ATT&CK Matrix for Enterprise

ID: TA0040 Impact ID: TA0043 Reconnaissance

T1529 - System Shutdown/Reboot T1531 - Account Access Removal T1594 - Search Victim-Owned Websites T1595 - Active Scanning

T1489 - Service Stop T1485 - Data Destruction T1593 - Search Open Websites/Domains Scanning IP Blocks

T1496 - Resource Hijacking T1486 - Data Encrypted for Impact Social Media Vulnerability Scanning

T1498 - Network Denial of Service T1565 - Data Manipulation Search Engines Wordlist Scanning

Direct Network Flood Stored Data Manipulation Code Repositories T1592 - Gather Victim Host Information

Reflection Amplification Transmitted Data Manipulation T1596 - Search Open Technical Databases Hardware
13 Techniques
T1490 - Inhibit System Recovery Runtime Data Manipulation DNS/Passive DNS Software

T1495 - Firmware Corruption T1491 - Defacement WHOIS Firmware

The adversary is trying to manipulate,
interrupt, or destroy your systems and data. Internal Defacement Digital Certificates Client Configurations 10 Techniques

External Defacement CDNs T1589 - Gather Victim Identity Information

The adversary is trying to
T1561 - Disk Wipe Scan Databases Credentials
gather information they
Disk Content Wipe T1597 - Search Closed Sources Email Addresses
can use to plan future
Disk Structure Wipe Threat Intel Vendors Employee Names operations.
T1499 - Endpoint Denial of Service Purchase Technical Data T1590 - Gather Victim Network Information

OS Exhaustion Flood T1598 - Phishing for Information Domain Properties

Service Exhaustion Flood Spearphishing Service DNS

Application Exhaustion Flood Spearphishing Attachment Network Trust Dependencies

Application or System Exploitation Spearphishing Link Network Topology

IP Addresses
ID: TA0010 Exfiltration Network Security Appliances

T1537 - Transfer Data to Cloud Account T1020 - Automated Exfiltration T1591 - Gather Victim Org Information

T1029 - Scheduled Transfer Traffic Duplication Determine Physical Locations

9 Techniques T1567 - Exfiltration Over Web Service T1030 - Data Transfer Size Limits Business Relationships

Exfiltration to Code Repository T1048 - Exfiltration Over Alternative Protocol Identify Business Tempo
The adversary is trying to steal data. Identify Roles
Exfiltration to Cloud Storage Exfiltration Over Symmetric Encrypted Non-C2 Protocol

T1052 - Exfiltration Over Physical Medium Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Exfiltration over USB Exfiltration Over Unencrypted Non-C2 Protocol

ID: TA0042 Resource Development
T1041 - Exfiltration Over C2 Channel T1608 - Stage Capabilities T1583 - Acquire Infrastructure

T1011 - Exfiltration Over Other Network Medium Upload Malware Domains

Exfiltration Over Bluetooth Upload Tool DNS Server

Install Digital Certificate Virtual Private Server

ID: TA0011 Command and Control Drive-by Target Server

Dead Drop Resolver T1071 - Application Layer Protocol Link Target Botnet

Bidirectional Communication T1102 - Web Service Web Protocols SEO Poisoning Web Services

One-Way Communication File Transfer Protocols T1588 - Obtain Capabilities Serverless

T1205 - Traffic Signaling Mail Protocols Malware T1586 - Compromise Accounts

Port Knocking DNS Tool Social Media Accounts 7 Techniques

Socket Filters T1092 - Communication Through Removable Media Code Signing Certificates Email Accounts

T1219 - Remote Access Software Digital Certificates Cloud Accounts The adversary is trying to establish resources they can
T1132 - Data Encoding
use to support operations.
T1090 - Proxy Standard Encoding Exploits T1584 - Compromise Infrastructure
16 Techniques Internal Proxy Vulnerabilities Domains
Non-Standard Encoding
External Proxy T1001 - Data Obfuscation T1585 - Establish Accounts DNS Server
The adversary is trying to communicate with
compromised systems to control them. Multi-hop Proxy Junk Data Social Media Accounts Virtual Private Server

Domain Fronting Steganography Email Accounts Server

T1572 - Protocol Tunneling Protocol Impersonation Cloud Accounts Botnet

T1571 - Non-Standard Port T1568 - Dynamic Resolution Web Services

T1095 - Non-Application Layer Protocol Fast Flux DNS Serverless

T1104 - Multi-Stage Channels Domain Generation Algorithms T1587 - Develop Capabilities

DNS Calculation Malware

T1573 - Encrypted Channel Code Signing Certificates

Symmetric Cryptography Digital Certificates

Asymmetric Cryptography Exploits

T1008 - Fallback Channels

T1105 - Ingress Tool Transfer

ID: TA0001 Initial Access
T1078 - Valid Accounts T1189 - Drive-by Compromise
ID: TA0009 Collection Default Accounts T1190 - Exploit Public-Facing Application

T1125 - Video Capture T1557 - Adversary-in-the-Middle Domain Accounts T1133 - External Remote Services
9 Techniques
T1113 - Screen Capture LLMNR/NBT-NS Poisoning and SMB Relay Local Accounts T1200 - Hardware Additions

T1056 - Input Capture ARP Cache Poisoning Cloud Accounts T1566 - Phishing The adversary is trying to get into your network.
Keylogging DHCP Spoofing T1199 - Trusted Relationship Spearphishing Attachment

GUI Input Capture T1560 - Archive Collected Data T1195 - Supply Chain Compromise Spearphishing Link

Web Portal Capture Archive via Utility Compromise Software Dependencies and Development Tools Spearphishing via Service

Credential API Hooking Archive via Library Compromise Software Supply Chain
17 Techniques Compromise Hardware Supply Chain
T1114 - Email Collection Archive via Custom Method

Local Email Collection T1123 - Audio Capture T1091 - Replication Through Removable Media
The adversary is trying to gather data of interest to
their goal. Remote Email Collection T1119 - Automated Collection

Email Forwarding Rule T1185 - Browser Session Hijacking

ID: TA0002 Execution
T1074 - Data Staged T1115 - Clipboard Data T1047 - Windows Management Instrumentation T1059 - Command and Scripting Interpreter

Local Data Staging T1530 - Data from Cloud Storage T1204 - User Execution PowerShell

Remote Data Staging T1602 - Data from Configuration Repository Malicious Link AppleScript

T1025 - Data from Removable Media SNMP (MIB Dump) Malicious File Windows Command Shell

T1039 - Data from Network Shared Drive Network Device Configuration Dump Malicious Image Unix Shell

T1005 - Data from Local System T1213 - Data from Information Repositories T1569 - System Services Visual Basic

Confluence Launchctl Python

Sharepoint Service Execution JavaScript

Code Repositories T1072 - Software Deployment Tools Network Device CLI

13 Techniques
T1129 - Shared Modules T1609 - Container Administration Command
ID: TA0008 Lateral Movement T1648 - Serverless Execution T1610 - Deploy Container The adversary is trying to run malicious code.
T1550 - Use Alternate Authentication Material T1210 - Exploitation of Remote Services T1203 - Exploitation for Client Execution

Application Access Token T1534 - Internal Spearphishing T1559 - Inter-Process Communication

Pass the Hash T1570 - Lateral Tool Transfer Component Object Model

Pass the Ticket T1563 - Remote Service Session Hijacking Dynamic Data Exchange
9 Techniques
Web Session Cookie SSH Hijacking XPC Services

The adversary is trying to move through your T1080 - Taint Shared Content RDP Hijacking T1106 - Native API
environment.
T1072 - Software Deployment Tools T1021 - Remote Services T1053 - Scheduled Task/Job

T1091 - Replication Through Removable Media Remote Desktop Protocol At

SMB/Windows Admin Shares Cron

Distributed Component Object Model Scheduled Task

SSH Systemd Timers

VNC Container Orchestration Job

Windows Remote Management

ID: TA0003 Persistence
ID: TA0007 Discovery T1078 - Valid Accounts T1098 - Account Manipulation

T1497 - Virtualization/Sandbox Evasion T1087 - Account Discovery Default Accounts Additional Cloud Credentials

System Checks Local Account Domain Accounts Additional Email Delegate Permissions

User Activity Based Checks Domain Account Local Accounts Additional Cloud Roles

Time Based Evasion Email Account Cloud Accounts SSH Authorized Keys

T1124 - System Time Discovery Cloud Account T1205 - Traffic Signaling Device Registration

T1007 - System Service Discovery T1010 - Application Window Discovery Port Knocking T1197 - BITS Jobs

T1033 - System Owner/User Discovery T1217 - Browser Bookmark Discovery Socket Filters T1547 - Boot or Logon Autostart Execution

T1049 - System Network Connections Discovery T1580 - Cloud Infrastructure Discovery T1505 - Server Software Component Registry Run Keys / Startup Folder

T1016 - System Network Configuration Discovery T1538 - Cloud Service Dashboard SQL Stored Procedures Authentication Package
30 Techniques Transport Agent Time Providers
Internet Connection Discovery T1526 - Cloud Service Discovery

T1614 - System Location Discovery T1619 - Cloud Storage Object Discovery Web Shell Winlogon Helper DLL
The adversary is trying to figure out your
System Language Discovery T1613 - Container and Resource Discovery IIS Components Security Support Provider
environment.
T1082 - System Information Discovery T1622 - Debugger Evasion Terminal Services DLL Kernel Modules and Extensions

T1518 - Software Discovery T1482 - Domain Trust Discovery T1053 - Scheduled Task/Job Re-opened Applications

Security Software Discovery T1083 - File and Directory Discovery At LSASS Driver

T1018 - Remote System Discovery T1615 - Group Policy Discovery Cron Shortcut Modification

T1012 - Query Registry T1046 - Network Service Discovery Scheduled Task Port Monitors

T1057 - Process Discovery T1135 - Network Share Discovery Systemd Timers Print Processors

T1069 - Permission Groups Discovery T1040 - Network Sniffing Container Orchestration Job XDG Autostart Entries

Local Groups T1542 - Pre-OS Boot Active Setup

Domain Groups System Firmware Login Items

Cloud Groups Component Firmware T1037 - Boot or Logon Initialization Scripts

T1120 - Peripheral Device Discovery Bootkit Logon Script (Windows)

T1201 - Password Policy Discovery TFTP Boot Login Hook

ROMMONkit Network Logon Script 19 Techniques

ID: TA0004 Privilege Escalation T1137 - Office Application Startup RC Scripts

Office Template Macros Startup Items The adversary is trying to maintain

T1078 - Valid Accounts T1548 - Abuse Elevation Control Mechanism
their foothold.
Office Test T1176 - Browser Extensions
Default Accounts Setuid and Setgid
Outlook Forms T1554 - Compromise Client Software Binary
Domain Accounts Bypass User Account Control
Outlook Home Page T1136 - Create Account
Local Accounts Sudo and Sudo Caching
Outlook Rules Local Account
Cloud Accounts Elevated Execution with Prompt
Add-ins Domain Account
T1053 - Scheduled Task/Job T1134 - Access Token Manipulation
T1556 - Modify Authentication Process Cloud Account
At Token Impersonation/Theft
Domain Controller Authentication T1543 - Create or Modify System Process
Cron Create Process with Token
Password Filter DLL Launch Agent
Scheduled Task Make and Impersonate Token
Pluggable Authentication Modules Systemd Service
Systemd Timers Parent PID Spoofing
Network Device Authentication Windows Service
Container Orchestration Job SID-History Injection
Reversible Encryption Launch Daemon
T1055 - Process Injection T1547 - Boot or Logon Autostart Execution
Multi-Factor Authentication T1546 - Event Triggered Execution
Dynamic-link Library Injection Registry Run Keys / Startup Folder
Hybrid Identity Change Default File Association
Portable Executable Injection Authentication Package
T1525 - Implant Internal Image Screensaver
Thread Execution Hijacking Time Providers
T1574 - Hijack Execution Flow Windows Management Instrumentation Event Subscription
Asynchronous Procedure Call Winlogon Helper DLL
DLL Search Order Hijacking Unix Shell Configuration Modification
Thread Local Storage Security Support Provider
DLL Side-Loading Trap
Ptrace System Calls Kernel Modules and Extensions
Dylib Hijacking LC_LOAD_DYLIB Addition
Proc Memory Re-opened Applications
Executable Installer File Permissions Weakness Netsh Helper DLL
Extra Window Memory Injection LSASS Driver
Dynamic Linker Hijacking Accessibility Features
Process Doppelgänging Shortcut Modification
Path Interception by PATH Environment Variable AppCert DLLs
VDSO Hijacking Port Monitors
Path Interception by Search Order Hijacking AppInit DLLs
ListPlanting Print Processors
Path Interception by Unquoted Path Application Shimming
T1574 - Hijack Execution Flow XDG Autostart Entries
Services File Permissions Weakness Image File Execution Options Injection
13 Techniques DLL Search Order Hijacking Active Setup
Services Registry Permissions Weakness PowerShell Profile
DLL Side-Loading Login Items
The adversary is trying to gain higher-level permissions. COR_PROFILER Emond
Dylib Hijacking T1037 - Boot or Logon Initialization Scripts
KernelCallbackTable Component Object Model Hijacking
Executable Installer File Permissions Weakness Logon Script (Windows)
Installer Packages
Hijacking Login Hook
T1133 - External Remote Services
Path Interception by PATH Environment Variable Network Logon Script

Path Interception by Search Order Hijacking RC Scripts

ID: TA0005 Defense Evasion
Path Interception by Unquoted Path Startup Items

Services File Permissions Weakness T1543 - Create or Modify System Process T1220 - XSL Script Processing T1548 - Abuse Elevation Control Mechanism

Services Registry Permissions Weakness Launch Agent T1600 - Weaken Encryption Setuid and Setgid

COR_PROFILER Systemd Service Reduce Key Space Bypass User Account Control

KernelCallbackTable Windows Service Disable Crypto Hardware Sudo and Sudo Caching

T1068 - Exploitation for Privilege Escalation Launch Daemon T1497 - Virtualization/Sandbox Evasion Elevated Execution with Prompt

T1546 - Event Triggered Execution T1484 - Domain Policy Modification System Checks T1202 - Indirect Command Execution

Change Default File Association Group Policy Modification User Activity Based Checks T1564 - Hide Artifacts

Screensaver Domain Trust Modification Time Based Evasion Hidden Files and Directories

Windows Management Instrumentation Event Subscription T1611 - Escape to Host T1078 - Valid Accounts Hidden Users

Unix Shell Configuration Modification Default Accounts Hidden Window

Trap Domain Accounts NTFS File Attributes

LC_LOAD_DYLIB Addition Local Accounts Hidden File System

Netsh Helper DLL Cloud Accounts Run Virtual Instance

Accessibility Features T1550 - Use Alternate Authentication Material VBA Stomping

AppCert DLLs Application Access Token Email Hiding Rules

AppInit DLLs Pass the Hash Resource Forking

Application Shimming Pass the Ticket Process Argument Spoofing

Image File Execution Options Injection Web Session Cookie T1134 - Access Token Manipulation

PowerShell Profile T1535 - Unused/Unsupported Cloud Regions Token Impersonation/Theft

Emond T1127 - Trusted Developer Utilities Proxy Execution Create Process with Token

Component Object Model Hijacking MSBuild Make and Impersonate Token

Installer Packages T1205 - Traffic Signaling Parent PID Spoofing

Port Knocking SID-History Injection

Socket Filters T1036 - Masquerading

@hackinarticles
T1221 - Template Injection Invalid Code Signature

T1216 - System Script Proxy Execution Right-to-Left Override

https://github.com/Ignitetechnologies
PubPrn Rename System Utilities

T1218 - System Binary Proxy Execution Masquerade Task or Service

https://in.linkedin.com/company/hackingarticles
Compiled HTML File Match Legitimate Name or Location

Control Panel Space after Filename

CMSTP Double File Extension

InstallUtil T1197 - BITS Jobs

Mshta T1612 - Build Image on Host

Msiexec T1622 - Debugger Evasion

Odbcconf T1140 - Deobfuscate/Decode Files or Information

Regsvcs/Regasm T1610 - Deploy Container

Regsvr32 T1006 - Direct Volume Access

Rundll32 T1484 - Domain Policy Modification

Verclsid Group Policy Modification

Mavinject Domain Trust Modification

MMC T1480 - Execution Guardrails

T1553 - Subvert Trust Controls Environmental Keying

Gatekeeper Bypass T1211 - Exploitation for Defense Evasion

Code Signing T1222 - File and Directory Permissions Modification

42 Techniques
SIP and Trust Provider Hijacking Windows File and Directory Permissions Modification

Install Root Certificate Linux and Mac File and Directory Permissions Modification The adversary is trying to avoid being detected.
Mark-of-the-Web Bypass T1574 - Hijack Execution Flow

Code Signing Policy Modification DLL Search Order Hijacking

T1014 - Rootkit DLL Side-Loading

T1207 - Rogue Domain Controller Dylib Hijacking

T1620 - Reflective Code Loading Executable Installer File Permissions Weakness

T1055 - Process Injection Dynamic Linker Hijacking

Dynamic-link Library Injection Path Interception by PATH Environment Variable

Portable Executable Injection Path Interception by Search Order Hijacking

Thread Execution Hijacking Path Interception by Unquoted Path

Asynchronous Procedure Call Services File Permissions Weakness

Thread Local Storage Services Registry Permissions Weakness

Ptrace System Calls COR_PROFILER

Proc Memory KernelCallbackTable

Extra Window Memory Injection T1562 - Impair Defenses

Process Hollowing Disable or Modify Tools

Process Doppelgänging Disable Windows Event Logging

VDSO Hijacking Impair Command History Logging

ListPlanting Disable or Modify System Firewall

T1542 - Pre-OS Boot Indicator Blocking

System Firmware Disable or Modify Cloud Firewall

Component Firmware Disable Cloud Logs

Bootkit Safe Mode Boot

ROMMONkit Downgrade Attack

TFTP Boot T1070 - Indicator Removal

T1647 - Plist File Modification Clear Windows Event Logs

T1027 - Obfuscated Files or Information Clear Linux or Mac System Logs

Binary Padding Clear Command History

Software Packing File Deletion

Steganography Network Share Connection Removal

Compile After Delivery Timestomp

Indicator Removal from Tools Clear Network Connection History and Configurations

HTML Smuggling Clear Mailbox Data

Dynamic API Resolution Clear Persistence

Stripped Payloads T1556 - Modify Authentication Process

Embedded Payloads Domain Controller Authentication

T1599 - Network Boundary Bridging Password Filter DLL

Network Address Translation Traversal Pluggable Authentication Modules

T1601 - Modify System Image Network Device Authentication

Patch System Image Reversible Encryption

Downgrade System Image Multi-Factor Authentication

Hybrid Identity

T1578 - Modify Cloud Compute Infrastructure

Create Snapshot

Create Cloud Instance

Delete Cloud Instance

Revert Cloud Instance

T1112 - Modify Registry

ID: TA0006 Credential Access

Credentials In Files T1557 - Adversary-in-the-Middle
Credentials in Registry LLMNR/NBT-NS Poisoning and SMB Relay
Bash History ARP Cache Poisoning
Private Keys T1552 - Unsecured Credentials
DHCP Spoofing
Cloud Instance Metadata API
T1110 - Brute Force
Group Policy Preferences
Password Guessing
Container API
Password Cracking
T1539 - Steal Web Session Cookie
Password Spraying
T1558 - Steal or Forge Kerberos Tickets
Credential Stuffing
Golden Ticket
T1555 - Credentials from Password Stores
Silver Ticket
Keychain
Kerberoasting
Securityd Memory
AS-REP Roasting
Credentials from Web Browsers
T1649 - Steal or Forge Authentication Certificates
Windows Credential Manager
T1528 - Steal Application Access Token 17 Techniques
Password Managers
T1003 - OS Credential Dumping
T1212 - Exploitation for Credential Access
LSASS Memory The adversary is trying to steal account names and
T1187 - Forced Authentication passwords.
Security Account Manager
T1606 - Forge Web Credentials
NTDS
Web Cookies
LSA Secrets
SAML Tokens
Cached Domain Credentials
T1056 - Input Capture
DCSync
Keylogging
Proc Filesystem
GUI Input Capture
/etc/passwd and /etc/shadow
Web Portal Capture
T1040 - Network Sniffing
Credential API Hooking
T1621 - Multi-Factor Authentication Request Generation
T1556 - Modify Authentication Process

Domain Controller Authentication

Password Filter DLL

Pluggable Authentication Modules

Network Device Authentication

Reversible Encryption

Multi-Factor Authentication

Hybrid Identity

T1111 - Multi-Factor Authentication Interception