d4 · tools · attack

The ATT&CK matrix.

MITRE ATT&CK catalogues the tactics and techniques adversaries actually use, drawn from real intrusions. This is the Enterprise matrix: 15 tactics in kill-chain order, each listing the techniques used to achieve it. Open a CVE from the tracker to see a vulnerability's techniques highlighted here.

Reconnaissance12

T1595 · 3 subActive Scanning T1592 · 4 subGather Victim Host Information T1589 · 3 subGather Victim Identity Information T1590 · 6 subGather Victim Network Information T1591 · 4 subGather Victim Org Information T1598 · 4 subPhishing for Information T1682Query Public AI Services T1597 · 2 subSearch Closed Sources T1596 · 5 subSearch Open Technical Databases T1593 · 3 subSearch Open Websites/Domains T1681Search Threat Vendor Data T1594Search Victim-Owned Websites

Resource Development9

T1650Acquire Access T1583 · 8 subAcquire Infrastructure T1586 · 3 subCompromise Accounts T1584 · 8 subCompromise Infrastructure T1587 · 4 subDevelop Capabilities T1585 · 3 subEstablish Accounts T1683 · 2 subGenerate Content T1588 · 7 subObtain Capabilities T1608 · 6 subStage Capabilities

Initial Access11

T1659Content Injection T1189Drive-by Compromise T1190Exploit Public-Facing Application T1133External Remote Services T1200Hardware Additions T1566 · 4 subPhishing T1091Replication Through Removable Media T1195 · 3 subSupply Chain Compromise T1199Trusted Relationship T1078 · 4 subValid Accounts T1669Wi-Fi Networks

Execution20

Persistence22

Privilege Escalation13

T1548 · 6 subAbuse Elevation Control Mechanism T1134 · 5 subAccess Token Manipulation T1098 · 7 subAccount Manipulation T1547 · 14 subBoot or Logon Autostart Execution T1037 · 5 subBoot or Logon Initialization Scripts T1543 · 5 subCreate or Modify System Process T1484 · 2 subDomain or Tenant Policy Modification T1611Escape to Host T1546 · 18 subEvent Triggered Execution T1068Exploitation for Privilege Escalation T1055 · 12 subProcess Injection T1053 · 5 subScheduled Task/Job T1078 · 4 subValid Accounts

Stealth30

T1134 · 5 subAccess Token Manipulation T1197BITS Jobs T1612Build Image on Host T1622Debugger Evasion T1678Delay Execution T1140Deobfuscate/Decode Files or Information T1006Direct Volume Access T1480 · 2 subExecution Guardrails T1211Exploitation for Stealth T1564 · 14 subHide Artifacts T1574 · 12 subHijack Execution Flow T1070 · 8 subIndicator Removal T1202Indirect Command Execution T1036 · 12 subMasquerading T1027 · 18 subObfuscated Files or Information T1542 · 5 subPre-OS Boot T1055 · 12 subProcess Injection T1620Reflective Code Loading T1014Rootkit T1679Selective Exclusion T1684 · 2 subSocial Engineering T1218 · 14 subSystem Binary Proxy Execution T1216 · 2 subSystem Script Proxy Execution T1221Template Injection T1205 · 2 subTraffic Signaling T1127 · 3 subTrusted Developer Utilities Proxy Execution T1535Unused/Unsupported Cloud Regions T1078 · 4 subValid Accounts T1497 · 3 subVirtualization/Sandbox Evasion T1220XSL Script Processing

Defense Impairment18

T1686 · 3 subDisable or Modify System Firewall T1685 · 6 subDisable or Modify Tools T1484 · 2 subDomain or Tenant Policy Modification T1689Downgrade Attack T1687Exploitation for Defense Impairment T1222 · 2 subFile and Directory Permissions Modification T1556 · 9 subModify Authentication Process T1578 · 5 subModify Cloud Compute Infrastructure T1666Modify Cloud Resource Hierarchy T1112Modify Registry T1601 · 2 subModify System Image T1599 · 1 subNetwork Boundary Bridging T1647Plist File Modification T1690Prevent Command History Logging T1207Rogue Domain Controller T1688Safe Mode Boot T1553 · 6 subSubvert Trust Controls T1600 · 2 subWeaken Encryption

Credential Access17

T1557 · 4 subAdversary-in-the-Middle T1110 · 4 subBrute Force T1555 · 6 subCredentials from Password Stores T1212Exploitation for Credential Access T1187Forced Authentication T1606 · 2 subForge Web Credentials T1056 · 4 subInput Capture T1556 · 9 subModify Authentication Process T1111Multi-Factor Authentication Interception T1621Multi-Factor Authentication Request Generation T1040Network Sniffing T1003 · 8 subOS Credential Dumping T1528Steal Application Access Token T1649Steal or Forge Authentication Certificates T1558 · 5 subSteal or Forge Kerberos Tickets T1539Steal Web Session Cookie T1552 · 8 subUnsecured Credentials

Discovery34

T1087 · 4 subAccount Discovery T1010Application Window Discovery T1217Browser Information Discovery T1580Cloud Infrastructure Discovery T1538Cloud Service Dashboard T1526Cloud Service Discovery T1619Cloud Storage Object Discovery T1613Container and Resource Discovery T1622Debugger Evasion T1652Device Driver Discovery T1482Domain Trust Discovery T1083File and Directory Discovery T1615Group Policy Discovery T1680Local Storage Discovery T1654Log Enumeration T1046Network Service Discovery T1135Network Share Discovery T1040Network Sniffing T1201Password Policy Discovery T1120Peripheral Device Discovery T1069 · 3 subPermission Groups Discovery T1057Process Discovery T1012Query Registry T1018Remote System Discovery T1518 · 2 subSoftware Discovery T1082System Information Discovery T1614 · 1 subSystem Location Discovery T1016 · 2 subSystem Network Configuration Discovery T1049System Network Connections Discovery T1033System Owner/User Discovery T1007System Service Discovery T1124System Time Discovery T1673Virtual Machine Discovery T1497 · 3 subVirtualization/Sandbox Evasion

Lateral Movement9

T1210Exploitation of Remote Services T1534Internal Spearphishing T1570Lateral Tool Transfer T1563 · 2 subRemote Service Session Hijacking T1021 · 8 subRemote Services T1091Replication Through Removable Media T1072Software Deployment Tools T1080Taint Shared Content T1550 · 4 subUse Alternate Authentication Material

Collection17

T1557 · 4 subAdversary-in-the-Middle T1560 · 3 subArchive Collected Data T1123Audio Capture T1119Automated Collection T1185Browser Session Hijacking T1115Clipboard Data T1530Data from Cloud Storage T1602 · 2 subData from Configuration Repository T1213 · 6 subData from Information Repositories T1005Data from Local System T1039Data from Network Shared Drive T1025Data from Removable Media T1074 · 2 subData Staged T1114 · 3 subEmail Collection T1056 · 4 subInput Capture T1113Screen Capture T1125Video Capture

Command and Control18

T1071 · 5 subApplication Layer Protocol T1092Communication Through Removable Media T1659Content Injection T1132 · 2 subData Encoding T1001 · 3 subData Obfuscation T1568 · 3 subDynamic Resolution T1573 · 2 subEncrypted Channel T1008Fallback Channels T1665Hide Infrastructure T1105Ingress Tool Transfer T1104Multi-Stage Channels T1095Non-Application Layer Protocol T1571Non-Standard Port T1572Protocol Tunneling T1090 · 4 subProxy T1219 · 3 subRemote Access Tools T1205 · 2 subTraffic Signaling T1102 · 3 subWeb Service

Exfiltration9

T1020 · 1 subAutomated Exfiltration T1030Data Transfer Size Limits T1048 · 3 subExfiltration Over Alternative Protocol T1041Exfiltration Over C2 Channel T1011 · 1 subExfiltration Over Other Network Medium T1052 · 1 subExfiltration Over Physical Medium T1567 · 4 subExfiltration Over Web Service T1029Scheduled Transfer T1537Transfer Data to Cloud Account

Impact15

T1531Account Access Removal T1485 · 1 subData Destruction T1486Data Encrypted for Impact T1565 · 3 subData Manipulation T1491 · 2 subDefacement T1561 · 2 subDisk Wipe T1667Email Bombing T1499 · 4 subEndpoint Denial of Service T1657Financial Theft T1495Firmware Corruption T1490Inhibit System Recovery T1498 · 2 subNetwork Denial of Service T1496 · 4 subResource Hijacking T1489Service Stop T1529System Shutdown/Reboot

Each cell links to the full technique page on attack.mitre.org; the count next to a technique id is its number of sub-techniques. Tactics answer "why" (what the adversary is after); techniques answer "how". Data: ATT&CK Enterprise v19.1, loaded from a seed generated 2026-07-15; CVE mappings from the CTID KEV mappings project (07/28/2025). ATT&CK is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. CVE-to-technique mappings © the Center for Threat-Informed Defense, Apache 2.0.