ATT&CK Reference
Portfolio

ATT&CK navigator

A lightweight kill-chain grid. Each column is a tactic, each cell is a technique. Click any cell to open its detail page.

Pre-access
Access
Persistence & privilege
Evasion & credentials
Discovery & movement
Collection & C2
Exfiltration & impact
TA0043Reconnaissance
  1. T1589Gather Victim Identity Information3 sub
  2. T1590Gather Victim Network Information6 sub
  3. T1591Gather Victim Org Information4 sub
  4. T1592Gather Victim Host Information4 sub
  5. T1593Search Open Websites/Domains3 sub
  6. T1594Search Victim-Owned Websites
  7. T1595Active Scanning3 sub
  8. T1596Search Open Technical Databases5 sub
  9. T1597Search Closed Sources2 sub
  10. T1598Phishing for Information4 sub
TA0042Resource Development
  1. T1583Acquire Infrastructure8 sub
  2. T1584Compromise Infrastructure8 sub
  3. T1585Establish Accounts3 sub
  4. T1586Compromise Accounts3 sub
  5. T1587Develop Capabilities4 sub
  6. T1588Obtain Capabilities7 sub
  7. T1608Stage Capabilities6 sub
  8. T1650Acquire Access
TA0001Initial Access
  1. T1078Valid Accounts4 sub
  2. T1091Replication Through Removable Media
  3. T1133External Remote Services
  4. T1189Drive-by Compromise
  5. T1190Exploit Public-Facing Application
  6. T1195Supply Chain Compromise3 sub
  7. T1199Trusted Relationship
  8. T1200Hardware Additions
  9. T1566Phishing4 sub
  10. T1659Content Injection
  11. T1669Wi-Fi Networks
TA0002Execution
  1. T1047Windows Management Instrumentation
  2. T1053Scheduled Task/Job5 sub
  3. T1059Command and Scripting Interpreter12 sub
  4. T1072Software Deployment Tools
  5. T1106Native API
  6. T1129Shared Modules
  7. T1203Exploitation for Client Execution
  8. T1204User Execution4 sub
  9. T1559Inter-Process Communication3 sub
  10. T1569System Services3 sub
  11. T1609Container Administration Command
  12. T1610Deploy Container
  13. T1648Serverless Execution
  14. T1651Cloud Administration Command
  15. T1674Input Injection
  16. T1675ESXi Administration Command
TA0003Persistence
  1. T1037Boot or Logon Initialization Scripts5 sub
  2. T1053Scheduled Task/Job5 sub
  3. T1078Valid Accounts4 sub
  4. T1098Account Manipulation7 sub
  5. T1112Modify Registry
  6. T1133External Remote Services
  7. T1136Create Account3 sub
  8. T1137Office Application Startup6 sub
  9. T1176Software Extensions2 sub
  10. T1197BITS Jobs
  11. T1205Traffic Signaling2 sub
  12. T1505Server Software Component6 sub
  13. T1525Implant Internal Image
  14. T1542Pre-OS Boot5 sub
  15. T1543Create or Modify System Process5 sub
  16. T1546Event Triggered Execution17 sub
  17. T1547Boot or Logon Autostart Execution14 sub
  18. T1554Compromise Host Software Binary
  19. T1556Modify Authentication Process9 sub
  20. T1574Hijack Execution Flow12 sub
  21. T1653Power Settings
  22. T1668Exclusive Control
  23. T1671Cloud Application Integration
TA0004Privilege Escalation
  1. T1037Boot or Logon Initialization Scripts5 sub
  2. T1053Scheduled Task/Job5 sub
  3. T1055Process Injection12 sub
  4. T1068Exploitation for Privilege Escalation
  5. T1078Valid Accounts4 sub
  6. T1098Account Manipulation7 sub
  7. T1134Access Token Manipulation5 sub
  8. T1484Domain or Tenant Policy Modification2 sub
  9. T1543Create or Modify System Process5 sub
  10. T1546Event Triggered Execution17 sub
  11. T1547Boot or Logon Autostart Execution14 sub
  12. T1548Abuse Elevation Control Mechanism6 sub
  13. T1574Hijack Execution Flow12 sub
  14. T1611Escape to Host
TA0005Defense Evasion
  1. T1006Direct Volume Access
  2. T1014Rootkit
  3. T1027Obfuscated Files or Information17 sub
  4. T1036Masquerading11 sub
  5. T1055Process Injection12 sub
  6. T1070Indicator Removal10 sub
  7. T1078Valid Accounts4 sub
  8. T1112Modify Registry
  9. T1127Trusted Developer Utilities Proxy Execution3 sub
  10. T1134Access Token Manipulation5 sub
  11. T1140Deobfuscate/Decode Files or Information
  12. T1197BITS Jobs
  13. T1202Indirect Command Execution
  14. T1205Traffic Signaling2 sub
  15. T1207Rogue Domain Controller
  16. T1211Exploitation for Defense Evasion
  17. T1216System Script Proxy Execution2 sub
  18. T1218System Binary Proxy Execution14 sub
  19. T1220XSL Script Processing
  20. T1221Template Injection
  21. T1222File and Directory Permissions Modification2 sub
  22. T1480Execution Guardrails2 sub
  23. T1484Domain or Tenant Policy Modification2 sub
  24. T1497Virtualization/Sandbox Evasion3 sub
  25. T1535Unused/Unsupported Cloud Regions
  26. T1542Pre-OS Boot5 sub
  27. T1548Abuse Elevation Control Mechanism6 sub
  28. T1550Use Alternate Authentication Material4 sub
  29. T1553Subvert Trust Controls6 sub
  30. T1556Modify Authentication Process9 sub
  31. T1562Impair Defenses11 sub
  32. T1564Hide Artifacts14 sub
  33. T1574Hijack Execution Flow12 sub
  34. T1578Modify Cloud Compute Infrastructure5 sub
  35. T1599Network Boundary Bridging1 sub
  36. T1600Weaken Encryption2 sub
  37. T1601Modify System Image2 sub
  38. T1610Deploy Container
  39. T1612Build Image on Host
  40. T1620Reflective Code Loading
  41. T1622Debugger Evasion
  42. T1647Plist File Modification
  43. T1656Impersonation
  44. T1666Modify Cloud Resource Hierarchy
  45. T1672Email Spoofing
TA0006Credential Access
  1. T1003OS Credential Dumping8 sub
  2. T1040Network Sniffing
  3. T1056Input Capture4 sub
  4. T1110Brute Force4 sub
  5. T1111Multi-Factor Authentication Interception
  6. T1187Forced Authentication
  7. T1212Exploitation for Credential Access
  8. T1528Steal Application Access Token
  9. T1539Steal Web Session Cookie
  10. T1552Unsecured Credentials8 sub
  11. T1555Credentials from Password Stores6 sub
  12. T1556Modify Authentication Process9 sub
  13. T1557Adversary-in-the-Middle4 sub
  14. T1558Steal or Forge Kerberos Tickets5 sub
  15. T1606Forge Web Credentials2 sub
  16. T1621Multi-Factor Authentication Request Generation
  17. T1649Steal or Forge Authentication Certificates
TA0007Discovery
  1. T1007System Service Discovery
  2. T1010Application Window Discovery
  3. T1012Query Registry
  4. T1016System Network Configuration Discovery2 sub
  5. T1018Remote System Discovery
  6. T1033System Owner/User Discovery
  7. T1040Network Sniffing
  8. T1046Network Service Discovery
  9. T1049System Network Connections Discovery
  10. T1057Process Discovery
  11. T1069Permission Groups Discovery3 sub
  12. T1082System Information Discovery
  13. T1083File and Directory Discovery
  14. T1087Account Discovery4 sub
  15. T1120Peripheral Device Discovery
  16. T1124System Time Discovery
  17. T1135Network Share Discovery
  18. T1201Password Policy Discovery
  19. T1217Browser Information Discovery
  20. T1482Domain Trust Discovery
  21. T1497Virtualization/Sandbox Evasion3 sub
  22. T1518Software Discovery1 sub
  23. T1526Cloud Service Discovery
  24. T1538Cloud Service Dashboard
  25. T1580Cloud Infrastructure Discovery
  26. T1613Container and Resource Discovery
  27. T1614System Location Discovery1 sub
  28. T1615Group Policy Discovery
  29. T1619Cloud Storage Object Discovery
  30. T1622Debugger Evasion
  31. T1652Device Driver Discovery
  32. T1654Log Enumeration
  33. T1673Virtual Machine Discovery
TA0008Lateral Movement
  1. T1021Remote Services8 sub
  2. T1072Software Deployment Tools
  3. T1080Taint Shared Content
  4. T1091Replication Through Removable Media
  5. T1210Exploitation of Remote Services
  6. T1534Internal Spearphishing
  7. T1550Use Alternate Authentication Material4 sub
  8. T1563Remote Service Session Hijacking2 sub
  9. T1570Lateral Tool Transfer
TA0009Collection
  1. T1005Data from Local System
  2. T1025Data from Removable Media
  3. T1039Data from Network Shared Drive
  4. T1056Input Capture4 sub
  5. T1074Data Staged2 sub
  6. T1113Screen Capture
  7. T1114Email Collection3 sub
  8. T1115Clipboard Data
  9. T1119Automated Collection
  10. T1123Audio Capture
  11. T1125Video Capture
  12. T1185Browser Session Hijacking
  13. T1213Data from Information Repositories5 sub
  14. T1530Data from Cloud Storage
  15. T1557Adversary-in-the-Middle4 sub
  16. T1560Archive Collected Data3 sub
  17. T1602Data from Configuration Repository2 sub
TA0011Command and Control
  1. T1001Data Obfuscation3 sub
  2. T1008Fallback Channels
  3. T1071Application Layer Protocol5 sub
  4. T1090Proxy4 sub
  5. T1092Communication Through Removable Media
  6. T1095Non-Application Layer Protocol
  7. T1102Web Service3 sub
  8. T1104Multi-Stage Channels
  9. T1105Ingress Tool Transfer
  10. T1132Data Encoding2 sub
  11. T1205Traffic Signaling2 sub
  12. T1219Remote Access Tools3 sub
  13. T1568Dynamic Resolution3 sub
  14. T1571Non-Standard Port
  15. T1572Protocol Tunneling
  16. T1573Encrypted Channel2 sub
  17. T1659Content Injection
  18. T1665Hide Infrastructure
TA0010Exfiltration
  1. T1011Exfiltration Over Other Network Medium1 sub
  2. T1020Automated Exfiltration1 sub
  3. T1029Scheduled Transfer
  4. T1030Data Transfer Size Limits
  5. T1041Exfiltration Over C2 Channel
  6. T1048Exfiltration Over Alternative Protocol3 sub
  7. T1052Exfiltration Over Physical Medium1 sub
  8. T1537Transfer Data to Cloud Account
  9. T1567Exfiltration Over Web Service4 sub
TA0040Impact
  1. T1485Data Destruction1 sub
  2. T1486Data Encrypted for Impact
  3. T1489Service Stop
  4. T1490Inhibit System Recovery
  5. T1491Defacement2 sub
  6. T1495Firmware Corruption
  7. T1496Resource Hijacking4 sub
  8. T1498Network Denial of Service2 sub
  9. T1499Endpoint Denial of Service4 sub
  10. T1529System Shutdown/Reboot
  11. T1531Account Access Removal
  12. T1561Disk Wipe2 sub
  13. T1565Data Manipulation3 sub
  14. T1657Financial Theft
  15. T1667Email Bombing

The matrix reads left to right, but real intrusions loop. Use this view as a coverage map: mark the techniques your detections catch and hunt the gaps.