MITRE ATT&CK Threat Matrix & Technique Directory

This directory indexes 251 MITRE ATT&CK techniques observed across our catalog of 2,966 malware families. Each technique hub provides in-depth technical analysis, offensive execution patterns, telemetry-driven detection signatures, containment guidance, and an interactive roster of all associated malware families.

Threat Matrix Ingestion: Export all 251 MITRE techniques for SIEM correlation or threat modeling.

Initial Access(13 Techniques)

Techniques used by adversaries to gain their initial foothold within an enterprise network, spanning spearphishing, drive-by downloads, exploit kits, and compromised edge perimeter appliances.

Execution(21 Techniques)

Techniques that result in adversary-controlled code running on a local or remote target system, including command-line interpreters, PowerShell payloads, and native binary proxy execution.

Persistence(22 Techniques)

Mechanisms that adversaries use to maintain access across reboots, credential changes, and system maintenance, including Registry Run keys, scheduled tasks, and autostart services.

Privilege Escalation(8 Techniques)

Techniques used to obtain higher-level permissions on systems, elevating standard user context to SYSTEM, root, or domain administrator through kernel exploits and token manipulation.

Defense Evasion(54 Techniques)

Tradecraft designed to avoid detection, analysis, and eradication throughout their operational lifecycle, including process injection, file obfuscation, and disabling defensive telemetry.

Credential Access(24 Techniques)

Techniques for stealing credentials such as plaintext passwords, password hashes, and Kerberos tickets using memory dumping (LSASS) and browser credential store decryption.

Discovery(15 Techniques)

Techniques adversaries employ to observe and orient themselves within an enterprise environment, profiling network shares, Active Directory domains, and local system configurations.

Lateral Movement(12 Techniques)

Methods used to extend access to additional remote systems and compute nodes within an enterprise network via SMB/RPC, Windows Remote Management, and RDP sessions.

Collection(19 Techniques)

Adversary tradecraft focused on gathering sensitive files, keystrokes, screen captures, audio, and database records prior to exfiltration.

Command and Control(27 Techniques)

Communication channels and covert protocols utilized to maintain interactive control of compromised implants through legitimate web protocols, encrypted proxies, and DNS tunneling.

Exfiltration(5 Techniques)

Techniques used to stealthily transfer proprietary data, intellectual property, and credentials out of the enterprise perimeter to adversary-operated infrastructure.

Impact(22 Techniques)

Techniques adversaries use to disrupt business operations, destroy system integrity, or manipulate critical availability, including high-speed ransomware encryption and disk wiping.

Reconnaissance(3 Techniques)

Resource Development(4 Techniques)