MITRE ATT&CK

Complete MITRE ATT&CK reference - 14 tactics, key techniques per tactic, APT group mapping, detection engineering, attack chains, and interactive coverage tools.

#Tactics

#The 14 ATT&CK Enterprise Tactics

ID Name Description
TA0043 Reconnaissance Gather information about the target before compromise (OSINT, active scanning, social engineering)
TA0042 Resource Development Acquire or create resources (infrastructure, accounts, tooling) to support operations
TA0001 Initial Access Gain a first foothold into the target network
TA0002 Execution Run malicious code on a local or remote system
TA0003 Persistence Maintain access across reboots, credential changes, or interruptions
TA0004 Privilege Escalation Obtain higher-level permissions (SYSTEM, root, Domain Admin)
TA0005 Defense Evasion Avoid detection by security mechanisms (AV, EDR, SIEM)
TA0006 Credential Access Steal credentials (passwords, tokens, hashes, Kerberos tickets)
TA0007 Discovery Enumerate the environment: systems, networks, users, configurations
TA0008 Lateral Movement Move to other systems within the internal network
TA0009 Collection Gather data of interest before exfiltration
TA0011 Command and Control Establish and maintain communications with compromised systems
TA0010 Exfiltration Transfer collected data out of the target network
TA0040 Impact Manipulate, disrupt, or destroy systems and data

#Key Techniques

#About this section

Curated selection of the most commonly observed techniques in real-world incidents and red team operations (10-14 per tactic). ATT&CK Enterprise documents 200+ techniques and 400+ sub-techniques. For the complete matrix, see MITRE ATT&CK Enterprise Techniques. For an interactive view, see the Coverage Matrix widget below.

#Reconnaissance (TA0043)

ID Technique Notes
T1595.001 Active Scanning: IP Blocks nmap, masscan, zmap of target ranges
T1595.002 Active Scanning: Vulnerability Scanning Nessus, Nuclei, OpenVAS against exposed services
T1592.001 Gather Victim Host Info: Hardware Identify target hardware via job postings, docs
T1592.004 Gather Victim Host Info: Client Configs Browser/OS fingerprinting via watering hole
T1589.001 Gather Victim Identity Info: Credentials Credential stuffing lists, breach databases
T1589.002 Gather Victim Identity Info: Email Addresses theHarvester, Hunter.io, LinkedIn scraping
T1598.003 Phishing for Information: Spearphishing Link Fake login page to harvest creds pre-compromise
T1593.001 Search Open Websites: Social Media LinkedIn, Twitter recon for org chart and tech stack
T1596.005 Search Open Technical Databases: Scan DBs Shodan, Censys, FOFA for exposed services
T1597.001 Search Closed Sources: Threat Intel Vendors Purchase target intel from underground forums

#Resource Development (TA0042)

ID Technique Notes
T1583.001 Acquire Infrastructure: Domains Typosquat and lookalike domains for phishing
T1583.003 Acquire Infrastructure: VPS Bulletproof hosting, cloud VPS for C2
T1583.006 Acquire Infrastructure: Web Services GitHub, Azure, AWS for payload staging
T1584.001 Compromise Infrastructure: Domains Hijack expired or vulnerable domains
T1584.004 Compromise Infrastructure: Server Compromised web servers as C2 redirectors
T1587.001 Develop Capabilities: Malware Custom implants, RATs, loaders
T1587.003 Develop Capabilities: Digital Certificates Self-signed or stolen certs for code signing
T1585.001 Establish Accounts: Social Media Fake personas for social engineering
T1585.002 Establish Accounts: Email Accounts Disposable email for phishing infrastructure
T1588.002 Obtain Capabilities: Tool Cobalt Strike, Brute Ratel, Sliver licenses or cracks
T1588.005 Obtain Capabilities: Exploits Purchase 0-day or n-day exploit code
T1608.001 Stage Capabilities: Upload Malware Host payloads on compromised or rented infra

#Initial Access (TA0001)

ID Technique Notes
T1566.001 Spearphishing Attachment Office macros, ISO, LNK, OneNote, HTA
T1566.002 Spearphishing Link Drive-by downloads, fake login pages
T1566.003 Spearphishing via Service Messages via LinkedIn, Slack, Teams
T1190 Exploit Public-Facing Application CVEs on VPN, Exchange, web apps, firewalls
T1133 External Remote Services VPN/RDP with valid or sprayed credentials
T1078 Valid Accounts Compromised creds from OSINT/breach databases
T1078.004 Valid Accounts: Cloud Accounts Stolen OAuth tokens, compromised Azure/AWS creds
T1195.002 Supply Chain Compromise: Software Trojanized updates (SolarWinds, 3CX, Kaseya)
T1199 Trusted Relationship Compromise MSP or vendor with target access
T1091 Replication Through Removable Media USB drop attacks, BadUSB
T1189 Drive-by Compromise Browser exploit via watering hole site

#Execution (TA0002)

ID Technique Notes
T1059.001 PowerShell AMSI bypass + encoded commands, Invoke-Expression
T1059.003 Windows Command Shell cmd.exe, wscript, mshta, forfiles
T1059.005 Visual Basic VBScript via wscript, Office VBA macros
T1059.006 Python Python-based implants, pyinstaller payloads
T1059.007 JavaScript JScript via wscript/cscript, Node.js
T1106 Native API Direct WinAPI calls (CreateProcess, NtAllocateVirtualMemory)
T1204.001 User Execution: Malicious Link User clicks phishing link
T1204.002 User Execution: Malicious File User double-clicks executable, opens macro doc
T1047 Windows Management Instrumentation wmic process call create, WMI event subscriptions
T1569.002 System Services: Service Execution PsExec, sc start, services as execution vector
T1053.005 Scheduled Task/Job schtasks /create for deferred execution

#Persistence (TA0003)

ID Technique Notes
T1547.001 Registry Run Keys / Startup Folder HKCU\Software\Microsoft\Windows\CurrentVersion\Run
T1053.005 Scheduled Task schtasks /create with SYSTEM privileges
T1543.003 Windows Service sc create / New-Service for persistent backdoor
T1574.002 DLL Side-Loading Malicious DLL in legitimate application directory
T1136.001 Create Account: Local net user /add, hidden admin accounts
T1136.002 Create Account: Domain AD account creation for persistent access
T1546.003 WMI Event Subscription Fileless persistence via WMI consumers
T1546.015 COM Hijacking Replace COM object references in registry
T1505.003 Web Shell ASPX, PHP, JSP shells on web servers
T1098 Account Manipulation Add creds to service principal, modify ACLs
T1556.001 Modify Authentication Process: Domain Controller Skeleton Key, SSP injection on DC
T1197 BITS Jobs Background Intelligent Transfer for persistent downloads

#Privilege Escalation (TA0004)

ID Technique Notes
T1548.002 Bypass UAC fodhelper, eventvwr, CMSTPLUA COM object
T1068 Exploitation for Privilege Escalation Kernel/driver CVEs (PrintNightmare, EternalBlue)
T1134.001 Token Impersonation/Theft SeImpersonatePrivilege, Potato family attacks
T1134.002 Create Process with Token CreateProcessWithToken, RunAs
T1611 Escape to Host Container escape to underlying host
T1055 Process Injection Inject shellcode into privileged process
T1078.002 Valid Accounts: Domain Escalate via stolen Domain Admin creds
T1547.012 Print Processors Register malicious print processor DLL
T1574.001 DLL Search Order Hijacking Place DLL in search path before legitimate
T1484.001 Group Policy Modification Modify GPO for domain-wide escalation

#Defense Evasion (TA0005)

ID Technique Notes
T1562.001 Disable or Modify Tools Kill AV/EDR, disable Defender real-time protection
T1562.004 Disable or Modify Firewall netsh advfirewall set allprofiles state off
T1027.002 Obfuscated Files: Software Packing UPX, custom packers, crypters
T1027.010 Command Obfuscation Base64, XOR, string concatenation, Invoke-Obfuscation
T1055.012 Process Hollowing Spawn legitimate process, hollow and inject
T1055.001 DLL Injection LoadLibrary injection into remote process
T1070.001 Clear Windows Event Logs wevtutil cl Security/System/Application
T1070.004 File Deletion Remove dropped tools and artifacts
T1218.011 Rundll32 LOLBin execution via signed binary
T1218.005 Mshta Execute HTA payloads via mshta.exe
T1036.005 Masquerading: Match Legitimate Name svchost.exe, csrss.exe lookalikes
T1112 Modify Registry Disable security features via registry edits
T1140 Deobfuscate/Decode Files Decode payload at runtime to evade static analysis
T1620 Reflective Code Loading In-memory .NET assembly loading, BOFs

#Credential Access (TA0006)

ID Technique Notes
T1003.001 OS Credential Dumping: LSASS Memory Mimikatz sekurlsa::logonpasswords, nanodump
T1003.003 OS Credential Dumping: NTDS ntdsutil, secretsdump.py against AD database
T1003.006 OS Credential Dumping: DCSync Mimikatz lsadump::dcsync, impacket secretsdump
T1558.003 Kerberoasting Crack service ticket hash offline (hashcat -m 13100)
T1558.004 AS-REP Roasting GetNPUsers.py, accounts without preauth
T1110.003 Password Spraying One password across many accounts
T1110.001 Password Guessing Brute force against single account
T1555.003 Credentials from Web Browsers Chrome/Firefox saved passwords, cookies
T1555.005 Password Managers KeePass, LastPass vault extraction
T1552.001 Unsecured Credentials: Files Config files, scripts with hardcoded passwords
T1552.006 Unsecured Credentials: Cloud Instance Metadata IMDS 169.254.169.254 token theft
T1056.001 Input Capture: Keylogging Keylogger deployment for credential harvest

#Discovery (TA0007)

ID Technique Notes
T1087.002 Domain Account Discovery net user /domain, Get-ADUser
T1087.001 Local Account Discovery net user, whoami /all
T1069.002 Domain Groups Get-ADGroupMember "Domain Admins"
T1018 Remote System Discovery arp -a, nmap, nbtscan, net view
T1082 System Information Discovery systeminfo, uname -a, hostname
T1046 Network Service Discovery nmap -sV, port scanning internal ranges
T1016 System Network Configuration ipconfig, route print, netstat
T1049 System Network Connections netstat -an, ss -tlnp
T1083 File and Directory Discovery dir, find, locate sensitive files
T1482 Domain Trust Discovery nltest /domain_trusts, Get-ADTrust
T1615 Group Policy Discovery gpresult /r, Get-GPO
T1033 System Owner/User Discovery whoami, quser, w

#Lateral Movement (TA0008)

ID Technique Notes
T1021.001 Remote Desktop Protocol Pivot via RDP with stolen creds
T1021.002 SMB/Windows Admin Shares PsExec, smbexec via ADMIN$, C$ shares
T1021.003 DCOM Remote execution via DCOM objects
T1021.006 Windows Remote Management WinRM, Enter-PSSession, evil-winrm
T1550.002 Pass the Hash PtH with NTLM hash (impacket, CrackMapExec)
T1550.003 Pass the Ticket PtT with TGT/ST Kerberos tickets
T1550.001 Application Access Token Reuse OAuth/JWT tokens across services
T1021.004 SSH Lateral movement via SSH with stolen keys
T1080 Taint Shared Content Place payloads in network shares
T1570 Lateral Tool Transfer Move tools between compromised hosts
T1563.002 RDP Hijacking tscon session hijack without password

#Collection (TA0009)

ID Technique Notes
T1560.001 Archive via Utility 7z, rar, zip for staging collected data
T1560.003 Archive via Custom Method Custom encryption/compression before exfil
T1119 Automated Collection Scripts to sweep file shares for sensitive docs
T1115 Clipboard Data Monitor clipboard for passwords, sensitive data
T1530 Data from Cloud Storage S3 bucket enumeration, Azure blob access
T1213.002 Data from Information Repositories: SharePoint Scrape SharePoint/Confluence for docs
T1114.002 Remote Email Collection Outlook Web Access, Graph API mailbox access
T1114.001 Local Email Collection PST file extraction from local Outlook
T1056.001 Input Capture: Keylogging Keylogger for credential and data capture
T1113 Screen Capture Screenshots of user activity
T1125 Video Capture Webcam access for surveillance

#Command and Control (TA0011)

ID Technique Notes
T1071.001 Web Protocols: HTTPS C2 over HTTPS (Cobalt Strike, Havoc, Sliver)
T1071.004 DNS DNS tunneling (dnscat2, iodine)
T1071.002 File Transfer Protocols FTP/SFTP for C2 communication
T1095 Non-Application Layer Protocol C2 over ICMP, raw TCP/UDP
T1572 Protocol Tunneling SSH tunnel, chisel, ligolo-ng, cloudflared
T1090.003 Multi-hop Proxy Tor, proxychains, redirector chains
T1090.001 Internal Proxy SOCKS proxy via compromised host
T1105 Ingress Tool Transfer Download additional tools to target
T1132.001 Standard Encoding Base64-encoded C2 traffic
T1573.002 Encrypted Channel: Asymmetric Crypto TLS/SSL encrypted C2 channels
T1102 Web Service C2 via Telegram, Slack, Discord, GitHub
T1568.002 Dynamic Resolution: Domain Generation DGA for resilient C2 infrastructure

#Exfiltration (TA0010)

ID Technique Notes
T1041 Exfiltration Over C2 Channel Data exfil through existing C2 connection
T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 HTTPS POST to attacker-controlled server
T1048.003 Exfiltration Over Unencrypted Non-C2 DNS, ICMP, HTTP exfiltration channels
T1567.002 Exfiltration to Cloud Storage Upload to Mega, Google Drive, Dropbox, S3
T1029 Scheduled Transfer Timed exfil to blend with normal traffic
T1537 Transfer Data to Cloud Account Move data to attacker-controlled cloud account
T1052.001 Exfiltration Over Physical Medium: USB Copy data to removable media
T1020 Automated Exfiltration Scripted continuous data exfiltration
T1030 Data Transfer Size Limits Chunk data to avoid DLP thresholds

#Impact (TA0040)

ID Technique Notes
T1486 Data Encrypted for Impact Ransomware encryption (LockBit, BlackCat, Conti)
T1485 Data Destruction Wipe files, databases, backups
T1561.002 Disk Wipe: Disk Structure MBR/GPT wipe (NotPetya, WhisperGate)
T1561.001 Disk Wipe: Disk Content Overwrite disk content sector by sector
T1489 Service Stop Stop critical services, disable backups
T1496 Resource Hijacking Cryptomining on compromised infrastructure
T1531 Account Access Removal Lock out legitimate users, reset passwords
T1490 Inhibit System Recovery Delete shadow copies, disable recovery mode
T1498 Network Denial of Service DDoS against target infrastructure
T1529 System Shutdown/Reboot Force reboot to complete destructive actions

#ATT&CK Groups Reference

#Notable APT Groups (curated selection)

This is a curated selection of the most active threat groups in 2024-2025. MITRE documents 140+ groups. For the complete list, see MITRE ATT&CK Groups.

Russia:

Group Unit Notable Techniques Key Operations
APT29 / Cozy Bear SVR T1059.001 PowerShell, T1071.001 HTTPS C2, T1078 Valid Accounts, T1550.002 PtH SolarWinds (2020), Microsoft 365 (2024)
APT28 / Fancy Bear GRU Unit 26165 T1566 Spearphishing, T1003 Credential Dumping, T1090 Proxy, T1068 Exploit DNC hack (2016), Outlook zero-day CVE-2023-23397
Sandworm / Voodoo Bear GRU Unit 74455 T1486 Ransomware, T1561 Disk Wipe, T1489 Service Stop NotPetya (2017), Industroyer2 (2022), Prestige (2022)
Turla / Venomous Bear FSB Center 16 T1071.004 DNS C2, T1055 Process Injection, T1027 Obfuscation Snake implant (20+ years), satellite C2 hijacking

China:

Group Unit Notable Techniques Key Operations
APT41 / Winnti MSS contractor T1190 Exploit Public Apps, T1059.001 PS, T1053 Scheduled Task, T1505.003 Webshell Supply chain (CCleaner 2017), gaming industry
Volt Typhoon PLA T1190 Exploit, T1218 LOLBins, T1071.001 Living-off-the-Land US critical infra pre-positioning (2023-2025)
APT10 / Stone Panda MSS Tianjin T1199 Trusted Relationship, T1071.001 HTTPS, T1560 Archive Data Cloud Hopper (MSP targeting)
APT40 / Leviathan MSS Hainan T1190 Exploit Public Apps, T1021.002 SMB, T1003 Credential Dump Maritime/defense targeting
Mustang Panda PLA SSF T1566.001 Spearphishing, T1574.002 DLL Side-Loading, T1105 Tool Transfer SE Asia government targeting
Salt Typhoon MSS T1190 Exploit, T1078 Valid Accounts, T1557 Adversary-in-the-Middle US telecom interception (2024-2025)

North Korea:

Group Unit Notable Techniques Key Operations
Lazarus Group RGB Bureau 121 T1566.001 Macro docs, T1055 Process Injection, T1486 Ransomware, T1496 Crypto Sony (2014), WannaCry (2017), Ronin Bridge ($625M 2022)
Kimsuky RGB T1566 Spearphishing, T1059.005 VBS, T1056.001 Keylogging South Korean government/think tanks
Andariel / Onyx Sleet RGB T1190 Exploit, T1059 Command Scripting, T1486 Ransomware Defense/aerospace targeting, Maui ransomware

Iran:

Group Unit Notable Techniques Key Operations
MuddyWater MOIS T1566 Spearphishing, T1059.001 PS, T1105 Tool Transfer Middle East government/telecom
Charming Kitten / APT35 IRGC-IO T1566 Spearphishing, T1078 Valid Accounts, T1114 Email Collection Journalists/activists/diaspora targeting
OilRig / APT34 MOIS T1071.004 DNS C2, T1059.001 PS, T1003 Credential Dump Oil/gas sector, DNS tunneling pioneer
CyberAv3ngers IRGC-CEC T1190 Exploit, T1489 Service Stop Unitronics PLC targeting (water systems 2023)

Cybercrime / Ransomware:

Group Type Notable Techniques Key Operations
FIN7 / Carbanak Financial crime T1566.001 Phishing, T1059.001 PS, T1105 Tool Transfer Hospitality/retail PoS ($1B+ stolen)
FIN11 / Clop Financial crime + RaaS T1190 Exploit (MOVEit, GoAnywhere), T1486 Ransomware, T1567 Cloud Exfil MOVEit mass exploitation (2023, 2000+ orgs)
ALPHV / BlackCat Ransomware-as-a-Service T1486 Ransomware, T1490 Inhibit Recovery, T1489 Service Stop Change Healthcare ($22M ransom 2024), exit scam
LockBit Ransomware-as-a-Service T1486 Ransomware, T1021.002 SMB, T1490 Delete Shadow Copies Most prolific RaaS 2022-2024, seized Feb 2024
Scattered Spider Social engineering T1566 Phishing, T1621 MFA Fatigue, T1078 Valid Accounts MGM/Caesars (2023), Okta customers
Black Basta Ransomware-as-a-Service T1566.001 Spearphishing, T1219 Remote Access Tools, T1486 Ransomware Ex-Conti members, 500+ victims

Other:

Group Attribution Notable Techniques Key Operations
Sea Turtle Turkey - intelligence T1584 Compromise Infrastructure, T1557 DNS Hijacking DNS registry hijacking (2019)
APT32 / OceanLotus Vietnam - MPS T1566 Spearphishing, T1059.001 PS, T1574.002 DLL Side-Loading Journalists, dissidents, foreign corps in Vietnam
SideWinder India - military T1566.001 Spearphishing, T1203 Exploit Client, T1059.001 PS Pakistan/China government targeting
Transparent Tribe / APT36 Pakistan - ISI T1566 Spearphishing, T1059.005 VBS, T1056.001 Keylogging India military/government

#Detection Engineering Quick Reference

#Data Sources by Tactic

Tactic Primary Data Source Key Detections
Reconnaissance External threat intel, DNS logs, honeypot logs Port scan alerts, credential leak monitoring, dark web mentions
Resource Development Certificate transparency, domain registration feeds New lookalike domains, suspicious cert issuance
Initial Access Email gateway logs, WAF logs, VPN logs Malicious attachment analysis, URL reputation, anomalous login location
Execution Process creation (Sysmon EID 1), Script Block Logging (EID 4104) Suspicious parent-child process trees, encoded commands, AMSI events
Persistence Registry monitoring (Sysmon EID 13), scheduled tasks (EID 4698) New Run key, new service creation, new scheduled task, WMI subscription
Privilege Escalation Process token events (EID 4672), Sysmon EID 10 Unexpected SYSTEM processes, UAC bypass patterns, token manipulation
Defense Evasion Module load (Sysmon EID 7), file creation (EID 11) Unsigned DLL loads, masquerading binary names, log clearing (EID 1102)
Credential Access LSASS access (Sysmon EID 10), auth logs (EID 4625/4768) LSASS memory access, Kerberoast (EID 4769 with RC4), password spray
Discovery Process creation, PowerShell logging Rapid enumeration commands, BloodHound collector activity
Lateral Movement Logon events (EID 4624 type 3/10), SMB (Sysmon EID 3) Remote service creation, PtH (NTLM type 3), anomalous RDP sessions
Collection File access (Sysmon EID 11), email audit logs Mass file access, archive creation, mailbox export
Command and Control Network flow, DNS logs, proxy logs Beaconing patterns, DNS tunneling entropy, unusual user-agents
Exfiltration DLP, proxy logs, cloud API logs Large outbound transfers, unusual cloud uploads, DNS data exfil
Impact Volume shadow copy events, service control events Shadow copy deletion (vssadmin), mass file modification, service stops

#Sysmon Event ID Quick Reference (Windows)

Source: Microsoft Learn - Sysmon Events (verified Feb 2026). Log location: Applications and Services Logs > Microsoft > Windows > Sysmon > Operational.

EID Event Detection Use Volume
1 Process Creation Suspicious process trees, LOLBin execution, command-line inspection High
2 File Creation Time Change Timestomping detection - process modifies file creation timestamp to hide artifacts Low
3 Network Connection C2 callbacks, lateral movement, beaconing (disabled by default, enable selectively) Very High
5 Process Terminated Complete execution timelines, detect short-lived processes Medium
6 Driver Loaded Rootkit / BYOVD detection - kernel driver load with signature and hash info Low
7 Image Loaded (DLL) DLL side-loading, unsigned module loads, injection detection Very High
8 CreateRemoteThread Process injection detection - high signal, low volume Low
10 Process Access LSASS credential dumping - noisy, use with targeted filtering High
11 File Create Payload drops, webshell creation, staging detection High
12/13/14 Registry Key/Value Create, Set, Rename Persistence via registry (Run keys, services, COM hijack) High
15 FileCreateStreamHash Alternate Data Stream (ADS) detection, Zone.Identifier / Mark-of-the-Web Low
17 Pipe Created C2 named pipes creation (Cobalt Strike SMB beacon default \postex_*) Low
18 Pipe Connected Named pipe connection - lateral movement via SMB pipes Low
19/20/21 WMI Filter, Consumer, Binding WMI persistence - fileless malware uses WMI event subscriptions Low
22 DNS Query C2 domain resolution, DGA detection, beaconing patterns High
23 File Delete (archived) Ransomware mass deletion, evidence destruction - file content preserved Medium
25 Process Tampering Process hollowing, herpaderping, ghosting - advanced malware evasion Low
26 File Delete Logged File deletion with hash (no content archive, lighter than EID 23) Medium
27/28/29 Executable File Detect/Block Executable staging detection - new in Sysmon 15+, can block exe creation Low

#Sysmon for Linux Event IDs

Source: Sysmon for Linux. Limited subset of Windows Sysmon. Same Event IDs for cross-platform correlation.

EID Event Linux Notes
1 Process Creation execve syscall, full command line + hashes
3 Network Connection TCP/UDP connects via connect() syscall
5 Process Terminated Process exit via exit_group
9 RawAccessRead Direct disk read (dd, raw device access)
11 File Create open() with O_CREAT, creat()
16 Config Change Sysmon config reload
23 File Delete unlink() / unlinkat() with file archive

Missing on Linux (no equivalent): EID 2 (timestomp), 6 (driver), 7 (DLL), 8 (thread injection), 10 (process access), 12-15 (registry/ADS - N/A), 17-18 (named pipes), 19-21 (WMI - N/A), 22 (DNS), 25 (tampering), 27-29 (exe blocking).

#Windows Event IDs (Security + System logs)

Sources: Ultimate Windows Security, ManageEngine EID 7045.

EID Log Event Detection Use
1102 Security Audit Log Cleared Anti-forensics, defense evasion
4624 Security Logon Success Lateral movement (type 3=network, 10=RDP), valid account use
4625 Security Logon Failure Password spray, brute force
4648 Security Explicit Credential Logon RunAs / credential use across systems
4672 Security Special Privileges Assigned Privileged logon monitoring (SeDebugPrivilege, etc.)
4688 Security Process Creation Execution monitoring (requires "Audit Process Creation" + command line)
4697 Security Service Installed in System Service persistence (requires "Audit Security System Extension")
4698 Security Scheduled Task Created Persistence via scheduled tasks
4720 Security User Account Created New account for persistence
4657 Security Registry Value Modified Registry persistence (Run keys, services) - requires "Audit Registry"
4768 Security TGT Requested (AS-REQ) AS-REP roasting: look for encryption type 0x17 (RC4)
4769 Security Service Ticket Requested (TGS-REQ) Kerberoasting: encryption type 0x17 (RC4) for service accounts
5156 Security WFP Connection Allowed Outbound connections (alternative to Sysmon EID 3 without Sysmon)
7045 System New Service Installed Service persistence, PsExec, lateral move. Note: System log, not Security

#Common Attack Chains

#Ransomware Deployment Chain

T1566.001 Spearphishing Attachment
    |
T1204.002 User Execution: Malicious File
    |
T1059.001 PowerShell (Cobalt Strike beacon)
    |
T1547.001 Registry Run Key (persistence)
    |
T1003.001 LSASS Dump (credential harvest)
    |
T1021.002 SMB/Admin Shares (lateral movement)
    |
T1490 Inhibit System Recovery (delete shadows)
    |
T1486 Data Encrypted for Impact (ransomware)

#APT Data Theft Chain

T1190 Exploit Public-Facing Application
    |
T1059.001 PowerShell (initial payload)
    |
T1053.005 Scheduled Task (persistence)
    |
T1003.001 LSASS / T1003.006 DCSync
    |
T1087.002 Domain Account Discovery
    |
T1021.001 RDP / T1021.006 WinRM
    |
T1560.001 Archive Collected Data (7z/rar)
    |
T1041 Exfiltration Over C2 Channel

#Business Email Compromise Chain

T1598.003 Phishing for Information (cred harvest)
    |
T1078 Valid Accounts (compromised mailbox)
    |
T1114.002 Remote Email Collection
    |
T1534 Internal Spearphishing
    |
T1657 Financial Theft (wire fraud)

#Supply Chain Compromise Chain

T1195.002 Supply Chain: Software Supply Chain
    |
T1059.001 PowerShell (post-install execution)
    |
T1547.001 Registry Run Key (persistence)
    |
T1071.001 HTTPS C2 (blends with update traffic)
    |
T1041 Exfiltration Over C2 Channel

#Cloud Breach Chain

T1078.004 Valid Accounts: Cloud Accounts
    |
T1538 Cloud Service Dashboard
    |
T1580 Cloud Infrastructure Discovery
    |
T1530 Data from Cloud Storage (S3/Blob)
    |
T1537 Transfer Data to Cloud Account

#Living-off-the-Land Chain

T1190 Exploit Public-Facing Application
    |
T1059.003 Windows Command Shell
    |
T1218.011 Rundll32 (LOLBin proxy exec)
    |
T1003.001 LSASS (comsvcs.dll minidump)
    |
T1021.006 WinRM (native lateral movement)
    |
T1048.003 Exfil Over DNS (no malware dropped)

#Coverage Matrix

#Detection Coverage Interactive

Interactive visualization of detection coverage by tactic and technique. Map your security controls (EDR, SIEM, honeypots) to ATT&CK techniques to identify detection blind spots. This widget covers a curated subset of the most critical techniques. For the full 200+ technique matrix, use the official ATT&CK Navigator.

MITRE ATT&CK Coverage Matrix

Click a technique badge to cycle state: grey = not tested, orange = tested / not detected, green = tested / detected.

Covered: 0 / 0
Detection rate: 0%
Not detected: 0
Detected: 0
T1xxx Not tested T1xxx Tested, not detected T1xxx Tested, detected

#Behavior Mapper

#Behavioral Mapping

Map behavioral indicators (IOBs), observed procedures, and APT groups to ATT&CK techniques. Generate exportable Navigator layers.

Malware Behavior Mapper

Check observed behaviors to map them to MITRE ATT&CK techniques. Updates live.

Mapped Techniques 0
Check behaviors on the left to map techniques.

#Atomic Test Builder

#Atomic Red Team Command Builder

Build ready-to-run atomic tests per ATT&CK technique to validate your detections: pick a technique, get the executor command with its input arguments.

Atomic Red Team Command Builder

#Also See

#Official Resources

#Cyber Aurelien Guidi