← All cheat sheets

MITRE ATT&CK

Plain-text reference · 5 KB. Read it, search it (Ctrl-F) or print it.

MITRE ATT&CK is a knowledge base of adversary tactics and techniques based on
real-world observations. SOC teams use it to map detections, measure coverage,
and communicate about threats in a common language. This is a defensive
reference -- mapping and coverage, not how-to.

STRUCTURE#

Tactic     = the adversary's goal (the "why"). A column in the matrix.
Technique  = how they achieve it (the "how"). ID format Txxxx.
Sub-technique = a more specific method. ID format Txxxx.yyy.
Procedure  = a specific real-world implementation (often tied to a group/tool).
Also: Groups (Gxxxx), Software (Sxxxx), Mitigations (Mxxxx),
Data Sources / Data Components (what telemetry detects a technique).

Matrices: Enterprise (Windows/Linux/macOS/Cloud/Containers/Network), Mobile,
and ICS. SOC work is usually Enterprise.

THE 14 ENTERPRISE TACTICS (in rough attack order)#

TA0043  Reconnaissance
TA0042  Resource Development
TA0001  Initial Access
TA0002  Execution
TA0003  Persistence
TA0004  Privilege Escalation
TA0005  Defense Evasion
TA0006  Credential Access
TA0007  Discovery
TA0008  Lateral Movement
TA0009  Collection
TA0011  Command and Control
TA0010  Exfiltration
TA0040  Impact

COMMONLY-SEEN TECHNIQUES BY TACTIC (reference IDs)#

Initial Access
  T1566  Phishing (.001 attachment, .002 link, .003 via service)
  T1190  Exploit Public-Facing Application
  T1078  Valid Accounts (also Persistence/PrivEsc/Defense Evasion)
  T1133  External Remote Services

Execution
  T1059  Command and Scripting Interpreter
         .001 PowerShell  .003 Windows Command Shell  .004 Unix Shell
         .005 Visual Basic  .006 Python  .007 JavaScript
  T1204  User Execution
  T1053  Scheduled Task/Job (.005 Scheduled Task, .003 cron)
  T1047  Windows Management Instrumentation (WMI)
  T1569  System Services (.002 Service Execution)

Persistence
  T1547  Boot or Logon Autostart Execution (.001 Registry Run Keys/Startup)
  T1053  Scheduled Task/Job
  T1136  Create Account
  T1543  Create or Modify System Process (.003 Windows Service)
  T1546  Event Triggered Execution (.003 WMI Event Subscription)
  T1505  Server Software Component (.003 Web Shell)

Privilege Escalation
  T1548  Abuse Elevation Control Mechanism (.002 UAC Bypass)
  T1055  Process Injection
  T1068  Exploitation for Privilege Escalation
  T1134  Access Token Manipulation

Defense Evasion
  T1070  Indicator Removal (.001 Clear Windows Event Logs)
  T1027  Obfuscated Files or Information
  T1140  Deobfuscate/Decode Files or Information
  T1562  Impair Defenses (.001 Disable or Modify Tools)
  T1218  System Binary Proxy Execution (.011 Rundll32, .010 Regsvr32)
  T1036  Masquerading

Credential Access
  T1003  OS Credential Dumping (.001 LSASS Memory, .002 SAM, .003 NTDS)
  T1110  Brute Force (.003 Password Spraying)
  T1558  Steal or Forge Kerberos Tickets (.003 Kerberoasting)
  T1555  Credentials from Password Stores

Discovery
  T1087  Account Discovery
  T1082  System Information Discovery
  T1083  File and Directory Discovery
  T1018  Remote System Discovery
  T1046  Network Service Discovery
  T1016  System Network Configuration Discovery

Lateral Movement
  T1021  Remote Services (.001 RDP, .002 SMB/Admin Shares, .006 WinRM)
  T1570  Lateral Tool Transfer
  T1550  Use Alternate Authentication Material (.002 Pass the Hash,
         .003 Pass the Ticket)

Collection
  T1005  Data from Local System
  T1114  Email Collection
  T1056  Input Capture (.001 Keylogging)

Command and Control
  T1071  Application Layer Protocol (.001 Web, .004 DNS)
  T1105  Ingress Tool Transfer
  T1573  Encrypted Channel
  T1572  Protocol Tunneling
  T1090  Proxy

Exfiltration
  T1041  Exfiltration Over C2 Channel
  T1048  Exfiltration Over Alternative Protocol
  T1567  Exfiltration Over Web Service

Impact
  T1486  Data Encrypted for Impact (ransomware)
  T1490  Inhibit System Recovery (e.g. delete shadow copies)
  T1489  Service Stop
  T1529  System Shutdown/Reboot
  T1498  Network Denial of Service

HOW A SOC USES ATT&CK#

- Detection mapping: tag every detection rule / Sigma rule with its
  technique ID(s) so coverage is measurable.
- Coverage / gap analysis: use the ATT&CK Navigator to color the matrix by
  what you can detect, partially detect, or miss. Prioritize gaps by threat.
- Alert enrichment: attach technique IDs to alerts so analysts get context
  and can pivot to likely next steps (adjacent tactics).
- Threat-informed defense: map a relevant adversary group's known techniques
  (Gxxxx -> techniques) and compare to your detections.
- Reporting: describe incidents in ATT&CK terms for consistent comms.

Tools: ATT&CK Navigator (layer files), DeTT&CT, ATT&CK Workbench. Sigma
rules carry attack.* tags that map directly to technique IDs.

Note: technique IDs evolve across ATT&CK versions (techniques are added,
split, or deprecated). Pin detections to a specific ATT&CK version and
re-map on upgrade.

Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.