ATT&CK MATRIX

Reference · MITRE

The full MITRE ATT&CK Enterprise kill chain — every tactic column and technique cell, collected fresh from MITRE's public STIX. Cell intensity = how many tracked threat groups use the technique; ◆ = cited in advisories we collect. Click a technique for detail; filter by group to see one actor's playbook.

Tactics

kill-chain columns

Techniques

222

top-level · Enterprise

Threat groups

170

with mapped playbooks

Corpus-linked events

our advisories citing T-ids

MATRIX_DOMAIN ENTERPRISE MOBILE ICS ⇩ EXPORT_JSON

FILTER_GROUP ALL_GROUPS Kimsuky Lazarus Group APT28 Mustang Panda APT41 Volt Typhoon Sandworm Team APT32 Magic Hound OilRig Gamaredon Group MuddyWater

TECHNIQUE · T1546.003 — Windows Management Instrumentation Event Subscription

privilege escalationpersistence Windows SUB-TECHNIQUE of T1546 MITRE page ↗

Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user login, or the computer's uptime.(Citation: Mandiant M-Trends 2015) Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system.(Citation: FireEye WMI SANS 2015)(Citation: FireEye WMI 2015) Adversaries may also compile WMI scripts – using …

Threat groups using it · 10

APT29 APT33 Blue Mockingbird FIN8 HEXANE Leviathan Metador Mustang Panda Rancor Turla

Reconnaissance

TA0043 · 12

Gather Victim Identity Information T1589 · 3s ◆1 Gather Victim Org Information T1591 · 4s Search Open Websites/Domains T1593 · 3s ◆1 Search Victim-Owned Websites T1594 Phishing for Information T1598 · 4s Gather Victim Network Information T1590 · 6s Query Public AI Services T1682 Search Open Technical Databases T1596 · 5s ◆1 Search Threat Vendor Data T1681 Gather Victim Host Information T1592 · 4s Search Closed Sources T1597 · 2s ◆1 Active Scanning T1595 · 3s ◆2

Resource Development

TA0042 · 9

Acquire Infrastructure T1583 · 8s ◆2 Establish Accounts T1585 · 3s Develop Capabilities T1587 · 4s ◆1 Acquire Access T1650 Stage Capabilities T1608 · 6s ◆1 Compromise Accounts T1586 · 3s Compromise Infrastructure T1584 · 8s ◆1 Generate Content T1683 · 2s Obtain Capabilities T1588 · 7s ◆2

Initial Access

TA0001 · 11

Valid Accounts T1078 · 4s ◆1 Exploit Public-Facing Application T1190 ◆1 Drive-by Compromise T1189 External Remote Services T1133 Trusted Relationship T1199 ◆1 Phishing T1566 · 4s ◆1 Replication Through Removable Media T1091 Supply Chain Compromise T1195 · 3s Content Injection T1659 Hardware Additions T1200 Wi-Fi Networks T1669

Execution

TA0002 · 20

Windows Management Instrumentation T1047 Exploitation for Client Execution T1203 ◆1 Native API T1106 Command and Scripting Interpreter T1059 · 13s Software Deployment Tools T1072 BITS Jobs T1197 Cloud Administration Command T1651 User Execution T1204 · 5s Container Administration Command T1609 Deploy Container T1610 ESXi Administration Command T1675 Input Injection T1674 Shared Modules T1129 Hijack Execution Flow T1574 · 12s Inter-Process Communication T1559 · 3s Poisoned Pipeline Execution T1677 Scheduled Task/Job T1053 · 5s Serverless Execution T1648 System Services T1569 · 3s ◆1 Trusted Developer Utilities Proxy Execution T1127 · 3s

Persistence

TA0003 · 22

Valid Accounts T1078 · 4s ◆1 Modify Registry T1112 External Remote Services T1133 BITS Jobs T1197 Account Manipulation T1098 · 7s ◆1 Boot or Logon Initialization Scripts T1037 · 5s Create Account T1136 · 3s Traffic Signaling T1205 · 2s Compromise Host Software Binary T1554 Office Application Startup T1137 · 6s Boot or Logon Autostart Execution T1547 · 14s Modify Authentication Process T1556 · 9s ◆1 Cloud Application Integration T1671 Create or Modify System Process T1543 · 5s Event Triggered Execution T1546 · 18s Exclusive Control T1668 Implant Internal Image T1525 Power Settings T1653 Pre-OS Boot T1542 · 5s Scheduled Task/Job T1053 · 5s Server Software Component T1505 · 6s Software Extensions T1176 · 2s

Privilege Escalation

TA0004 · 13

Valid Accounts T1078 · 4s ◆1 Exploitation for Privilege Escalation T1068 ◆1 Process Injection T1055 · 12s Account Manipulation T1098 · 7s ◆1 Boot or Logon Initialization Scripts T1037 · 5s Access Token Manipulation T1134 · 5s Abuse Elevation Control Mechanism T1548 · 6s Boot or Logon Autostart Execution T1547 · 14s Escape to Host T1611 Create or Modify System Process T1543 · 5s Domain or Tenant Policy Modification T1484 · 2s Event Triggered Execution T1546 · 18s Scheduled Task/Job T1053 · 5s

Stealth

TA0005 · 30

Valid Accounts T1078 · 4s ◆1 Deobfuscate/Decode Files or Information T1140 Masquerading T1036 · 12s Obfuscated Files or Information T1027 · 18s ◆2 Process Injection T1055 · 12s Template Injection T1221 Rootkit T1014 BITS Jobs T1197 Execution Guardrails T1480 · 2s Indicator Removal T1070 · 8s Reflective Code Loading T1620 Access Token Manipulation T1134 · 5s Traffic Signaling T1205 · 2s Virtualization/Sandbox Evasion T1497 · 3s Delay Execution T1678 Direct Volume Access T1006 Exploitation for Stealth T1211 Indirect Command Execution T1202 System Binary Proxy Execution T1218 · 14s XSL Script Processing T1220 Debugger Evasion T1622 Selective Exclusion T1679 Build Image on Host T1612 Hide Artifacts T1564 · 14s Hijack Execution Flow T1574 · 12s Pre-OS Boot T1542 · 5s Social Engineering T1684 · 2s System Script Proxy Execution T1216 · 2s Trusted Developer Utilities Proxy Execution T1127 · 3s Unused/Unsupported Cloud Regions T1535

Defense Impairment

TA0112 · 18

Disable or Modify Tools T1685 · 6s Modify Registry T1112 Disable or Modify System Firewall T1686 · 3s Prevent Command History Logging T1690 Modify Authentication Process T1556 · 9s ◆1 Network Boundary Bridging T1599 · 1s Subvert Trust Controls T1553 · 6s Domain or Tenant Policy Modification T1484 · 2s Downgrade Attack T1689 Exploitation for Defense Impairment T1687 File and Directory Permissions Modification T1222 · 2s Modify Cloud Compute Infrastructure T1578 · 5s Modify Cloud Resource Hierarchy T1666 Modify System Image T1601 · 2s Plist File Modification T1647 Rogue Domain Controller T1207 Safe Mode Boot T1688 Weaken Encryption T1600 · 2s

Credential Access

TA0006 · 17

Brute Force T1110 · 4s OS Credential Dumping T1003 · 8s ◆1 Credentials from Password Stores T1555 · 6s Network Sniffing T1040 Steal Web Session Cookie T1539 Multi-Factor Authentication Interception T1111 Adversary-in-the-Middle T1557 · 4s ◆1 Input Capture T1056 · 4s Multi-Factor Authentication Request Generation T1621 Forced Authentication T1187 Steal Application Access Token T1528 Exploitation for Credential Access T1212 Modify Authentication Process T1556 · 9s ◆1 Steal or Forge Authentication Certificates T1649 Steal or Forge Kerberos Tickets T1558 · 5s Unsecured Credentials T1552 · 8s Forge Web Credentials T1606 · 2s

Discovery

TA0007 · 34

System Information Discovery T1082 File and Directory Discovery T1083 System Network Configuration Discovery T1016 · 2s Process Discovery T1057 Remote System Discovery T1018 System Owner/User Discovery T1033 System Network Connections Discovery T1049 Network Service Discovery T1046 Query Registry T1012 Network Share Discovery T1135 System Service Discovery T1007 System Time Discovery T1124 Software Discovery T1518 · 2s Domain Trust Discovery T1482 Local Storage Discovery T1680 Peripheral Device Discovery T1120 Network Sniffing T1040 Browser Information Discovery T1217 Permission Groups Discovery T1069 · 3s Log Enumeration T1654 Account Discovery T1087 · 4s ◆1 Application Window Discovery T1010 Password Policy Discovery T1201 Virtualization/Sandbox Evasion T1497 · 3s Cloud Infrastructure Discovery T1580 System Location Discovery T1614 · 1s Cloud Service Dashboard T1538 Cloud Service Discovery T1526 Container and Resource Discovery T1613 Debugger Evasion T1622 Device Driver Discovery T1652 Group Policy Discovery T1615 Virtual Machine Discovery T1673 Cloud Storage Object Discovery T1619

Lateral Movement

TA0008 · 9

Lateral Tool Transfer T1570 Exploitation of Remote Services T1210 Replication Through Removable Media T1091 Software Deployment Tools T1072 Internal Spearphishing T1534 Taint Shared Content T1080 Remote Services T1021 · 8s Remote Service Session Hijacking T1563 · 2s Use Alternate Authentication Material T1550 · 4s ◆1

Collection

TA0009 · 17

Data from Local System T1005 Automated Collection T1119 ◆1 Screen Capture T1113 Archive Collected Data T1560 · 3s ◆1 Data from Network Shared Drive T1039 Data Staged T1074 · 2s ◆1 Data from Cloud Storage T1530 Clipboard Data T1115 Data from Removable Media T1025 Email Collection T1114 · 3s ◆1 Video Capture T1125 Adversary-in-the-Middle T1557 · 4s ◆1 Input Capture T1056 · 4s Audio Capture T1123 Browser Session Hijacking T1185 ◆1 Data from Information Repositories T1213 · 6s Data from Configuration Repository T1602 · 2s ◆1

Command and Control

TA0011 · 18

Ingress Tool Transfer T1105 Proxy T1090 · 4s ◆1 Non-Standard Port T1571 Protocol Tunneling T1572 Web Service T1102 · 3s Non-Application Layer Protocol T1095 Remote Access Tools T1219 · 3s Dynamic Resolution T1568 · 3s Application Layer Protocol T1071 · 5s ◆1 Fallback Channels T1008 Encrypted Channel T1573 · 2s Multi-Stage Channels T1104 Traffic Signaling T1205 · 2s Hide Infrastructure T1665 Communication Through Removable Media T1092 Content Injection T1659 Data Encoding T1132 · 2s Data Obfuscation T1001 · 3s

Exfiltration

TA0010 · 9

Exfiltration Over C2 Channel T1041 Automated Exfiltration T1020 · 1s Data Transfer Size Limits T1030 Exfiltration Over Web Service T1567 · 4s Transfer Data to Cloud Account T1537 Exfiltration Over Alternative Protocol T1048 · 3s ◆2 Scheduled Transfer T1029 Exfiltration Over Other Network Medium T1011 · 1s Exfiltration Over Physical Medium T1052 · 1s

Impact

TA0040 · 15

Data Encrypted for Impact T1486 Financial Theft T1657 Inhibit System Recovery T1490 Service Stop T1489 Data Destruction T1485 · 1s System Shutdown/Reboot T1529 Account Access Removal T1531 Data Manipulation T1565 · 3s Email Bombing T1667 Endpoint Denial of Service T1499 · 4s Network Denial of Service T1498 · 2s Defacement T1491 · 2s Disk Wipe T1561 · 2s Firmware Corruption T1495 Resource Hijacking T1496 · 4s

Heat · group adoption: ≤ median > median top quartile top decile ◆ n = cited in n of our collected advisories Source: MITRE ATT&CK Enterprise · attack-stix-data · group adoption = STIX “uses” edges