1. Home
  2. Mapping Frameworks
  3. VERIS Home

VERIS

The Vocabulary for Event Recording and Incident Sharing (VERIS) provides a common language for describing security incidents in a structured and repeatable manner that allows for the analysis of data across a variety of incidents. These mappings provide the context to better connect the who, what, and why captured in VERIS incident representation with the when and how described in MITRE ATT&CK® adversary behavioral tactics and techniques.

VERIS Versions: 1.4.0, 1.3.7, 1.3.5 ATT&CK Versions: 16.1, 12.1, 9.0 ATT&CK Domain: Enterprise, ICS, Mobile

VERIS Mapping Methodology

Download Mapping Artifacts:

download JSON

download YAML

download CSV

download Excel

download STIX Bundles

download Navigator Layers

SELECT VERSIONS

VERIS Version

ATT&CK Version

ATT&CK Domain

Capability Groups

ID Capability Group Name Number of Mappings Number of Capabilities
action.hacking action.hacking 478 53
action.malware action.malware 400 51
attribute.integrity attribute.integrity 88 11
attribute.confidentiality attribute.confidentiality 75 1
attribute.availability attribute.availability 42 5
action.social action.social 64 10
value_chain.development value_chain.development 23 10

All Mappings

This is a very large mapping. To reduce the size, we have only downloaded the first 550 of 1,170 mappings. Load all data (1.4 MB)

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
action.social.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1656 Impersonation
action.hacking.variety.Other Other related-to T1001 Data Obfuscation
action.hacking.variety.Other Other related-to T1001.001 Junk Data
action.hacking.variety.Other Other related-to T1001.002 Steganography
action.hacking.variety.Other Other related-to T1001.003 Protocol or Service Impersonation
action.hacking.variety.Other Other related-to T1071 Application Layer Protocol
action.hacking.variety.Other Other related-to T1071.001 Web Protocols
action.hacking.variety.Other Other related-to T1071.002 File Transfer Protocols
action.hacking.variety.Other Other related-to T1071.003 Mail Protocols
action.hacking.variety.Other Other related-to T1071.004 DNS
action.hacking.variety.Other Other related-to T1105 Ingress Tool Transfer
action.hacking.variety.Other Other related-to T1127.001 MSBuild
action.malware.variety.Other Other related-to T1080 Taint Shared Content
action.malware.variety.Other Other related-to T1204 User Execution
action.malware.variety.Other Other related-to T1204.001 Malicious Link
action.malware.variety.Other Other related-to T1204.002 Malicious File
action.malware.variety.Other Other related-to T1204.003 Malicious Image
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1027.011 Fileless Storage
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1027.012 LNK Icon Smuggling
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1027.013 Encrypted/Encoded File
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.009 Cloud API
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.010 AutoHotKey & AutoIT
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.011 Lua
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1127.002 ClickOnce
action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1098.006 Additional Container Cluster Roles
action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1098.007 Additional Local or Domain Groups
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027 Obfuscated Files or Information
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.001 Binary Padding
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.002 Software Packing
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.003 Steganography
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.004 Compile After Delivery
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.010 Command Obfuscation
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.011 Fileless Storage
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.012 LNK Icon Smuggling
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.013 Encrypted/Encoded File
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.014 Polymorphic Code
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1070.010 Relocate Malware
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1132.002 Non-Standard Encoding
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'. related-to T1059.009 Cloud API
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'. related-to T1059.010 AutoHotKey & AutoIT
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'. related-to T1059.011 Lua
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'. related-to T1127.002 ClickOnce
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1021.007 Cloud Services
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1021.008 Direct Cloud VM Connections
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1134.003 Make and Impersonate Token
action.hacking.vector.Command shell Remote shell related-to T1021.008 Direct Cloud VM Connections
action.hacking.vector.Command shell Remote shell related-to T1027.010 Command Obfuscation
action.hacking.vector.Command shell Remote shell related-to T1059.009 Cloud API
action.hacking.vector.Command shell Remote shell related-to T1059.010 AutoHotKey & AutoIT
action.hacking.vector.Command shell Remote shell related-to T1059.011 Lua
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1071.005 Publish/Subscribe Protocols
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1016.002 Wi-Fi Discovery
action.malware.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036.009 Break Process Trees
action.malware.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1071.005 Publish/Subscribe Protocols
action.malware.variety.Scan network Enumerating the state of the network related-to T1016.002 Wi-Fi Discovery
action.malware.variety.Spyware/Keylogger Spyware, keylogger or form-grabber (capture user input or activity) related-to T1111 Multi-Factor Authentication Interception
action.social.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036.008 Masquerade File Type
action.social.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036.010 Masquerade Account Name
attribute.integrity.variety.Modify privileges Modified privileges or permissions related-to T1098.006 Additional Container Cluster Roles
attribute.integrity.variety.Modify privileges Modified privileges or permissions related-to T1098.007 Additional Local or Domain Groups
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1047 Windows Management Instrumentation
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1053 Scheduled Task/Job
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1053.002 At
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1053.003 Cron
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1053.005 Scheduled Task
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1053.006 Systemd Timers
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1053.007 Container Orchestration Job
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059 Command and Scripting Interpreter
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.001 PowerShell
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.002 AppleScript
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.003 Windows Command Shell
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.004 Unix Shell
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.005 Visual Basic
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.006 Python
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.007 JavaScript
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.008 Network Device CLI
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1072 Software Deployment Tools
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1105 Ingress Tool Transfer
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1106 Native API
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1112 Modify Registry
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1127 Trusted Developer Utilities Proxy Execution
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1127.001 MSBuild
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1129 Shared Modules
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1137 Office Application Startup
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1137.001 Office Template Macros
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1137.002 Office Test
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1137.003 Outlook Forms
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1137.004 Outlook Home Page
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1137.005 Outlook Rules
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1187 Forced Authentication
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1202 Indirect Command Execution
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1216 System Script Proxy Execution
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1216.001 PubPrn
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1216.002 SyncAppvPublishingServer
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1218 System Binary Proxy Execution
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1218.001 Compiled HTML File
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1218.002 Control Panel
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1218.003 CMSTP
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1218.004 InstallUtil
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1218.005 Mshta
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1218.007 Msiexec
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1218.008 Odbcconf
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1218.009 Regsvcs/Regasm
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1218.010 Regsvr32
action.hacking.variety.AiTM Adversary-in-the-middle attack. Child of 'Exploit vuln' related-to T1111 Multi-Factor Authentication Interception
action.hacking.variety.AiTM Adversary-in-the-middle attack. Child of 'Exploit vuln' related-to T1185 Browser Session Hijacking
action.hacking.variety.AiTM Adversary-in-the-middle attack. Child of 'Exploit vuln' related-to T1187 Forced Authentication
action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1037 Boot or Logon Initialization Scripts
action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1053 Scheduled Task/Job
action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1078 Valid Accounts
action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1098 Account Manipulation
action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1133 External Remote Services
action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1563.002 RDP Hijacking
action.hacking.variety.Brute force Brute force or password guessing attacks. related-to T1110 Brute Force
action.hacking.variety.Brute force Brute force or password guessing attacks. related-to T1222.002 Linux and Mac File and Directory Permissions Modification
action.hacking.variety.Brute force Brute force or password guessing attacks. related-to T1565.001 Stored Data Manipulation
action.hacking.variety.Brute force Brute force or password guessing attacks. related-to T1021.003 Distributed Component Object Model
action.hacking.variety.Brute force Brute force or password guessing attacks. related-to T1531 Account Access Removal
action.hacking.variety.Buffer overflow Buffer overflow. Child of 'Exploit vuln'. related-to T1203 Exploitation for Client Execution
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1001 Data Obfuscation
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1102.001 Dead Drop Resolver
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1602.001 SNMP (MIB Dump)
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1584.002 DNS Server
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1008 Fallback Channels
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1014 Rootkit
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036 Masquerading
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1071 Application Layer Protocol
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1090 Proxy
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1102 Web Service
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1104 Multi-Stage Channels
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1132 Data Encoding
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1583.007 Serverless
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1205 Traffic Signaling
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1021.007 Cloud Services
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1053.005 Scheduled Task
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1211 Exploitation for Defense Evasion
action.hacking.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1190 Exploit Public-Facing Application
action.hacking.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1212 Exploitation for Credential Access
action.hacking.variety.Exploit vuln Exploit vulnerability in code (vs misconfig or weakness). This can be used with other hacking enumerations, (such as XSS when an XSS vuln exists.). Parent of many hacking varieties. related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.Exploit vuln Exploit vulnerability in code (vs misconfig or weakness). This can be used with other hacking enumerations, (such as XSS when an XSS vuln exists.). Parent of many hacking varieties. related-to T1212 Exploitation for Credential Access
action.hacking.variety.Format string attack Format string attack. Child of 'Exploit vuln'. related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.Fuzz testing Fuzz testing. Child of 'Exploit vuln'. related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.Hijack To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes) related-to T1185 Browser Session Hijacking
action.hacking.variety.HTTP request smuggling HTTP request smuggling. Child of 'Exploit vuln'. related-to T1185 Browser Session Hijacking
action.hacking.variety.HTTP request smuggling HTTP request smuggling. Child of 'Exploit vuln'. related-to T1203 Exploitation for Client Execution
action.hacking.variety.HTTP request splitting HTTP request splitting. Child of 'Exploit vuln'. related-to T1185 Browser Session Hijacking
action.hacking.variety.HTTP request splitting HTTP request splitting. Child of 'Exploit vuln'. related-to T1203 Exploitation for Client Execution
action.hacking.variety.HTTP response smuggling HTTP response smuggling. Child of 'Exploit vuln'. related-to T1185 Browser Session Hijacking
action.hacking.variety.HTTP response smuggling HTTP response smuggling. Child of 'Exploit vuln'. related-to T1203 Exploitation for Client Execution
action.hacking.variety.HTTP response splitting HTTP response splitting. Child of 'Exploit vuln'. related-to T1185 Browser Session Hijacking
action.hacking.variety.HTTP response splitting HTTP response splitting. Child of 'Exploit vuln'. related-to T1203 Exploitation for Client Execution
action.hacking.variety.Insecure deserialization iterating over sequential or obvious values. https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization. Child of 'Exploit vuln'. related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.Integer overflows Integer overflows. Child of 'Exploit vuln'. related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.LDAP injection LDAP injection. Child of 'Exploit vuln'. related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.Null byte injection Null byte injection. Child of 'Exploit vuln'. related-to T1027 Obfuscated Files or Information
action.hacking.variety.Offline cracking Offline password or key cracking (e.g., rainbow tables, Hashcat, JtR) related-to T1565.001 Stored Data Manipulation
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'. related-to T1059 Command and Scripting Interpreter
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'. related-to T1505.005 Terminal Services DLL
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'. related-to T1569 System Services
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'. related-to T1110 Brute Force
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1007 System Service Discovery
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1012 Query Registry
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1033 System Owner/User Discovery
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1057 Process Discovery
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1069 Permission Groups Discovery
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1136.003 Cloud Account
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1082 System Information Discovery
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1083 File and Directory Discovery
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1087 Account Discovery
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1573.001 Symmetric Cryptography
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1119 Automated Collection
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1120 Peripheral Device Discovery
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1124 System Time Discovery
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1201 Password Policy Discovery
action.hacking.variety.Scan network Enumerating the state of the network related-to T1018 Remote System Discovery
action.hacking.variety.Scan network Enumerating the state of the network related-to T1007 System Service Discovery
action.hacking.variety.Scan network Enumerating the state of the network related-to T1046 Network Service Discovery
action.hacking.variety.Scan network Enumerating the state of the network related-to T1049 System Network Connections Discovery
action.hacking.variety.Scan network Enumerating the state of the network related-to T1119 Automated Collection
action.hacking.variety.Scan network Enumerating the state of the network related-to T1135 Network Share Discovery
action.hacking.variety.Session fixation Session fixation. Child of 'Exploit vuln'. related-to T1185 Browser Session Hijacking
action.hacking.variety.Session fixation Session fixation. Child of 'Exploit vuln'. related-to T1212 Exploitation for Credential Access
action.hacking.variety.SQLi SQL injection. Child of 'Exploit vuln'. related-to T1190 Exploit Public-Facing Application
action.hacking.variety.Unknown Unknown related-to T1134 Access Token Manipulation
action.hacking.variety.Unknown Unknown related-to T1127 Trusted Developer Utilities Proxy Execution
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1021 Remote Services
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1027.007 Dynamic API Resolution
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1029 Scheduled Transfer
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1547.004 Winlogon Helper DLL
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1598.003 Spearphishing Link
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1560.001 Archive via Utility
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1583.004 Server
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1078 Valid Accounts
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1011.001 Exfiltration Over Bluetooth
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1550.004 Web Session Cookie
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1601.002 Downgrade System Image
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1569.002 Service Execution
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1133 External Remote Services
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1134 Access Token Manipulation
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1654 Log Enumeration
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1548 Abuse Elevation Control Mechanism
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1041 Exfiltration Over C2 Channel
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1187 Forced Authentication
action.hacking.variety.XML external entities XML external entities. Child of 'Exploit vuln'. related-to T1558.002 Silver Ticket
action.hacking.variety.XPath injection XPath injection. Child of 'Exploit vuln'. related-to T1010 Application Window Discovery
action.hacking.vector.3rd party desktop 3rd party online desktop sharing (LogMeIn, Go2Assist) related-to T1133 External Remote Services
action.hacking.vector.Backdoor Hacking actions taken through a backdoor. C2 is only used by malware. related-to T1037 Boot or Logon Initialization Scripts
action.hacking.vector.Backdoor Hacking actions taken through a backdoor. C2 is only used by malware. related-to T1053 Scheduled Task/Job
action.hacking.vector.Backdoor Hacking actions taken through a backdoor. C2 is only used by malware. related-to T1078 Valid Accounts
action.hacking.vector.Backdoor Hacking actions taken through a backdoor. C2 is only used by malware. related-to T1098 Account Manipulation
action.hacking.vector.Backdoor Hacking actions taken through a backdoor. C2 is only used by malware. related-to T1133 External Remote Services
action.hacking.vector.Backdoor Hacking actions taken through a backdoor. C2 is only used by malware. related-to T1563.002 RDP Hijacking
action.hacking.vector.Command shell Remote shell related-to T1029 Scheduled Transfer
action.hacking.vector.Command shell Remote shell related-to T1547.004 Winlogon Helper DLL
action.hacking.vector.Command shell Remote shell related-to T1598.003 Spearphishing Link
action.hacking.vector.Command shell Remote shell related-to T1583.004 Server
action.hacking.vector.Command shell Remote shell related-to T1047 Windows Management Instrumentation
action.hacking.vector.Command shell Remote shell related-to T1059 Command and Scripting Interpreter
action.hacking.vector.Command shell Remote shell related-to T1552.008 Chat Messages
action.hacking.vector.Command shell Remote shell related-to T1505.005 Terminal Services DLL
action.hacking.vector.Command shell Remote shell related-to T1569 System Services
action.hacking.vector.Command shell Remote shell related-to T1110 Brute Force
action.hacking.vector.Command shell Remote shell related-to T1071.001 Web Protocols
action.hacking.vector.Command shell Remote shell related-to T1127.002 ClickOnce
action.hacking.vector.Command shell Remote shell related-to T1546.013 PowerShell Profile
action.hacking.vector.Command shell Remote shell related-to T1584.005 Botnet
action.hacking.vector.Desktop sharing software Superset of 'Desktop sharing' and '3rd party desktop'. Please use in place of the other two related-to T1027.007 Dynamic API Resolution
action.hacking.vector.Desktop sharing software Superset of 'Desktop sharing' and '3rd party desktop'. Please use in place of the other two related-to T1560.001 Archive via Utility
action.hacking.vector.Desktop sharing software Superset of 'Desktop sharing' and '3rd party desktop'. Please use in place of the other two related-to T1133 External Remote Services
action.hacking.vector.Other network service Network service that is not remote access or a web application. related-to T1008 Fallback Channels
action.hacking.vector.Other network service Network service that is not remote access or a web application. related-to T1071 Application Layer Protocol
action.hacking.vector.Other network service Network service that is not remote access or a web application. related-to T1090 Proxy
action.hacking.vector.Other network service Network service that is not remote access or a web application. related-to T1095 Non-Application Layer Protocol
action.hacking.vector.Other network service Network service that is not remote access or a web application. related-to T1102 Web Service
action.hacking.vector.Other network service Network service that is not remote access or a web application. related-to T1104 Multi-Stage Channels
action.hacking.vector.Other network service Network service that is not remote access or a web application. related-to T1105 Ingress Tool Transfer
action.hacking.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1195 Supply Chain Compromise
action.hacking.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1499.003 Application Exhaustion Flood
action.hacking.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1589.001 Credentials
action.hacking.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1499.002 Service Exhaustion Flood
action.hacking.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1199 Trusted Relationship
action.hacking.vector.Physical access Physical access or connection (i.e., at keyboard or via cable) related-to T1200 Hardware Additions
action.hacking.vector.VPN VPN related-to T1133 External Remote Services
action.hacking.vector.Web application Web application related-to T1090.002 External Proxy
action.malware.variety.Adminware System or network utilities (e.g., PsTools, Netcat) related-to T1072 Software Deployment Tools
action.malware.variety.Adware Adware related-to T1199 Trusted Relationship
action.malware.variety.Backdoor Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'. related-to T1037 Boot or Logon Initialization Scripts
action.malware.variety.Backdoor Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'. related-to T1098 Account Manipulation
action.malware.variety.Backdoor Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'. related-to T1133 External Remote Services
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1008 Fallback Channels
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1098 Account Manipulation
action.malware.variety.Brute force Brute force attack related-to T1110 Brute Force
action.malware.variety.Brute force Brute force attack related-to T1222.002 Linux and Mac File and Directory Permissions Modification
action.malware.variety.Brute force Brute force attack related-to T1565.001 Stored Data Manipulation
action.malware.variety.Brute force Brute force attack related-to T1021.003 Distributed Component Object Model
action.malware.variety.Brute force Brute force attack related-to T1531 Account Access Removal
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1102.001 Dead Drop Resolver
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1008 Fallback Channels
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1071 Application Layer Protocol
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1584.007 Serverless
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1055.014 VDSO Hijacking
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1021 Remote Services
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1561 Disk Wipe
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1090 Proxy
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1566.003 Spearphishing via Service
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1110.003 Password Spraying
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1070.005 Network Share Connection Removal
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1578.005 Modify Cloud Compute Configurations
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1095 Non-Application Layer Protocol
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1102 Web Service
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1216 System Script Proxy Execution
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1036.003 Rename System Utilities
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1546.014 Emond
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1104 Multi-Stage Channels
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1132 Data Encoding
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1583.007 Serverless
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1485 Data Destruction
action.malware.variety.Capture app data Capture data from application or system process related-to T1056 Input Capture
action.malware.variety.Capture app data Capture data from application or system process related-to T1596.003 Digital Certificates
action.malware.variety.Capture app data Capture data from application or system process related-to T1547.006 Kernel Modules and Extensions
action.malware.variety.Capture app data Capture data from application or system process related-to T1090.002 External Proxy
action.malware.variety.Capture app data Capture data from application or system process related-to T1546.017 Udev Rules
action.malware.variety.Capture app data Capture data from application or system process related-to T1113 Screen Capture
action.malware.variety.Capture app data Capture data from application or system process related-to T1114 Email Collection
action.malware.variety.Capture app data Capture data from application or system process related-to T1110.002 Password Cracking
action.malware.variety.Capture app data Capture data from application or system process related-to T1556.006 Multi-Factor Authentication
action.malware.variety.Capture app data Capture data from application or system process related-to T1546.009 AppCert DLLs
action.malware.variety.Capture app data Capture data from application or system process related-to T1123 Audio Capture
action.malware.variety.Capture app data Capture data from application or system process related-to T1125 Video Capture
action.malware.variety.Capture app data Capture data from application or system process related-to T1176 Browser Extensions
action.malware.variety.Capture app data Capture data from application or system process related-to T1185 Browser Session Hijacking
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1114 Email Collection
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1587 Develop Capabilities
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1558.003 Kerberoasting
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1565.002 Transmitted Data Manipulation
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1005 Data from Local System
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1010 Application Window Discovery
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1025 Data from Removable Media
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1033 System Owner/User Discovery
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1039 Data from Network Shared Drive
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1083 File and Directory Discovery
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1119 Automated Collection
action.malware.variety.Client-side attack Client-side or browser attack (e.g., redirection, XSS, AitB) related-to T1203 Exploitation for Client Execution
action.malware.variety.Destroy data Destroy or corrupt stored data related-to T1542.002 Component Firmware
action.malware.variety.Destroy data Destroy or corrupt stored data related-to T1092 Communication Through Removable Media
action.malware.variety.Destroy data Destroy or corrupt stored data related-to T1566.002 Spearphishing Link
action.malware.variety.Destroy data Destroy or corrupt stored data related-to T1600.001 Reduce Key Space
action.malware.variety.Destroy data Destroy or corrupt stored data related-to T1027.010 Command Obfuscation
action.malware.variety.Destroy data Destroy or corrupt stored data related-to T1496.001 Compute Hijacking
action.malware.variety.Destroy data Destroy or corrupt stored data related-to T1218 System Binary Proxy Execution
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1006 Direct Volume Access
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1027 Obfuscated Files or Information
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1563 Remote Service Session Hijacking
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1111 Multi-Factor Authentication Interception
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1095 Non-Application Layer Protocol
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1499 Endpoint Denial of Service
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1059.011 Lua
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1036 Masquerading
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1505.004 IIS Components
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1562.007 Disable or Modify Cloud Firewall
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1195.002 Compromise Software Supply Chain
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1568 Dynamic Resolution
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1074.001 Local Data Staging
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1622 Debugger Evasion
action.malware.variety.Downloader Downloader (pull updates or other malware) related-to T1204 User Execution
action.malware.variety.Downloader Downloader (pull updates or other malware) related-to T1001.002 Steganography
action.malware.variety.Downloader Downloader (pull updates or other malware) related-to T1559.002 Dynamic Data Exchange
action.malware.variety.Downloader Downloader (pull updates or other malware) related-to T1027.005 Indicator Removal from Tools
action.malware.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1014 Rootkit
action.malware.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036 Masquerading
action.malware.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1068 Exploitation for Privilege Escalation
action.malware.variety.Export data Export data to another site or system related-to T1558.003 Kerberoasting
action.malware.variety.Export data Export data to another site or system related-to T1011 Exfiltration Over Other Network Medium
action.malware.variety.Export data Export data to another site or system related-to T1021.006 Windows Remote Management
action.malware.variety.Export data Export data to another site or system related-to T1020 Automated Exfiltration
action.malware.variety.Export data Export data to another site or system related-to T1055.004 Asynchronous Procedure Call
action.malware.variety.Export data Export data to another site or system related-to T1029 Scheduled Transfer
action.malware.variety.Export data Export data to another site or system related-to T1030 Data Transfer Size Limits
action.malware.variety.Export data Export data to another site or system related-to T1072 Software Deployment Tools
action.malware.variety.Export data Export data to another site or system related-to T1048 Exfiltration Over Alternative Protocol
action.malware.variety.Export data Export data to another site or system related-to T1070 Indicator Removal
action.malware.variety.Export data Export data to another site or system related-to T1552.006 Group Policy Preferences
action.malware.variety.Export data Export data to another site or system related-to T1213.005 Messaging Applications
action.malware.variety.Export data Export data to another site or system related-to T1052 Exfiltration Over Physical Medium
action.malware.variety.Export data Export data to another site or system related-to T1588.002 Tool
action.malware.variety.Export data Export data to another site or system related-to T1074 Data Staged
action.malware.variety.Export data Export data to another site or system related-to T1218.013 Mavinject
action.malware.variety.Export data Export data to another site or system related-to T1574.014 AppDomainManager
action.malware.variety.Export data Export data to another site or system related-to T1197 BITS Jobs
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1115 Clipboard Data
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1055 Process Injection
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1053.002 At
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1612 Build Image on Host
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1560.002 Archive via Library
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1036.004 Masquerade Task or Service
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1538 Cloud Service Dashboard
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1548.006 TCC Manipulation
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1059.003 Windows Command Shell
action.malware.variety.In-memory (malware never stored to persistent storage) related-to None None
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1585.001 Social Media Accounts
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1125 Video Capture
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1546.001 Change Default File Association
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1115 Clipboard Data
action.malware.variety.Modify data Malware which compromises a legitimate file rather than creating new filess related-to T1563.002 RDP Hijacking
action.malware.variety.Packet sniffer Packet sniffer (capture data from network) related-to T1007 System Service Discovery
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1003 OS Credential Dumping
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1222 File and Directory Permissions Modification
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1114 Email Collection
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1587 Develop Capabilities
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1547 Boot or Logon Autostart Execution
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1598.004 Spearphishing Voice
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1558.003 Kerberoasting
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1115 Clipboard Data
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1565.002 Transmitted Data Manipulation
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1546.017 Udev Rules
action.malware.variety.Profile host Enumerating the state of the current host related-to T1007 System Service Discovery
action.malware.variety.Profile host Enumerating the state of the current host related-to T1012 Query Registry
action.malware.variety.Profile host Enumerating the state of the current host related-to T1033 System Owner/User Discovery
action.malware.variety.Profile host Enumerating the state of the current host related-to T1082 System Information Discovery
action.malware.variety.Profile host Enumerating the state of the current host related-to T1083 File and Directory Discovery
action.malware.variety.RAM scraper RAM scraper or memory parser (capture data from volatile memory) related-to T1222 File and Directory Permissions Modification
action.malware.variety.RAM scraper RAM scraper or memory parser (capture data from volatile memory) related-to T1114 Email Collection
action.malware.variety.RAM scraper RAM scraper or memory parser (capture data from volatile memory) related-to T1547 Boot or Logon Autostart Execution
action.malware.variety.RAM scraper RAM scraper or memory parser (capture data from volatile memory) related-to T1598.004 Spearphishing Voice
action.malware.variety.Rootkit Rootkit (maintain local privileges and stealth) related-to T1014 Rootkit
action.malware.variety.Rootkit Rootkit (maintain local privileges and stealth) related-to T1195.002 Compromise Software Supply Chain
action.malware.variety.Scan network Enumerating the state of the network related-to T1016 System Network Configuration Discovery
action.malware.variety.Scan network Enumerating the state of the network related-to T1496.003 SMS Pumping
action.malware.variety.Scan network Enumerating the state of the network related-to T1018 Remote System Discovery
action.malware.variety.Scan network Enumerating the state of the network related-to T1007 System Service Discovery
action.malware.variety.Scan network Enumerating the state of the network related-to T1046 Network Service Discovery
action.malware.variety.Scan network Enumerating the state of the network related-to T1049 System Network Connections Discovery
action.malware.variety.Scan network Enumerating the state of the network related-to T1135 Network Share Discovery
action.malware.variety.Spyware/Keylogger Spyware, keylogger or form-grabber (capture user input or activity) related-to T1546.017 Udev Rules
action.malware.variety.Trojan An application which appears legitimate but hides malicious functionality. Child of 'RAT' when combined with 'Backdoor' related-to T1027.005 Indicator Removal from Tools
action.malware.variety.Unknown Unknown related-to T1140 Deobfuscate/Decode Files or Information
action.malware.variety.Worm Worm (propagate to other systems or devices) related-to T1080 Taint Shared Content
action.malware.variety.Worm Worm (propagate to other systems or devices) related-to T1091 Replication Through Removable Media
action.malware.vector.Direct install Directly installed or inserted by threat agent (after system access) related-to T1047 Windows Management Instrumentation
action.malware.vector.Email attachment Email via user-executed attachment. Child of 'Email' related-to T1036 Masquerading
action.malware.vector.Email attachment Email via user-executed attachment. Child of 'Email' related-to T1071.001 Web Protocols
action.malware.vector.Email attachment Email via user-executed attachment. Child of 'Email' related-to T1546.013 PowerShell Profile
action.malware.vector.Email attachment Email via user-executed attachment. Child of 'Email' related-to T1203 Exploitation for Client Execution
action.malware.vector.Email attachment Email via user-executed attachment. Child of 'Email' related-to T1559.002 Dynamic Data Exchange
action.malware.vector.Email link Email via embedded link. Child of 'Email' related-to T1598.004 Spearphishing Voice
action.malware.vector.Email link Email via embedded link. Child of 'Email' related-to T1001.002 Steganography
action.malware.vector.Network propagation Network propagation related-to T1021 Remote Services
action.malware.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1195 Supply Chain Compromise
action.malware.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1199 Trusted Relationship
action.malware.vector.Remote injection Remotely injected by agent (i.e. via SQLi) related-to T1133 External Remote Services
action.malware.vector.Removable media Removable storage media or devices related-to T1091 Replication Through Removable Media
action.malware.vector.Removable media Removable storage media or devices related-to T1092 Communication Through Removable Media
action.malware.vector.Software update Included in automated software update related-to T1072 Software Deployment Tools
action.malware.vector.Software update Included in automated software update related-to T1195 Supply Chain Compromise
action.malware.vector.Web application Web application. Parent of 'Web application - download' and 'Web application - drive-by. related-to T1133 External Remote Services
action.malware.vector.Web application - drive-by Web via auto-executed or "drive-by" infection. Child of 'Web application'. related-to T1176 Browser Extensions
action.malware.vector.Web application - drive-by Web via auto-executed or "drive-by" infection. Child of 'Web application'. related-to T1189 Drive-by Compromise
action.social.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1014 Rootkit
action.social.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036 Masquerading
action.social.variety.Forgery Forgery or counterfeiting (fake hardware, software, documents, etc) related-to T1562.007 Disable or Modify Cloud Firewall
action.social.variety.Phishing Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting. related-to T1562.007 Disable or Modify Cloud Firewall
action.social.variety.Phishing Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting. related-to T1204 User Execution
action.social.variety.Phishing Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting. related-to T1001.002 Steganography
action.social.variety.Phishing Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting. related-to T1559.002 Dynamic Data Exchange
action.social.variety.Phishing Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting. related-to T1027.005 Indicator Removal from Tools
action.social.variety.Pretexting Pretexting (dialogue leveraging invented scenario). Unlike 'Phishing', does not transfer data. (A fraudulent transfer or changing a bank account on a business account is not really disclosing data. related-to T1027.005 Indicator Removal from Tools
action.social.vector.Email Email related-to T1204 User Execution
action.social.vector.Email Email related-to T1001.002 Steganography
action.social.vector.Email Email related-to T1559.002 Dynamic Data Exchange
action.social.vector.Email Email related-to T1027.005 Indicator Removal from Tools
action.social.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1499.002 Service Exhaustion Flood
action.social.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1199 Trusted Relationship
action.social.vector.Removable media Removable storage media related-to T1091 Replication Through Removable Media
action.social.vector.Social media Social media or networking related-to T1204 User Execution
action.social.vector.Social media Social media or networking related-to T1001.002 Steganography
action.social.vector.Social media Social media or networking related-to T1559.002 Dynamic Data Exchange
action.social.vector.Social media Social media or networking related-to T1027.005 Indicator Removal from Tools
action.social.vector.Software Software related-to T1499.003 Application Exhaustion Flood
action.social.vector.Software Software related-to T1589.001 Credentials
action.social.vector.Web application Web application related-to T1189 Drive-by Compromise
attribute.confidentiality.data_disclosure None related-to T1003 OS Credential Dumping
attribute.confidentiality.data_disclosure None related-to T1222 File and Directory Permissions Modification
attribute.confidentiality.data_disclosure None related-to T1114 Email Collection
attribute.confidentiality.data_disclosure None related-to T1587 Develop Capabilities
attribute.confidentiality.data_disclosure None related-to T1547 Boot or Logon Autostart Execution
attribute.confidentiality.data_disclosure None related-to T1598.004 Spearphishing Voice
attribute.confidentiality.data_disclosure None related-to T1558.003 Kerberoasting
attribute.confidentiality.data_disclosure None related-to T1115 Clipboard Data
attribute.confidentiality.data_disclosure None related-to T1003.008 /etc/passwd and /etc/shadow
attribute.confidentiality.data_disclosure None related-to T1005 Data from Local System
attribute.confidentiality.data_disclosure None related-to T1011 Exfiltration Over Other Network Medium
attribute.confidentiality.data_disclosure None related-to T1011.001 Exfiltration Over Bluetooth
attribute.confidentiality.data_disclosure None related-to T1020 Automated Exfiltration
attribute.confidentiality.data_disclosure None related-to T1020.001 Traffic Duplication
attribute.confidentiality.data_disclosure None related-to T1025 Data from Removable Media
attribute.confidentiality.data_disclosure None related-to T1029 Scheduled Transfer
attribute.confidentiality.data_disclosure None related-to T1030 Data Transfer Size Limits
attribute.confidentiality.data_disclosure None related-to T1039 Data from Network Shared Drive
attribute.confidentiality.data_disclosure None related-to T1040 Network Sniffing
attribute.confidentiality.data_disclosure None related-to T1041 Exfiltration Over C2 Channel
attribute.confidentiality.data_disclosure None related-to T1048 Exfiltration Over Alternative Protocol
attribute.confidentiality.data_disclosure None related-to T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol
attribute.confidentiality.data_disclosure None related-to T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
attribute.confidentiality.data_disclosure None related-to T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
attribute.confidentiality.data_disclosure None related-to T1052 Exfiltration Over Physical Medium
attribute.confidentiality.data_disclosure None related-to T1052.001 Exfiltration over USB
attribute.confidentiality.data_disclosure None related-to T1056 Input Capture
attribute.confidentiality.data_disclosure None related-to T1056.001 Keylogging
attribute.confidentiality.data_disclosure None related-to T1056.002 GUI Input Capture
attribute.confidentiality.data_disclosure None related-to T1056.003 Web Portal Capture
attribute.confidentiality.data_disclosure None related-to T1056.004 Credential API Hooking
attribute.confidentiality.data_disclosure None related-to T1113 Screen Capture
attribute.confidentiality.data_disclosure None related-to T1114 Email Collection
attribute.confidentiality.data_disclosure None related-to T1114.001 Local Email Collection
attribute.confidentiality.data_disclosure None related-to T1114.002 Remote Email Collection
attribute.confidentiality.data_disclosure None related-to T1114.003 Email Forwarding Rule
attribute.confidentiality.data_disclosure None related-to T1115 Clipboard Data
attribute.confidentiality.data_disclosure None related-to T1119 Automated Collection
attribute.confidentiality.data_disclosure None related-to T1123 Audio Capture
attribute.confidentiality.data_disclosure None related-to T1125 Video Capture
attribute.confidentiality.data_disclosure None related-to T1187 Forced Authentication
attribute.integrity.variety.Alter behavior Influence or alter human behavior related-to T1114.003 Email Forwarding Rule
attribute.integrity.variety.Created account Created new user account related-to T1136 Create Account
attribute.integrity.variety.Created account Created new user account related-to T1136.001 Local Account
attribute.integrity.variety.Created account Created new user account related-to T1136.002 Domain Account
attribute.integrity.variety.Created account Created new user account related-to T1136.003 Cloud Account
attribute.integrity.variety.Log tampering Log tampering or modification related-to T1070.001 Clear Windows Event Logs
attribute.integrity.variety.Log tampering Log tampering or modification related-to T1070.002 Clear Linux or Mac System Logs
attribute.integrity.variety.Modify configuration Modified configuration or services related-to T1037 Boot or Logon Initialization Scripts
attribute.integrity.variety.Modify configuration Modified configuration or services related-to T1037.001 Logon Script (Windows)
attribute.integrity.variety.Modify configuration Modified configuration or services related-to T1037.002 Login Hook
attribute.integrity.variety.Modify configuration Modified configuration or services related-to T1037.003 Network Logon Script
attribute.integrity.variety.Modify configuration Modified configuration or services related-to T1037.004 RC Scripts
attribute.integrity.variety.Modify configuration Modified configuration or services related-to T1037.005 Startup Items
attribute.integrity.variety.Modify privileges Modified privileges or permissions related-to T1098 Account Manipulation
attribute.integrity.variety.Modify privileges Modified privileges or permissions related-to T1098.001 Additional Cloud Credentials
attribute.integrity.variety.Modify privileges Modified privileges or permissions related-to T1098.002 Additional Email Delegate Permissions
attribute.integrity.variety.Modify privileges Modified privileges or permissions related-to T1098.003 Additional Cloud Roles
attribute.integrity.variety.Modify privileges Modified privileges or permissions related-to T1098.004 SSH Authorized Keys
attribute.integrity.variety.Software installation Software installation or code modification related-to T1072 Software Deployment Tools
attribute.integrity.variety.Software installation Software installation or code modification related-to T1080 Taint Shared Content
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1205 Traffic Signaling
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1205 Traffic Signaling
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1218.011 Rundll32
action.malware.variety.Backdoor Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'. related-to T1205.001 Port Knocking
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1205.001 Port Knocking
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1205.001 Port Knocking
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1218.012 Verclsid
action.malware.variety.Capture app data Capture data from application or system process related-to T1207 Rogue Domain Controller
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1218.013 Mavinject
action.malware.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1211 Exploitation for Defense Evasion
action.social.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1211 Exploitation for Defense Evasion
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1218.014 MMC
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1218.015 Electron Applications
action.hacking.vector.Desktop sharing software Superset of 'Desktop sharing' and '3rd party desktop'. Please use in place of the other two related-to T1219 Remote Access Software
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1212 Exploitation for Credential Access
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1212 Exploitation for Credential Access
action.malware.vector.Web application - drive-by Web via auto-executed or "drive-by" infection. Child of 'Web application'. related-to T1212 Exploitation for Credential Access
attribute.confidentiality.data_disclosure None related-to T1212 Exploitation for Credential Access
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1220 XSL Script Processing
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1213 Data from Information Repositories
attribute.confidentiality.data_disclosure None related-to T1213 Data from Information Repositories
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1213.001 Confluence
attribute.confidentiality.data_disclosure None related-to T1213.001 Confluence
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1213.002 Sharepoint
attribute.confidentiality.data_disclosure None related-to T1213.002 Sharepoint
attribute.confidentiality.data_disclosure None related-to T1213.003 Code Repositories
attribute.confidentiality.data_disclosure None related-to T1213.004 Customer Relationship Management Software
attribute.confidentiality.data_disclosure None related-to T1213.005 Messaging Applications
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1480 Execution Guardrails
action.hacking.variety.Scan network Enumerating the state of the network related-to T1480 Execution Guardrails
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1480.001 Environmental Keying
action.hacking.variety.Scan network Enumerating the state of the network related-to T1480.001 Environmental Keying
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1480.002 Mutual Exclusion
action.hacking.variety.Disable controls Disable or interfere with security controls related-to T1489 Service Stop
action.hacking.variety.Hijack To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes) related-to T1496 Resource Hijacking
action.hacking.variety.Hijack To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes) related-to T1496.001 Compute Hijacking
action.hacking.variety.Hijack To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes) related-to T1496.002 Bandwidth Hijacking
action.hacking.variety.Hijack To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes) related-to T1496.003 SMS Pumping
action.hacking.variety.Hijack To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes) related-to T1496.004 Cloud Service Hijacking
action.hacking.vector.Hypervisor Hypervisor break-out attack related-to T1497 Virtualization/Sandbox Evasion
action.hacking.vector.Inter-tenant Penetration of another VM or web site on shared device or infrastructure related-to T1497 Virtualization/Sandbox Evasion
action.hacking.variety.DoS Denial of service related-to T1498 Network Denial of Service
action.hacking.variety.DoS Denial of service related-to T1498.001 Direct Network Flood
action.hacking.variety.DoS Denial of service related-to T1498.002 Reflection Amplification
action.hacking.variety.DoS Denial of service related-to T1499 Endpoint Denial of Service
action.hacking.variety.Soap array abuse Soap array abuse. Child of 'Exploit vuln'. related-to T1499 Endpoint Denial of Service
action.hacking.variety.XML external entities XML external entities. Child of 'Exploit vuln'. related-to T1499 Endpoint Denial of Service
action.malware.variety.Adminware System or network utilities (e.g., PsTools, Netcat) related-to T1219 Remote Access Software

Non-Mappable Capabilities

Non-mappable capabilities are either out of scope or unable to be mapped to any ATT&CK objects
Capability ID Capability Description
Action.Social.Variety.Influence Influence tactics (Leveraging authority or obligation, framing, etc)
Attribute.Availability.Variety.Acceleration Acceleration
Attribute.Integrity.Variety.Hardware tampering Hardware tampering or physical alteration
Action.Malware.Variety.Spam Send spam
Action.Hacking.Variety.CSRF Cross-site request forgery. Child of 'Exploit vuln'.
Attribute.Integrity.Variety.Other Other
Action.Malware.Variety.Other Other
Action.Hacking.Variety.SSI injection SSI injection. Child of 'Exploit vuln'.
Action.Social.Variety.Scam Online scam or hoax (e.g., scareware, 419 scam, auction fraud)
Action.Hacking.Variety.Special element injection Special element injection. Child of 'Exploit vuln'.
Action.Malware.Vector.Email other Email sub-variety known, but not one of those listed (attachment, link, autoexecute, etc). Child of 'Email'
Action.Social.Vector.Documents Documents
Action.Malware.Vector.Unknown Unknown
Action.Social.Variety.Elicitation Elicitation (subtle extraction of info through conversation)
Action.Malware.Vector.Email autoexecute Email via automatic execution. Child of 'Email'
Attribute.Availability.Variety.Other Other
Action.Hacking.Vector.Other Other
Action.Social.Vector.IM Instant messaging
Action.Social.Variety.Extortion Extortion or blackmail
Action.Social.Variety.Bribery Bribery or solicitation
Action.Hacking.Variety.URL redirector abuse URL redirector abuse. Child of 'Exploit vuln'.
Action.Hacking.Variety.Reverse engineering Reverse engineering. Child of 'Exploit vuln'.
Action.Hacking.Variety.XML entity expansion XML entity expansion. Child of 'Exploit vuln'.
Action.Hacking.Variety.XSS Cross-site scripting. Child of 'Exploit vuln'.
Action.Social.Variety.Other Other
Action.Hacking.Variety.User breakout Elevation of privilege by another customer in shared environment. Child of 'Exploit vuln'.
Action.Social.Variety.Spam Spam (unsolicited or undesired email and advertisements)
Action.Hacking.Variety.RFI Remote file inclusion. Child of 'Exploit vuln'.
Action.Social.Variety.Prompt Bombing Bombarding the user with MFA prompts to get them to accept the login request
Action.Social.Vector.Unknown Unknown
Value_chain.development.variety.NA No type of development was necessary
Action.Hacking.Variety.Soap array abuse Soap array abuse. Child of 'Exploit vuln'.
Action.Social.Vector.SMS SMS or texting
Action.Hacking.Variety.Mail command injection Mail command injection. Child of 'Exploit vuln'.
Action.Hacking.Vector.Unknown Unknown
Action.Social.Vector.Other Other
Attribute.Availability.Variety.Unknown Unknown
Attribute.Integrity.Variety.Fraudulent transaction Initiate fraudulent transaction
Action.Hacking.Variety.XML attribute blowup XML attribute blowup. Child of 'Exploit vuln'.
Action.Hacking.Variety.XQuery injection XQuery injection. Child of 'Exploit vuln'.
Action.Social.Variety.Unknown Unknown
Action.Social.Vector.In-person In-person
Action.Hacking.Variety.Other Other
Action.Social.Variety.Propaganda Propaganda or disinformation
Action.Social.Variety.Baiting Prepare malicious content in a location where a victim is likely to interact with it. (e.g. SEO - vect: websites, left usbs- vect: removable media, etc)
Action.Social.Vector.Phone Phone
Action.Malware.Vector.Other Other
Value_chain.development.variety.Email Develop an email such as for phishing.
Value_chain.development.variety.Physical Development of something physical such as a skimming device
Action.Malware.Vector.Email unknown Email but sub-variety (attachment, autoexecute, link, etc) not known. Child of 'Email'
Action.Hacking.Variety.Path traversal Path traversal. Child of 'Exploit vuln'.