MITRE ATT&CK Techniques

497 tracked

Browse 100 MITRE ATT&CK techniques. Map threats to the ATT&CK framework.

Total Entities

497

Active This Week

103

New This Week

5

Avg Threat Score

62.6

Trending (7 Days)

T1566 - PhishingT1041 - Exfiltration Over C2 ChannelT1059 - Command and Scripting InterpreterT1071 - Application Layer ProtocolT1190 - Exploit Public-Facing Application

Threat Score Distribution

Critical (80+)

0

High (60-79)

80

Medium (40-59)

15

Low (<40)

5

Source Diversity

T1566 - Phishing

1314

T1041 - Exfiltration Over C2 Channel

769

T1566.002 - Spearphishing Link

540

T1567 - Exfiltration Over Web Service

473

T1078 - Valid Accounts

393

T1071 - Application Layer Protocol

389

T1059 - Command and Scripting Interpreter

387

T1486 - Data Encrypted for Impact

357

New vs Returning

New this week (5)

Returning active (98)

Quiet (394)

Sort:

T1566 - Phishing

First seen: 11/3/2025

Last seen: 11/3/2025

+148 articles this week

T1041 - Exfiltration Over C2 Channel

First seen: 11/3/2025

Last seen: 11/3/2025

+123 articles this week

T1059 - Command and Scripting Interpreter

First seen: 11/3/2025

Last seen: 11/3/2025

+88 articles this week

T1071 - Application Layer Protocol

First seen: 11/23/2025

Last seen: 11/23/2025

+74 articles this week

T1566.002 - Spearphishing Link

First seen: 11/3/2025

Last seen: 11/3/2025

+53 articles this week

T1068 - Exploitation for Privilege Escalation

First seen: 11/11/2025

Last seen: 11/11/2025

+61 articles this week

T1567 - Exfiltration Over Web Service

First seen: 2/4/2026

Last seen: 2/4/2026

+62 articles this week

T1190 - Exploit Public-Facing Application

First seen: 11/3/2025

Last seen: 11/3/2025

+70 articles this week

T1078 - Valid Accounts

First seen: 11/4/2025

Last seen: 11/4/2025

+67 articles this week

T1195 - Supply Chain Compromise

First seen: 11/11/2025

Last seen: 11/11/2025

+27 articles this week

T1003 - OS Credential Dumping

First seen: 2/4/2026

Last seen: 2/4/2026

+38 articles this week

T1021 - Remote Services

First seen: 11/4/2025

Last seen: 11/4/2025

+45 articles this week

T1059.001 - PowerShell

First seen: 11/3/2025

Last seen: 11/3/2025

+35 articles this week

T1486 - Data Encrypted for Impact

First seen: 11/11/2025

Last seen: 11/11/2025

+40 articles this week

T1566.001 - Spearphishing Attachment

First seen: 11/3/2025

Last seen: 11/3/2025

+39 articles this week

T1203 - Exploitation for Client Execution

First seen: 11/12/2025

Last seen: 11/12/2025

+15 articles this week

T1110 - Brute Force

First seen: 11/11/2025

Last seen: 11/11/2025

+45 articles this week

T1055 - Process Injection

First seen: 11/11/2025

Last seen: 11/11/2025

+25 articles this week

T1053 - Scheduled Task/Job

First seen: 11/23/2025

Last seen: 11/23/2025

+20 articles this week

T1574 - Hijack Execution Flow

First seen: 1/27/2026

Last seen: 1/27/2026

+21 articles this week

T1505.003 - Web Shell

First seen: 11/23/2025

Last seen: 11/23/2025

+17 articles this week

T1056 - Input Capture

First seen: 11/12/2025

Last seen: 11/12/2025

+21 articles this week

T1547 - Boot Or Logon Autostart Execution

First seen: 1/30/2026

Last seen: 1/30/2026

+13 articles this week

T1105 - Ingress Tool Transfer

First seen: 11/20/2025

Last seen: 11/20/2025

+8 articles this week

T1059.007 - JavaScript

First seen: 11/20/2025

Last seen: 11/20/2025

+13 articles this week

T1036 - Masquerading

First seen: 11/17/2025

Last seen: 11/17/2025

+9 articles this week

T1071.001 - Web Protocols

First seen: 11/23/2025

Last seen: 11/23/2025

+11 articles this week

T1027 - Obfuscated Files Or Information

First seen: 2/10/2026

Last seen: 2/10/2026

+6 articles this week

T1499 - Endpoint Denial of Service

First seen: 11/11/2025

Last seen: 11/11/2025

+16 articles this week

T1059.003 - Windows Command Shell

First seen: 11/3/2025

Last seen: 11/3/2025

+7 articles this week

T1543.003 - Windows Service

First seen: 2/5/2026

Last seen: 2/5/2026

+12 articles this week

T1567.002 - Exfiltration to Cloud Storage

First seen: 11/4/2025

Last seen: 11/4/2025

+4 articles this week

T1059.006 - Python

First seen: 12/10/2025

Last seen: 12/10/2025

+1 articles this week

T1059.004 - Unix Shell

First seen: 2/5/2026

Last seen: 2/5/2026

+8 articles this week

T1059.005 - Visual Basic

First seen: 11/12/2025

Last seen: 11/12/2025

+7 articles this week

T1047 - Windows Management Instrumentation

First seen: 11/16/2025

Last seen: 11/16/2025

+8 articles this week

T1562.001 - Disable Or Modify Tools

First seen: 2/4/2026

Last seen: 2/4/2026

+9 articles this week

T1113 - Screen Capture

First seen: 12/4/2025

Last seen: 12/4/2025

+20 articles this week

T1555.003 - Credentials From Web Browsers

First seen: 2/12/2026

Last seen: 2/12/2026

+6 articles this week

T1189 - Drive-by Compromise

First seen: 11/4/2025

Last seen: 11/4/2025

+2 articles this week

T1485 - Data Destruction

First seen: 2/11/2026

Last seen: 2/11/2026

+13 articles this week

T1547.001 - Registry Run Keys / Startup Folder

First seen: 2/5/2026

Last seen: 2/5/2026

+11 articles this week

T1136 - Create Account

First seen: 11/18/2025

Last seen: 11/18/2025

+2 articles this week

T1566.003 - Spearphishing Via Service

First seen: 2/9/2026

Last seen: 2/9/2026

+7 articles this week

T1046 - Network Service Discovery

First seen: 11/11/2025

Last seen: 11/11/2025

+5 articles this week

T1056.001 - Keylogging

First seen: 11/23/2025

Last seen: 11/23/2025

+3 articles this week

T1082 - System Information Discovery

First seen: 11/20/2025

Last seen: 11/20/2025

+6 articles this week

T1133 - External Remote Services

First seen: 11/3/2025

Last seen: 11/3/2025

+5 articles this week

T1021.001 - Remote Desktop Protocol

First seen: 11/3/2025

Last seen: 11/3/2025

+4 articles this week

T1552.001 - Credentials In Files

First seen: 2/6/2026

Last seen: 2/6/2026

+10 articles this week

T1090 - Proxy

First seen: 2/4/2026

Last seen: 2/4/2026

+1 articles this week

T1071.004 - DNS

First seen: 1/20/2026

Last seen: 1/20/2026

+1 articles this week

T1218.005 - Mshta

First seen: 12/1/2025

Last seen: 12/1/2025

+4 articles this week

T1112 - Modify Registry

First seen: 11/23/2025

Last seen: 11/23/2025

T1566 - Spearphishing Attachment

First seen: 11/3/2025

Last seen: 11/3/2025

T1070 - Indicator Removal

First seen: 2/9/2026

Last seen: 2/9/2026

+2 articles this week

T1557 - Adversary-in-the-Middle

First seen: 11/4/2025

Last seen: 11/4/2025

+3 articles this week

T1115 - Clipboard Data

First seen: 11/12/2025

Last seen: 11/12/2025

+1 articles this week

T1021.004 - SSH

First seen: 11/26/2025

Last seen: 11/26/2025

+2 articles this week

T1566 - Spearphishing

First seen: 11/3/2025

Last seen: 11/3/2025

T1574.001 - DLL

First seen: 2/4/2026

Last seen: 2/4/2026

+1 articles this week

T1057 - Process Discovery

First seen: 2/5/2026

Last seen: 2/5/2026

+7 articles this week

T1562 - Impair Defenses

First seen: 12/23/2025

Last seen: 12/23/2025

+2 articles this week

T1218.011 - Rundll32

First seen: 12/6/2025

Last seen: 12/6/2025

Go

First seen: 11/11/2025

Last seen: 11/11/2025

+1 articles this week

T1204.002 - Malicious File

First seen: 2/12/2026

Last seen: 2/12/2026

+2 articles this week

T1204 - User Execution

First seen: 11/11/2025

Last seen: 11/11/2025

+2 articles this week

T1497 - Virtualization/Sandbox Evasion

First seen: 2/10/2026

Last seen: 2/10/2026

T1055.012 - Process Hollowing

First seen: 11/11/2025

Last seen: 11/11/2025

T1490 - Inhibit System Recovery

First seen: 11/28/2025

Last seen: 11/28/2025

+4 articles this week

T1548.002 - Bypass User Account Control

First seen: 11/3/2025

Last seen: 11/3/2025

+1 articles this week

T1572 - Protocol Tunneling

First seen: 3/9/2026

Last seen: 3/9/2026

+2 articles this week

T1070.001 - Clear Windows Event Logs

First seen: 11/23/2025

Last seen: 11/23/2025

+4 articles this week

Cross-Site Scripting (xss)

First seen: 11/27/2025

Last seen: 11/27/2025

+4 articles this week

T1005 - Data From Local System

First seen: 3/19/2026

Last seen: 3/19/2026

+2 articles this week

T1014 - Rootkit

First seen: 12/30/2025

Last seen: 12/30/2025

+1 articles this week

T1033 - System Owner/User Discovery

First seen: 2/12/2026

Last seen: 2/12/2026

T1134 - Access Token Manipulation

First seen: 2/12/2026

Last seen: 2/12/2026

+6 articles this week

T1539 - Steal Web Session Cookie

First seen: 12/11/2025

Last seen: 12/11/2025

+2 articles this week

T1123 - Audio Capture

First seen: 2/12/2026

Last seen: 2/12/2026

+9 articles this week

Lateral Movement

First seen: 11/4/2025

Last seen: 11/4/2025

T1550.003 - Pass the Ticket

First seen: 11/5/2025

Last seen: 11/5/2025

+4 articles this week

T1091 - Replication Through Removable Media

First seen: 3/27/2026

Last seen: 3/27/2026

+4 articles this week

T1210 - Exploitation Of Remote Services

First seen: 2/22/2026

Last seen: 2/22/2026

+2 articles this week

T1496 - Resource Hijacking

First seen: 2/6/2026

Last seen: 2/6/2026

Steganography

First seen: 11/10/2025

Last seen: 11/10/2025

T1083 - File And Directory Discovery

First seen: 2/26/2026

Last seen: 2/26/2026

+1 articles this week

T1087 - Account Discovery

First seen: 4/21/2026

Last seen: 4/21/2026

T1125 - Video Capture

First seen: 2/12/2026

Last seen: 2/12/2026

Remote Desktop Protocol

First seen: 11/23/2025

Last seen: 11/23/2025

+1 articles this week

T1021.002 - SMB/Windows Admin Shares

First seen: 4/22/2026

Last seen: 4/22/2026

T1053.005 - Scheduled Task

First seen: 2/3/2026

Last seen: 2/3/2026

T1053 - Scheduled Task

First seen: 11/21/2025

Last seen: 11/21/2025

Web Shell

First seen: 11/3/2025

Last seen: 11/3/2025

T1098 - Account Manipulation

First seen: 2/12/2026

Last seen: 2/12/2026

+1 articles this week

T1543 - Create Or Modify System Process

First seen: 11/23/2025

Last seen: 11/23/2025

+1 articles this week

T1550.002 - Pass The Hash

First seen: 4/24/2026

Last seen: 4/24/2026

+2 articles this week

T1132 - Data Encoding

First seen: 11/3/2025

Last seen: 11/3/2025

T1136.001 - Local Account

First seen: 11/5/2025

Last seen: 11/5/2025

T1218 - System Binary Proxy Execution

First seen: 4/26/2026

Last seen: 4/26/2026