250 techniques38% have ≥1 framework

ATT&CKATT&CK Matrix — coloured by compliance coverage

250 top-level ATT&CK Enterprise techniques across 14 tactics. Heat = distinct frameworks that map to a technique via the cs-graph corroborator. Authored by Adam Lundqvist.

Metric(EPSS volume · KEV-linked · ATLAS overlap · LOLbin abuse — coming)

compliance coverage

0

1

2-3

4-5

6+

ISO 27001 · 202 DORA · 186 CIS v8 · 159 NIS2 · 140 GDPR · 88 OWASP Top 10 · 80 NIST CSF · 80 OWASP LLM Top 10 · 68 PCI DSS v4 · 68 OWASP API Top 10 · 67 EU AI Act · 59 iso27701 · 37 EU CRA · 26 tiber_eu · 24

TA0001Initial Access10 techniques

Exploit Public-Facing Application

External Remote Services

Supply Chain Compromise

Drive-by Compromise

Replication Through Removable Media

Trusted Relationship

Hardware Additions

Content Injection

TA0002Execution14 techniques

Command and Scripting Interpreter

Scheduled Task/Job

Windows Management Instrumentation

Exploitation for Client Execution

Software Deployment Tools

Inter-Process Communication

System Services

Container Administration Command

Deploy Container

Serverless Execution

Cloud Administration Command

TA0003Persistence22 techniques

Boot or Logon Autostart Execution

External Remote Services

Account Manipulation

Scheduled Task/Job

Boot or Logon Initialization Scripts

Create or Modify System Process

Hijack Execution Flow

Office Application Startup

Browser Extensions

Traffic Signaling

PowerShell Profile

Server Software Component

Implant Internal Image

Event Triggered Execution

Compromise Client Software Binary

Modify Authentication Process

TA0004Privilege Escalation18 techniques

Exploitation for Privilege Escalation

Boot or Logon Autostart Execution

Process Injection

Account Manipulation

Scheduled Task/Job

Boot or Logon Initialization Scripts

Create or Modify System Process

Hijack Execution Flow

Access Token Manipulation

Domain Policy Modification

Parent PID Spoofing

PowerShell Profile

Elevated Execution with Prompt

Event Triggered Execution

Abuse Elevation Control Mechanism

TA0005Defense Evasion47 techniques

Obfuscated Files or Information

Process Injection

Indicator Removal

Impair Defenses

System Binary Proxy Execution

Unused/Unsupported Cloud Regions

Hijack Execution Flow

Direct Volume Access

Modify Registry

Trusted Developer Utilities Proxy Execution

Access Token Manipulation

Deobfuscate/Decode Files or Information

Indirect Command Execution

Traffic Signaling

Rogue Domain Controller

Exploitation for Defense Evasion

System Script Proxy Execution

XSL Script Processing

Template Injection

File and Directory Permissions Modification

Execution Guardrails

Domain Policy Modification

Virtualization/Sandbox Evasion

Parent PID Spoofing

Web Session Cookie

Application Access Token

Revert Cloud Instance

Abuse Elevation Control Mechanism

Use Alternate Authentication Material

Subvert Trust Controls

Modify Authentication Process

Modify Cloud Compute Infrastructure

Network Boundary Bridging

Weaken Encryption

Modify System Image

Deploy Container

Build Image on Host

Reflective Code Loading

Debugger Evasion

Plist File Modification

TA0006Credential Access20 techniques

OS Credential Dumping

Unsecured Credentials

Network Sniffing

Credentials from Password Stores

Steal Application Access Token

Steal Web Session Cookie

Multi-Factor Authentication Interception

Securityd Memory

Forced Authentication

Exploitation for Credential Access

Credentials from Web Browsers

Cloud Instance Metadata API

Modify Authentication Process

Adversary-in-the-Middle

Steal or Forge Kerberos Tickets

Forge Web Credentials

Multi-Factor Authentication Request Generation

Steal or Forge Authentication Certificates

TA0007Discovery32 techniques

File and Directory Discovery

Account Discovery

Remote System Discovery

Network Service Discovery

System Network Connections Discovery

System Information Discovery

System Network Configuration Discovery

System Owner/User Discovery

Network Sniffing

System Service Discovery

Process Discovery

Permission Groups Discovery

Network Share Discovery

Cloud Service Discovery

Application Window Discovery

Peripheral Device Discovery

System Time Discovery

Password Policy Discovery

Browser Information Discovery

Domain Trust Discovery

Virtualization/Sandbox Evasion

Software Discovery

Cloud Service Dashboard

Cloud Infrastructure Discovery

Container and Resource Discovery

System Location Discovery

Group Policy Discovery

Cloud Storage Object Discovery

Debugger Evasion

Device Driver Discovery

Log Enumeration

TA0008Lateral Movement11 techniques

Remote Services

Exploitation of Remote Services

Software Deployment Tools

Taint Shared Content

Replication Through Removable Media

Web Session Cookie

Application Access Token

Internal Spearphishing

Use Alternate Authentication Material

Remote Service Session Hijacking

Lateral Tool Transfer

TA0009Collection17 techniques

Data from Local System

Data from Network Shared Drive

Data from Cloud Storage

Automated Collection

Data from Removable Media

Email Collection

Archive Collected Data

Browser Session Hijacking

Data from Information Repositories

Adversary-in-the-Middle

Data from Configuration Repository

TA0010Exfiltration9 techniques

Exfiltration Over C2 Channel

Exfiltration Over Alternative Protocol

Exfiltration Over Web Service

Automated Exfiltration

Exfiltration Over Other Network Medium

Transfer Data to Cloud Account

Scheduled Transfer

Data Transfer Size Limits

Exfiltration Over Physical Medium

TA0011Command and Control17 techniques

Application Layer Protocol

Protocol Tunneling

Ingress Tool Transfer

Data Obfuscation

Fallback Channels

Communication Through Removable Media

Non-Application Layer Protocol

Multi-Stage Channels

Traffic Signaling

Remote Access Software

Dynamic Resolution

Non-Standard Port

Encrypted Channel

Content Injection

TA0040Impact15 techniques

Data Destruction

Data Encrypted for Impact

Inhibit System Recovery

Endpoint Denial of Service

Network Denial of Service

System Shutdown/Reboot

Account Access Removal

Disk Structure Wipe

Firmware Corruption

Resource Hijacking

Data Manipulation

Financial Theft

TA0042Resource Development8 techniques

Acquire Infrastructure

Compromise Infrastructure

Establish Accounts

Compromise Accounts

Develop Capabilities

Obtain Capabilities

Stage Capabilities

TA0043Reconnaissance10 techniques

Gather Victim Host Information

Gather Victim Identity Information

Gather Victim Network Information

Gather Victim Org Information

Search Open Websites/Domains

Search Victim-Owned Websites

Active Scanning

Search Open Technical Databases

Search Closed Sources

Phishing for Information

Sourced from MITRE ATT&CK Enterprise (current release). Compliance coverage derived from compliance_tests_technique edges in the cs-graph corroborator. Curated by Adam Lundqvist, Founder at SQUR.