MITRE ATT&CK Technique Search
Fast offline search across every ATT&CK Enterprise technique and sub-technique, with detection strategies and mitigations.
Dataset: MITRE ATT&CK Enterprise v19.2, 222 techniques / 475 sub-techniques (revoked and deprecated entries excluded), generated from MITRE’s STIX release; offline snapshot. The canonical version is at attack.mitre.org.
What this tool does
This is an offline copy of MITRE ATT&CK Enterprise v19.2: all 222 techniques and 475 sub-techniques that are not revoked or deprecated, generated from MITRE’s official STIX release. Each entry has a short description, the tactics it serves, the platforms it applies to, ATT&CK’s detection strategy and the data components it uses, its sub-techniques and the mitigations ATT&CK maps to it. Every result links to its page on attack.mitre.org for the full text, procedure examples and references. It runs as a static search index in your browser, so it works without a connection once the page has loaded and nothing you type is sent anywhere.
How to use it
- Type a technique ID (
T1059), a sub-technique ID (T1059.001), a name, or a keyword such ascredential dumpingorlateral movement. - Narrow results with the Tactics and Platforms chips, for example Stealth + Windows, or combine several of each. Results are ranked: an exact ID first, then name matches, then matches in the description or detection text.
- Click a result to expand its description, detection strategy, data components, sub-techniques and mitigations, or jump to the Sigma rule builder from the links inside.
Frequently asked questions
What is the difference between a tactic and a technique in ATT&CK?
A tactic is the attacker’s goal, for example Privilege Escalation or Exfiltration. A technique is how that goal is achieved, for example T1059 Command and Scripting Interpreter. Most techniques serve more than one tactic, and many break down into sub-techniques that describe a specific implementation.
What does a sub-technique ID like T1059.001 mean?
The part after the dot narrows the parent technique to a specific variant. T1059 is Command and Scripting Interpreter in general; T1059.001 is the PowerShell variant, T1059.003 is the Windows Command Shell variant. Search either ID to jump straight to it.
How do I turn an ATT&CK technique into a detection rule?
Each result lists ATT&CK’s detection strategy for it (the DET id, its name and the first line of its analytic) and the data components that analytic relies on (Process Creation, Command Execution, Network Traffic Flow and so on). Use those to scope a rule in the Sigma rule builder or a collection config in the Sysmon config builder, then check the exact Windows event IDs you need in the Windows Event ID lookup.
Is this the same data as attack.mitre.org?
It is generated from MITRE’s own release: the official ATT&CK Enterprise v19.2 STIX bundle, with every technique and sub-technique that is not revoked or deprecated — 222 techniques and 475 sub-techniques. Names, tactics, platforms, parent/sub-technique links, detection strategies, data components and mitigations come straight from that file; descriptions are shortened to their opening sentences. It is searched entirely in your browser, offline. Each result links to its page on attack.mitre.org, which carries the full text, procedure examples and references, and is always the canonical version. An ID that ATT&CK has since revoked (for example merged into another technique) is not listed here; attack.mitre.org shows what replaced it.
How is ATT&CK Enterprise different from ATT&CK for ICS or Mobile?
ATT&CK is split into separate matrices per environment. Enterprise, searched here, covers Windows, macOS, Linux, cloud, containers, network infrastructure and identity. ICS covers industrial control systems and Mobile covers Android/iOS; both use a largely different technique set, with some tactics shared across all three.