloud Application Integration

Privilege EscalationTA0004 · 13

T1037 · 5 subBoot or Logon Initialization Scripts
001Logon Script (Windows)002Login Hook003Network Logon Script004RC Scripts005Startup Items
T1053 · 5 subScheduled Task/Job
002At003Cron005Scheduled Task006Systemd Timers007Container Orchestration Job
T1055 · 12 subProcess Injection
001Dynamic-link Library Injection002Portable Executable Injection003Thread Execution Hijacking004Asynchronous Procedure Call005Thread Local Storage008Ptrace System Calls009Proc Memory011Extra Window Memory Injection012Process Hollowing013Process Doppelgänging014VDSO Hijacking015ListPlanting
T1068Exploitation for Privilege Escalation
T1078 · 4 subValid Accounts
001Default Accounts002Domain Accounts003Local Accounts004Cloud Accounts
T1098 · 7 subAccount Manipulation
001Additional Cloud Credentials002Additional Email Delegate Permissions003Additional Cloud Roles004SSH Authorized Keys005Device Registration006Additional Container Cluster Roles007Additional Local or Domain Groups
T1134 · 5 subAccess Token Manipulation
001Token Impersonation/Theft002Create Process with Token003Make and Impersonate Token004Parent PID Spoofing005SID-History Injection
T1484 · 2 subDomain or Tenant Policy Modification
001Group Policy Modification002Trust Modification
T1543 · 5 subCreate or Modify System Process
001Launch Agent002Systemd Service003Windows Service004Launch Daemon005Container Service
T1546 · 18 subEvent Triggered Execution
001Change Default File Association002Screensaver003Windows Management Instrumentation Event Subscription004Unix Shell Configuration Modification005Trap006LC_LOAD_DYLIB Addition007Netsh Helper DLL008Accessibility Features009AppCert DLLs010AppInit DLLs011Application Shimming012Image File Execution Options Injection013PowerShell Profile014Emond015Component Object Model Hijacking016Installer Packages017Udev Rules018Python Startup Hooks
T1547 · 14 subBoot or Logon Autostart Execution
001Registry Run Keys / Startup Folder002Authentication Package003Time Providers004Winlogon Helper DLL005Security Support Provider006Kernel Modules and Extensions007Re-opened Applications008LSASS Driver009Shortcut Modification010Port Monitors012Print Processors013XDG Autostart Entries014Active Setup015Login Items
T1548 · 6 subAbuse Elevation Control Mechanism
001Setuid and Setgid002Bypass User Account Control003Sudo and Sudo Caching004Elevated Execution with Prompt005Temporary Elevated Cloud Access006TCC Manipulation
T1611Escape to Host

StealthTA0005 · 30

T1006Direct Volume Access
T1014Rootkit
T1027 · 18 subObfuscated Files or Information
001Binary Padding002Software Packing003Steganography004Compile After Delivery005Indicator Removal from Tools006HTML Smuggling007Dynamic API Resolution008Stripped Payloads009Embedded Payloads010Command Obfuscation011Fileless Storage012LNK Icon Smuggling013Encrypted/Encoded File014Polymorphic Code015Compression016Junk Code Insertion017SVG Smuggling018Invisible Unicode
T1036 · 12 subMasquerading
001Invalid Code Signature002Right-to-Left Override003Rename Legitimate Utilities004Masquerade Task or Service005Match Legitimate Resource Name or Location006Space after Filename007Double File Extension008Masquerade File Type009Break Process Trees010Masquerade Account Name011Overwrite Process Arguments012Browser Fingerprint
T1055 · 12 subProcess Injection
001Dynamic-link Library Injection002Portable Executable Injection003Thread Execution Hijacking004Asynchronous Procedure Call005Thread Local Storage008Ptrace System Calls009Proc Memory011Extra Window Memory Injection012Process Hollowing013Process Doppelgänging014VDSO Hijacking015ListPlanting
T1070 · 8 subIndicator Removal
003Clear Command History004File Deletion005Network Share Connection Removal006Timestomp007Clear Network Connection History and Configurations008Clear Mailbox Data009Clear Persistence010Relocate Malware
T1078 · 4 subValid Accounts
001Default Accounts002Domain Accounts003Local Accounts004Cloud Accounts
T1127 · 3 subTrusted Developer Utilities Proxy Execution
001MSBuild002ClickOnce003JamPlus
T1134 · 5 subAccess Token Manipulation
001Token Impersonation/Theft002Create Process with Token003Make and Impersonate Token004Parent PID Spoofing005SID-History Injection
T1140Deobfuscate/Decode Files or Information
T1197BITS Jobs
T1202Indirect Command Execution
T1205 · 2 subTraffic Signaling
001Port Knocking002Socket Filters
T1211Exploitation for Stealth
T1216 · 2 subSystem Script Proxy Execution
001PubPrn002SyncAppvPublishingServer
T1218 · 14 subSystem Binary Proxy Execution
001Compiled HTML File002Control Panel003CMSTP004InstallUtil005Mshta007Msiexec008Odbcconf009Regsvcs/Regasm010Regsvr32011Rundll32012Verclsid013Mavinject014MMC015Electron Applications
T1220XSL Script Processing
T1221Template Injection
T1480 · 2 subExecution Guardrails
001Environmental Keying002Mutual Exclusion
T1497 · 3 subVirtualization/Sandbox Evasion
001System Checks002User Activity Based Checks003Time Based Checks
T1535Unused/Unsupported Cloud Regions
T1542 · 5 subPre-OS Boot
001System Firmware002Component Firmware003Bootkit004ROMMONkit005TFTP Boot
T1564 · 14 subHide Artifacts
001Hidden Files and Directories002Hidden Users003Hidden Window004NTFS File Attributes005Hidden File System006Run Virtual Instance007VBA Stomping008Email Hiding Rules009Resource Forking010Process Argument Spoofing011Ignore Process Interrupts012File/Path Exclusions013Bind Mounts014Extended Attributes
T1574 · 12 subHijack Execution Flow
001DLL004Dylib Hijacking005Executable Installer File Permissions Weakness006Dynamic Linker Hijacking007Path Interception by PATH Environment Variable008Path Interception by Search Order Hijacking009Path Interception by Unquoted Path010Services File Permissions Weakness011Services Registry Permissions Weakness012COR_PROFILER013KernelCallbackTable014AppDomainManager
T1612Build Image on Host
T1620Reflective Code Loading
T1622Debugger Evasion
T1678Delay Execution
T1679Selective Exclusion
T1684 · 2 subSocial Engineering
001Impersonation002Email Spoofing

Credential AccessTA0006 · 17

T1003 · 8 subOS Credential Dumping
001LSASS Memory002Security Account Manager003NTDS004LSA Secrets005Cached Domain Credentials006DCSync007Proc Filesystem008/etc/passwd and /etc/shadow
T1040Network Sniffing
T1056 · 4 subInput Capture
001Keylogging002GUI Input Capture003Web Portal Capture004Credential API Hooking
T1110 · 4 subBrute Force
001Password Guessing002Password Cracking003Password Spraying004Credential Stuffing
T1111Multi-Factor Authentication Interception
T1187Forced Authentication
T1212Exploitation for Credential Access
T1528Steal Application Access Token
T1539Steal Web Session Cookie
T1552 · 8 subUnsecured Credentials
001Credentials In Files002Credentials in Registry003Shell History004Private Keys005Cloud Instance Metadata API006Group Policy Preferences007Container API008Chat Messages
T1555 · 6 subCredentials from Password Stores
001Keychain002Securityd Memory003Credentials from Web Browsers004Windows Credential Manager005Password Managers006Cloud Secrets Management Stores
T1556 · 9 subModify Authentication Process
001Domain Controller Authentication002Password Filter DLL003Pluggable Authentication Modules004Network Device Authentication005Reversible Encryption006Multi-Factor Authentication007Hybrid Identity008Network Provider DLL009Conditional Access Policies
T1557 · 4 subAdversary-in-the-Middle
001Name Resolution Poisoning and SMB Relay002ARP Cache Poisoning003DHCP Spoofing004Evil Twin
T1558 · 5 subSteal or Forge Kerberos Tickets
001Golden Ticket002Silver Ticket003Kerberoasting004AS-REP Roasting005Ccache Files
T1606 · 2 subForge Web Credentials
001Web Cookies002SAML Tokens
T1621Multi-Factor Authentication Request Generation
T1649Steal or Forge Authentication Certificates

DiscoveryTA0007 · 34

T1007System Service Discovery
T1010Application Window Discovery
T1012Query Registry
T1016 · 2 subSystem Network Configuration Discovery
001Internet Connection Discovery002Wi-Fi Discovery
T1018Remote System Discovery
T1033System Owner/User Discovery
T1040Network Sniffing
T1046Network Service Discovery
T1049System Network Connections Discovery
T1057Process Discovery
T1069 · 3 subPermission Groups Discovery
001Local Groups002Domain Groups003Cloud Groups
T1082System Information Discovery
T1083File and Directory Discovery
T1087 · 4 subAccount Discovery
001Local Account002Domain Account003Email Account004Cloud Account
T1120Peripheral Device Discovery
T1124System Time Discovery
T1135Network Share Discovery
T1201Password Policy Discovery
T1217Browser Information Discovery
T1482Domain Trust Discovery
T1497 · 3 subVirtualization/Sandbox Evasion
001System Checks002User Activity Based Checks003Time Based Checks
T1518 · 2 subSoftware Discovery
001Security Software Discovery002Backup Software Discovery
T1526Cloud Service Discovery
T1538Cloud Service Dashboard
T1580Cloud Infrastructure Discovery
T1613Container and Resource Discovery
T1614 · 1 subSystem Location Discovery
001System Language Discovery
T1615Group Policy Discovery
T1619Cloud Storage Object Discovery
T1622Debugger Evasion
T1652Device Driver Discovery
T1654Log Enumeration
T1673Virtual Machine Discovery
T1680Local Storage Discovery

Lateral MovementTA0008 · 9

T1021 · 8 subRemote Services
001Remote Desktop Protocol002SMB/Windows Admin Shares003Distributed Component Object Model004SSH005VNC006Windows Remote Management007Cloud Services008Direct Cloud VM Connections
T1072Software Deployment Tools
T1080Taint Shared Content
T1091Replication Through Removable Media
T1210Exploitation of Remote Services
T1534Internal Spearphishing
T1550 · 4 subUse Alternate Authentication Material
001Application Access Token002Pass the Hash003Pass the Ticket004Web Session Cookie
T1563 · 2 subRemote Service Session Hijacking
001SSH Hijacking002RDP Hijacking
T1570Lateral Tool Transfer

CollectionTA0009 · 17

T1005Data from Local System
T1025Data from Removable Media
T1039Data from Network Shared Drive
T1056 · 4 subInput Capture
001Keylogging002GUI Input Capture003Web Portal Capture004Credential API Hooking
T1074 · 2 subData Staged
001Local Data Staging002Remote Data Staging
T1113Screen Capture
T1114 · 3 subEmail Collection
001Local Email Collection002Remote Email Collection003Email Forwarding Rule
T1115Clipboard Data
T1119Automated Collection
T1123Audio Capture
T1125Video Capture
T1185Browser Session Hijacking
T1213 · 6 subData from Information Repositories
001Confluence002Sharepoint003Code Repositories004Customer Relationship Management Software005Messaging Applications006Databases
T1530Data from Cloud Storage
T1557 · 4 subAdversary-in-the-Middle
001Name Resolution Poisoning and SMB Relay002ARP Cache Poisoning003DHCP Spoofing004Evil Twin
T1560 · 3 subArchive Collected Data
001Archive via Utility002Archive via Library003Archive via Custom Method
T1602 · 2 subData from Configuration Repository
001SNMP (MIB Dump)002Network Device Configuration Dump

ExfiltrationTA0010 · 9

T1011 · 1 subExfiltration Over Other Network Medium
001Exfiltration Over Bluetooth
T1020 · 1 subAutomated Exfiltration
001Traffic Duplication
T1029Scheduled Transfer
T1030Data Transfer Size Limits
T1041Exfiltration Over C2 Channel
T1048 · 3 subExfiltration Over Alternative Protocol
001Exfiltration Over Symmetric Encrypted Non-C2 Protocol002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol003Exfiltration Over Unencrypted Non-C2 Protocol
T1052 · 1 subExfiltration Over Physical Medium
001Exfiltration over USB
T1537Transfer Data to Cloud Account
T1567 · 4 subExfiltration Over Web Service
001Exfiltration to Code Repository002Exfiltration to Cloud Storage003Exfiltration to Text Storage Sites004Exfiltration Over Webhook

Command and ControlTA0011 · 18

T1001 · 3 subData Obfuscation
001Junk Data002Steganography003Protocol or Service Impersonation
T1008Fallback Channels
T1071 · 5 subApplication Layer Protocol
001Web Protocols002File Transfer Protocols003Mail Protocols004DNS005Publish/Subscribe Protocols
T1090 · 4 subProxy
001Internal Proxy002External Proxy003Multi-hop Proxy004Domain Fronting
T1092Communication Through Removable Media
T1095Non-Application Layer Protocol
T1102 · 3 subWeb Service
001Dead Drop Resolver002Bidirectional Communication003One-Way Communication
T1104Multi-Stage Channels
T1105Ingress Tool Transfer
T1132 · 2 subData Encoding
001Standard Encoding002Non-Standard Encoding
T1205 · 2 subTraffic Signaling
001Port Knocking002Socket Filters
T1219 · 3 subRemote Access Tools
001IDE Tunneling002Remote Desktop Software003Remote Access Hardware
T1568 · 3 subDynamic Resolution
001Fast Flux DNS002Domain Generation Algorithms003DNS Calculation
T1571Non-Standard Port
T1572Protocol Tunneling
T1573 · 2 subEncrypted Channel
001Symmetric Cryptography002Asymmetric Cryptography
T1659Content Injection
T1665Hide Infrastructure

Initial AccessTA0027 · 8

T1451SIM Card Swap
T1456Drive-By Compromise
T1458Replication Through Removable Media
T1461Lockscreen Bypass
T1474 · 3 subSupply Chain Compromise
001Compromise Software Dependencies and Development Tools002Compromise Hardware Supply Chain003Compromise Software Supply Chain
T1660Phishing
T1661Application Versioning
T1664Exploitation for Initial Access

PersistenceTA0028 · 8

T1398Boot or Logon Initialization Scripts
T1541Foreground Persistence
T1577Compromise Application Executable
T1603Scheduled Task/Job
T1624 · 1 subEvent Triggered Execution
001Broadcast Receivers
T1625 · 1 subHijack Execution Flow
001System Runtime API Hijacking
T1645Compromise Client Software Binary
T1676Linked Devices

Privilege EscalationTA0029 · 3

T1404Exploitation for Privilege Escalation
T1626 · 1 subAbuse Elevation Control Mechanism
001Device Administrator Permissions
T1631 · 1 subProcess Injection
001Ptrace System Calls

Defense EvasionTA0030 · 17

T1406 · 2 subObfuscated Files or Information
001Steganography002Software Packing
T1407Download New Code at Runtime
T1516Input Injection
T1541Foreground Persistence
T1575Native API
T1604Proxy Through Victim
T1617Hooking
T1627 · 1 subExecution Guardrails
001Geofencing
T1628 · 3 subHide Artifacts
001Suppress Application Icon002User Evasion003Conceal Multimedia Files
T1629 · 3 subImpair Defenses
001Prevent Application Removal002Device Lockout003Disable or Modify Tools
T1630 · 3 subIndicator Removal on Host
001Uninstall Malicious Application002File Deletion003Disguise Root/Jailbreak Indicators
T1631 · 1 subProcess Injection
001Ptrace System Calls
T1632 · 1 subSubvert Trust Controls
001Code Signing Policy Modification
T1633 · 1 subVirtualization/Sandbox Evasion
001System Checks
T1655 · 1 subMasquerading
001Match Legitimate Name or Location
T1661Application Versioning
T1670Virtualization Solution

Credential AccessTA0031 · 6

T1414Clipboard Data
T1417 · 2 subInput Capture
001Keylogging002GUI Input Capture
T1453Abuse Accessibility Features
T1517Access Notifications
T1634 · 1 subCredentials from Password Store
001Keychain
T1635 · 1 subSteal Application Access Token
001URI Hijacking

DiscoveryTA0032 · 8

T1418 · 1 subSoftware Discovery
001Security Software Discovery
T1420File and Directory Discovery
T1421System Network Connections Discovery
T1422 · 2 subSystem Network Configuration Discovery
001Internet Connection Discovery002Wi-Fi Discovery
T1423Network Service Scanning
T1424Process Discovery
T1426System Information Discovery
T1430 · 2 subLocation Tracking
001Remote Device Management Services002Impersonate SS7 Nodes

Lateral MovementTA0033 · 2

T1428Exploitation of Remote Services
T1458Replication Through Removable Media

ImpactTA0034 · 10

T1464Network Denial of Service
T1471Data Encrypted for Impact
T1516Input Injection
T1582SMS Control
T1616Call Control
T1640Account Access Removal
T1641 · 1 subData Manipulation
001Transmitted Data Manipulation
T1642Endpoint Denial of Service
T1643Generate Traffic from Victim
T1662Data Destruction

CollectionTA0035 · 15

T1409Stored Application Data
T1414Clipboard Data
T1417 · 2 subInput Capture
001Keylogging002GUI Input Capture
T1429Audio Capture
T1430 · 2 subLocation Tracking
001Remote Device Management Services002Impersonate SS7 Nodes
T1453Abuse Accessibility Features
T1512Video Capture
T1513Screen Capture
T1517Access Notifications
T1532Archive Collected Data
T1533Data from Local System
T1616Call Control
T1636 · 5 subProtected User Data
001Calendar Entries002Call Log003Contact List004SMS Messages005Accounts
T1638Adversary-in-the-Middle
T1676Linked Devices

ExfiltrationTA0036 · 2

T1639 · 1 subExfiltration Over Alternative Protocol
001Exfiltration Over Unencrypted Non-C2 Protocol
T1646Exfiltration Over C2 Channel

Command and ControlTA0037 · 9

T1437 · 1 subApplication Layer Protocol
001Web Protocols
T1481 · 3 subWeb Service
001Dead Drop Resolver002Bidirectional Communication003One-Way Communication
T1509Non-Standard Port
T1521 · 3 subEncrypted Channel
001Symmetric Cryptography002Asymmetric Cryptography003SSL Pinning
T1544Ingress Tool Transfer
T1616Call Control
T1637 · 1 subDynamic Resolution
001Domain Generation Algorithms
T1644Out of Band Data
T1663Remote Access Software

ImpactTA0040 · 15

T1485 · 1 subData Destruction
001Lifecycle-Triggered Deletion
T1486Data Encrypted for Impact
T1489Service Stop
T1490Inhibit System Recovery
T1491 · 2 subDefacement
001Internal Defacement002External Defacement
T1495Firmware Corruption
T1496 · 4 subResource Hijacking
001Compute Hijacking002Bandwidth Hijacking003SMS Pumping004Cloud Service Hijacking
T1498 · 2 subNetwork Denial of Service
001Direct Network Flood002Reflection Amplification
T1499 · 4 subEndpoint Denial of Service
001OS Exhaustion Flood002Service Exhaustion Flood003Application Exhaustion Flood004Application or System Exploitation
T1529System Shutdown/Reboot
T1531Account Access Removal
T1561 · 2 subDisk Wipe
001Disk Content Wipe002Disk Structure Wipe
T1565 · 3 subData Manipulation
001Stored Data Manipulation002Transmitted Data Manipulation003Runtime Data Manipulation
T1657Financial Theft
T1667Email Bombing

ExecutionTA0041 · 4

T1575Native API
T1603Scheduled Task/Job
T1623 · 1 subCommand and Scripting Interpreter
001Unix Shell
T1658Exploitation for Client Execution

Resource DevelopmentTA0042 · 9

T1583 · 8 subAcquire Infrastructure
001Domains002DNS Server003Virtual Private Server004Server005Botnet006Web Services007Serverless008Malvertising
T1584 · 8 subCompromise Infrastructure
001Domains002DNS Server003Virtual Private Server004Server005Botnet006Web Services007Serverless008Network Devices
T1585 · 3 subEstablish Accounts
001Social Media Accounts002Email Accounts003Cloud Accounts
T1586 · 3 subCompromise Accounts
001Social Media Accounts002Email Accounts003Cloud Accounts
T1587 · 4 subDevelop Capabilities
001Malware002Code Signing Certificates003Digital Certificates004Exploits
T1588 · 7 subObtain Capabilities
001Malware002Tool003Code Signing Certificates004Digital Certificates005Exploits006Vulnerabilities007Artificial Intelligence
T1608 · 6 subStage Capabilities
001Upload Malware002Upload Tool003Install Digital Certificate004Drive-by Target005Link Target006SEO Poisoning
T1650Acquire Access
T1683 · 2 subGenerate Content
001Written Content002Audio-Visual Content

ReconnaissanceTA0043 · 12

T1589 · 3 subGather Victim Identity Information
001Credentials002Email Addresses003Employee Names
T1590 · 6 subGather Victim Network Information
001Domain Properties002DNS003Network Trust Dependencies004Network Topology005IP Addresses006Network Security Appliances
T1591 · 4 subGather Victim Org Information
001Determine Physical Locations002Business Relationships003Identify Business Tempo004Identify Roles
T1592 · 4 subGather Victim Host Information
001Hardware002Software003Firmware004Client Configurations
T1593 · 3 subSearch Open Websites/Domains
001Social Media002Search Engines003Code Repositories
T1594Search Victim-Owned Websites
T1595 · 3 subActive Scanning
001Scanning IP Blocks002Vulnerability Scanning003Wordlist Scanning
T1596 · 5 subSearch Open Technical Databases
001DNS/Passive DNS002WHOIS003Digital Certificates004CDNs005Scan Databases
T1597 · 2 subSearch Closed Sources
001Threat Intel Vendors002Purchase Technical Data
T1598 · 4 subPhishing for Information
001Spearphishing Service002Spearphishing Attachment003Spearphishing Link004Spearphishing Voice
T1681Search Threat Vendor Data
T1682Query Public AI Services

CollectionTA0100 · 11

T0801Monitor Process State
T0802Automated Collection
T0811Data from Information Repositories
T0830Adversary-in-the-Middle
T0845Program Upload
T0852Screen Capture
T0861Point & Tag Identification
T0868Detect Operating Mode
T0877I/O Image
T0887Wireless Sniffing
T0893Data from Local System

Command and ControlTA0101 · 3

T0869Standard Application Layer Protocol
T0884Connection Proxy
T0885Commonly Used Port

DiscoveryTA0102 · 5

T0840Network Connection Enumeration
T0842Network Sniffing
T0846 · 3 subRemote System Discovery
001Port Scan002Broadcast Discovery003Multicast Discovery
T0887Wireless Sniffing
T0888Remote System Information Discovery

EvasionTA0103 · 7

T0820Exploitation for Evasion
T0849Masquerading
T0851Rootkit
T0858Change Operating Mode
T0872Indicator Removal on Host
T0894System Binary Proxy Execution
T1692 · 2 subUnauthorized Message
001Command Message002Reporting Message

ExecutionTA0104 · 10

T0807Command-Line Interface
T0821Modify Controller Tasking
T0823Graphical User Interface
T0834Native API
T0853Scripting
T0858Change Operating Mode
T0863User Execution
T0871Execution through API
T0874Hooking
T0895Autorun Image

ImpactTA0105 · 12

T0813Denial of Control
T0815Denial of View
T0826Loss of Availability
T0827Loss of Control
T0828Loss of Productivity and Revenue
T0829Loss of View
T0831Manipulation of Control
T0832Manipulation of View
T0837Loss of Protection
T0879Damage to Property
T0880Loss of Safety
T0882Theft of Operational Information

Impair Process ControlTA0106 · 4

T0806Brute Force I/O
T0836Modify Parameter
T1692 · 2 subUnauthorized Message
001Command Message002Reporting Message
T1693 · 2 subModify Firmware
001System Firmware002Module Firmware

Inhibit Response FunctionTA0107 · 13

T0800Activate Firmware Update Mode
T0809Data Destruction
T0814Denial of Service
T0816Device Restart/Shutdown
T0835Manipulate I/O Image
T0838Modify Alarm Settings
T0851Rootkit
T0878Alarm Suppression
T0881Service Stop
T0892Change Credential
T1691 · 2 subBlock Operational Technology Message
001Command Message002Reporting Message
T1693 · 2 subModify Firmware
001System Firmware002Module Firmware
T1695 · 3 subBlock Communications
001Serial COM002Ethernet003Wi-Fi

Initial AccessTA0108 · 12

T0817Drive-by Compromise
T0819Exploit Public-Facing Application
T0822External Remote Services
T0847Replication Through Removable Media
T0848Rogue Master
T0860Wireless Compromise
T0862Supply Chain Compromise
T0864Transient Cyber Asset
T0865Spearphishing Attachment
T0866Exploitation of Remote Services
T0883Internet Accessible Device
T0886Remote Services

Lateral MovementTA0109 · 6

T0843 · 3 subProgram Download
001Download All002Online Edit003Program Append
T0859Valid Accounts
T0866Exploitation of Remote Services
T0867Lateral Tool Transfer
T0886Remote Services
T1694 · 2 subInsecure Credentials
001Default Credentials002Hardcoded Credentials

PersistenceTA0110 · 5

T0859Valid Accounts
T0873 · 1 subProject File Infection
001Siemens Project File Format
T0889Modify Program
T1693 · 2 subModify Firmware
001System Firmware002Module Firmware
T1694 · 2 subInsecure Credentials
001Default Credentials002Hardcoded Credentials

Privilege EscalationTA0111 · 2

T0874Hooking
T0890Exploitation for Privilege Escalation

Defense ImpairmentTA0112 · 18

T1112Modify Registry
T1207Rogue Domain Controller
T1222 · 2 subFile and Directory Permissions Modification
001Windows Permissions002Linux and Mac Permissions
T1484 · 2 subDomain or Tenant Policy Modification
001Group Policy Modification002Trust Modification
T1553 · 6 subSubvert Trust Controls
001Gatekeeper Bypass002Code Signing003SIP and Trust Provider Hijacking004Install Root Certificate005Mark-of-the-Web Bypass006Code Signing Policy Modification
T1556 · 9 subModify Authentication Process
001Domain Controller Authentication002Password Filter DLL003Pluggable Authentication Modules004Network Device Authentication005Reversible Encryption006Multi-Factor Authentication007Hybrid Identity008Network Provider DLL009Conditional Access Policies
T1578 · 5 subModify Cloud Compute Infrastructure
001Create Snapshot002Create Cloud Instance003Delete Cloud Instance004Revert Cloud Instance005Modify Cloud Compute Configurations
T1599 · 1 subNetwork Boundary Bridging
001Network Address Translation Traversal
T1600 · 2 subWeaken Encryption
001Reduce Key Space002Disable Crypto Hardware
T1601 · 2 subModify System Image
001Patch System Image002Downgrade System Image
T1647Plist File Modification
T1666Modify Cloud Resource Hierarchy
T1685 · 6 subDisable or Modify Tools
001Disable or Modify Windows Event Log002Disable or Modify Cloud Log003Modify or Spoof Tool UI004Disable or Modify Linux Audit System Log005Clear Windows Event Logs006Clear Linux or Mac System Logs
T1686 · 3 subDisable or Modify System Firewall
001Cloud Firewall002Network Device Firewall003Windows Host Firewall
T1687Exploitation for Defense Impairment
T1688Safe Mode Boot
T1689Downgrade Attack
T1690Prevent Command History Logging

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See Credits & Data Sources.