MITRE ATT&CK MITRE-ATTACK-Techniques-Sub-Techniques-200-600-T1078-T1059-T1566-T1190-T1486-Procedures-Adversary-Behaviour: MITRE ATT&CK Techniques + 200+ + Sub-Techniques + 600+ + T1078 + T1059 + T1566 + T1190 + T1486 + Procedures

Catalogue and analyse adversary techniques and sub-techniques. ATT&CK Enterprise contains 200+ techniques + 600+ sub-techniques as of v16 (October 2024). Each technique has unique ID (T-NNNN) + Name + Description + Tactics + Procedure Examples + Mitigations + Detection guidance + Platforms + Data Sources. Key technique examples: T1078 Valid Accounts (legitimate credentials abuse) + T1059 Command and Scripting Interpreter (PowerShell + Bash + Python + JavaScript + AppleScript) + T1566 Phishing (Spearphishing Attachment + Link + Service) + T1190 Exploit Public-Facing Application (CVE exploitation) + T1486 Data Encrypted for Impact (ransomware) + T1110 Brute Force + T1003 OS Credential Dumping (LSASS + SAM + DCSync) + T1218 System Binary Proxy Execution (Living off the Land) + T1055 Process Injection + T1071 Application Layer Protocol (DNS + HTTPS + IRC + DNS C2) + T1567 Exfiltration Over Web Service + T1027 Obfuscated Files + T1547 Boot or Logon Autostart Execution. Sub-Techniques provide more specific descriptions (e.g. T1078.001 Default Accounts + T1078.002 Domain Accounts + T1078.003 Local Accounts + T1078.004 Cloud Accounts). Procedure Examples document specific real-world implementations by named threat groups (APT28 + APT29 + APT38 + APT41 + FIN7 + Conti + LockBit + Lazarus + Volt Typhoon + Scattered Spider + Sandworm + many others) and tools (Cobalt Strike + Mimikatz + Empire + Metasploit + ProcDump + WMIExec + PsExec). Each technique describes adversary behaviour pattern that defenders can detect + mitigate + hunt for.