MITRE ATT&CK

829 checks defend against 149 techniques of ATT&CK 19.2. Darker means more checks; choose a tile to list them.

1–45–1415–3435–7980+

ReconnaissanceTA0043 · 4

T1598 · 4Phishing for InformationT1593.003 · 3Code RepositoriesT1591 · 2Gather Victim Org InformationT1589.002 · 1Email Addresses

Resource DevelopmentTA0042 · 2

T1584.001 · 2DomainsT1586.002 · 1Email Accounts

Initial AccessTA0001 · 18

T1078.004 · 221Cloud AccountsT1566 · 94PhishingT1566.002 · 44Spearphishing LinkT1566.001 · 23Spearphishing AttachmentT1078.002 · 17Domain AccountsT1190 · 17Exploit Public-Facing ApplicationT1199 · 14Trusted RelationshipT1078.003 · 10Local AccountsT1189 · 7Drive-by CompromiseT1195.001 · 6Compromise Software Dependencies and Development ToolsT1078.001 · 5Default AccountsT1133 · 3External Remote ServicesT1091 · 2Replication Through Removable MediaT1195 · 2Supply Chain CompromiseT1078 · 1Valid AccountsT1195.002 · 1Compromise Software Supply ChainT1200 · 1Hardware AdditionsT1566.003 · 1Spearphishing via Service

ExecutionTA0002 · 10

T1204.002 · 53Malicious FileT1204.001 · 25Malicious LinkT1203 · 8Exploitation for Client ExecutionT1059 · 5Command and Scripting InterpreterT1059.009 · 4Cloud APIT1677 · 4Poisoned Pipeline ExecutionT1072 · 3Software Deployment ToolsT1106 · 2Native APIT1204.005 · 1Malicious LibraryT1651 · 1Cloud Administration Command

PersistenceTA0003 · 24

T1078.004 · 221Cloud AccountsT1098.003 · 40Additional Cloud RolesT1098.001 · 31Additional Cloud CredentialsT1098.005 · 19Device RegistrationT1078.002 · 17Domain AccountsT1098 · 17Account ManipulationT1136.003 · 13Cloud AccountT1078.003 · 10Local AccountsT1556.007 · 7Hybrid IdentityT1078.001 · 5Default AccountsT1556.009 · 4Conditional Access PoliciesT1133 · 3External Remote ServicesT1137.006 · 3Add-insT1098.007 · 2Additional Local or Domain GroupsT1556.005 · 2Reversible EncryptionT1671 · 2Cloud Application IntegrationT1037.003 · 1Network Logon ScriptT1078 · 1Valid AccountsT1098.002 · 1Additional Email Delegate PermissionsT1136.001 · 1Local AccountT1136.002 · 1Domain AccountT1546.003 · 1Windows Management Instrumentation Event SubscriptionT1547.006 · 1Kernel Modules and ExtensionsT1556.006 · 1Multi-Factor Authentication

Privilege EscalationTA0004 · 20

T1078.004 · 221Cloud AccountsT1098.003 · 40Additional Cloud RolesT1098.001 · 31Additional Cloud CredentialsT1098.005 · 19Device RegistrationT1078.002 · 17Domain AccountsT1098 · 17Account ManipulationT1068 · 16Exploitation for Privilege EscalationT1078.003 · 10Local AccountsT1548.005 · 8Temporary Elevated Cloud AccessT1078.001 · 5Default AccountsT1134.005 · 5SID-History InjectionT1098.007 · 2Additional Local or Domain GroupsT1484.002 · 2Trust ModificationT1037.003 · 1Network Logon ScriptT1055 · 1Process InjectionT1078 · 1Valid AccountsT1098.002 · 1Additional Email Delegate PermissionsT1546.003 · 1Windows Management Instrumentation Event SubscriptionT1547.006 · 1Kernel Modules and ExtensionsT1548.002 · 1Bypass User Account Control

StealthTA0005 · 17

T1078.004 · 221Cloud AccountsT1684.002 · 35Email SpoofingT1078.002 · 17Domain AccountsT1684.001 · 15ImpersonationT1078.003 · 10Local AccountsT1078.001 · 5Default AccountsT1134.005 · 5SID-History InjectionT1070 · 4Indicator RemovalT1006 · 2Direct Volume AccessT1564.012 · 2File/Path ExclusionsT1027 · 1Obfuscated Files or InformationT1027.015 · 1CompressionT1036.008 · 1Masquerade File TypeT1055 · 1Process InjectionT1070.008 · 1Clear Mailbox DataT1078 · 1Valid AccountsT1564.008 · 1Email Hiding Rules

Defense ImpairmentTA0112 · 12

T1685.002 · 13Disable or Modify Cloud LogT1685 · 9Disable or Modify ToolsT1556.007 · 7Hybrid IdentityT1553.006 · 4Code Signing Policy ModificationT1556.009 · 4Conditional Access PoliciesT1222.001 · 2Windows PermissionsT1484.002 · 2Trust ModificationT1556.005 · 2Reversible EncryptionT1553.001 · 1Gatekeeper BypassT1556.006 · 1Multi-Factor AuthenticationT1666 · 1Modify Cloud Resource HierarchyT1686.003 · 1Windows Host Firewall

Credential AccessTA0006 · 32

T1110 · 36Brute ForceT1528 · 30Steal Application Access TokenT1110.003 · 19Password SprayingT1621 · 16Multi-Factor Authentication Request GenerationT1111 · 13Multi-Factor Authentication InterceptionT1557 · 12Adversary-in-the-MiddleT1558 · 12Steal or Forge Kerberos TicketsT1110.004 · 10Credential StuffingT1552.001 · 10Credentials In FilesT1558.003 · 10KerberoastingT1539 · 9Steal Web Session CookieT1552 · 9Unsecured CredentialsT1110.001 · 8Password GuessingT1003.006 · 7DCSyncT1556.007 · 7Hybrid IdentityT1552.004 · 5Private KeysT1003 · 4OS Credential DumpingT1003.001 · 4LSASS MemoryT1552.006 · 4Group Policy PreferencesT1556.009 · 4Conditional Access PoliciesT1649 · 4Steal or Forge Authentication CertificatesT1040 · 3Network SniffingT1557.004 · 3Evil TwinT1556.005 · 2Reversible EncryptionT1557.001 · 2Name Resolution Poisoning and SMB RelayT1558.002 · 2Silver TicketT1606.002 · 2SAML TokensT1003.002 · 1Security Account ManagerT1110.002 · 1Password CrackingT1556.006 · 1Multi-Factor AuthenticationT1558.001 · 1Golden TicketT1558.004 · 1AS-REP Roasting

DiscoveryTA0007 · 7

T1087.004 · 6Cloud AccountT1069.003 · 5Cloud GroupsT1040 · 3Network SniffingT1046 · 3Network Service DiscoveryT1526 · 2Cloud Service DiscoveryT1087.002 · 1Domain AccountT1087.003 · 1Email Account

Lateral MovementTA0008 · 11

T1550.001 · 15Application Access TokenT1021 · 12Remote ServicesT1550.004 · 12Web Session CookieT1550.003 · 11Pass the TicketT1080 · 7Taint Shared ContentT1210 · 5Exploitation of Remote ServicesT1534 · 5Internal SpearphishingT1550.002 · 4Pass the HashT1072 · 3Software Deployment ToolsT1091 · 2Replication Through Removable MediaT1021.001 · 1Remote Desktop Protocol

CollectionTA0009 · 12

T1530 · 22Data from Cloud StorageT1213.002 · 20SharepointT1213 · 14Data from Information RepositoriesT1557 · 12Adversary-in-the-MiddleT1005 · 6Data from Local SystemT1114.002 · 4Remote Email CollectionT1115 · 4Clipboard DataT1213.003 · 4Code RepositoriesT1114.003 · 3Email Forwarding RuleT1557.004 · 3Evil TwinT1557.001 · 2Name Resolution Poisoning and SMB RelayT1113 · 1Screen Capture

Command and ControlTA0011 · 6

T1071 · 8Application Layer ProtocolT1071.001 · 8Web ProtocolsT1573 · 5Encrypted ChannelT1105 · 2Ingress Tool TransferT1219 · 1Remote Access ToolsT1571 · 1Non-Standard Port

ExfiltrationTA0010 · 7

T1567 · 18Exfiltration Over Web ServiceT1048 · 10Exfiltration Over Alternative ProtocolT1567.002 · 8Exfiltration to Cloud StorageT1041 · 5Exfiltration Over C2 ChannelT1537 · 4Transfer Data to Cloud AccountT1052.001 · 2Exfiltration over USBT1567.001 · 1Exfiltration to Code Repository

ImpactTA0040 · 9

T1499.003 · 7Application Exhaustion FloodT1485 · 4Data DestructionT1498 · 3Network Denial of ServiceT1565.001 · 3Stored Data ManipulationT1499.002 · 2Service Exhaustion FloodT1531 · 2Account Access RemovalT1486 · 1Data Encrypted for ImpactT1490 · 1Inhibit System RecoveryT1499 · 1Endpoint Denial of Service