mitre-attack

name	mitre-attack
description	MITRE ATT&CK framework reference — tactics, techniques, and tool-to-TTP mappings for pentest documentation and detection rule writing
allowed-tools	Read

MITRE ATT&CK Enterprise Tactics (TA)

Tactic ID	Tactic Name	Description
TA0001	Initial Access	Entry point into target environment
TA0002	Execution	Running malicious code
TA0003	Persistence	Maintaining foothold across reboots
TA0004	Privilege Escalation	Gaining higher-level permissions
TA0005	Defense Evasion	Avoiding detection
TA0006	Credential Access	Stealing credentials
TA0007	Discovery	Learning about the environment
TA0008	Lateral Movement	Moving through the network
TA0009	Collection	Gathering data of interest
TA0010	Exfiltration	Stealing data
TA0011	Command and Control	Communicating with compromised systems
TA0040	Impact	Disrupting availability or integrity

Top 50 ATT&CK Techniques

TTP ID	Name	Tactic
T1595	Active Scanning	Reconnaissance
T1592	Gather Victim Host Information	Reconnaissance
T1593	Search Open Websites/Domains	Reconnaissance
T1566	Phishing	Initial Access
T1190	Exploit Public-Facing Application	Initial Access
T1133	External Remote Services	Initial Access
T1078	Valid Accounts	Initial Access/Persistence/Defense Evasion
T1059.001	PowerShell	Execution
T1059.003	Windows Command Shell	Execution
T1059.004	Unix Shell	Execution
T1053.005	Scheduled Task	Execution/Persistence
T1204	User Execution	Execution
T1547.001	Registry Run Keys	Persistence
T1547.006	Kernel Modules and Extensions	Persistence
T1543.003	Windows Service	Persistence
T1548.002	Bypass UAC	Privilege Escalation/Defense Evasion
T1068	Exploitation for Privilege Escalation	Privilege Escalation
T1055	Process Injection	Defense Evasion/Privilege Escalation
T1027	Obfuscated Files or Information	Defense Evasion
T1562.001	Disable or Modify Tools	Defense Evasion
T1070.001	Clear Windows Event Logs	Defense Evasion
T1003.001	LSASS Memory	Credential Access
T1003.003	NTDS	Credential Access
T1110.001	Password Guessing	Credential Access
T1110.003	Password Spraying	Credential Access
T1558.003	Kerberoasting	Credential Access
T1558.004	AS-REP Roasting	Credential Access
T1040	Network Sniffing	Credential Access/Discovery
T1087	Account Discovery	Discovery
T1082	System Information Discovery	Discovery
T1018	Remote System Discovery	Discovery
T1046	Network Service Discovery	Discovery
T1069	Permission Groups Discovery	Discovery
T1021.001	Remote Desktop Protocol	Lateral Movement
T1021.002	SMB/Windows Admin Shares	Lateral Movement
T1021.006	Windows Remote Management	Lateral Movement
T1550.002	Pass the Hash	Lateral Movement
T1550.003	Pass the Ticket	Lateral Movement
T1074	Data Staged	Collection
T1056	Input Capture	Collection/Credential Access
T1071.001	Web Protocols (HTTP/S)	C2
T1071.004	DNS	C2
T1095	Non-Application Layer Protocol	C2
T1572	Protocol Tunneling	C2
T1041	Exfiltration Over C2 Channel	Exfiltration
T1048	Exfiltration Over Alternative Protocol	Exfiltration
T1486	Data Encrypted for Impact	Impact
T1490	Inhibit System Recovery	Impact
T1489	Service Stop	Impact
T1562	Impair Defenses	Defense Evasion

Tool → ATT&CK Mapping

Tool	ATT&CK TTP	Description
nmap	T1046, T1595.001	Network Service Discovery / Active Scanning
nuclei	T1595.002	Vulnerability Scanning
subfinder/amass	T1596	Search Open Technical Databases
theHarvester	T1593.001	Social Media Search
mimikatz (sekurlsa)	T1003.001	LSASS Memory Dump
mimikatz (dcsync)	T1003.006	DCSync
bloodhound	T1069, T1482	Permission Group Discovery, Domain Trust Discovery
impacket-GetUserSPNs	T1558.003	Kerberoasting
impacket-GetNPUsers	T1558.004	AS-REP Roasting
hashcat	T1110	Brute Force / Password Cracking
crackmapexec	T1021.002, T1110	SMB Lateral Movement, Password Spraying
impacket-psexec	T1021.002, T1569	SMB Execution
impacket-wmiexec	T1047	Windows Management Instrumentation
evil-winrm	T1021.006	Windows Remote Management
sqlmap	T1190, T1059	SQL Injection Exploitation
Metasploit	T1190, T1068	Exploitation Framework
Sliver/Havoc/Cobalt Strike	T1071, T1573	C2 Communication
msfvenom	T1587.001	Develop Capabilities: Malware
responder	T1557.001	LLMNR/NBT-NS Poisoning
ntlmrelayx	T1557.001	NTLM Relay
certipy	T1649	Steal or Forge Authentication Certificates
bloodhound-python	T1069.002	Domain Group Discovery
feroxbuster/gobuster	T1595.003	Wordlist Scanning
hydra	T1110.001	Password Guessing
burpsuite	T1190	Web Vulnerability Discovery
sqlmap	T1190	SQL Injection
binwalk	T1592.002	Firmware Analysis
frida	T1629, T1633	Mobile Instrumentation
aircrack-ng	T1040	Network Sniffing
john/hashcat	T1110.002	Password Cracking
searchsploit	T1588.005	Exploit Research