1. Home
  2. Mapping Frameworks
  3. VERIS Home

VERIS MAPPINGS

The Vocabulary for Event Recording and Incident Sharing (VERIS) provides a common language for describing security incidents in a structured and repeatable manner that allows for the analysis of data across a variety of incidents. These mappings provide the context to better connect the who, what, and why captured in VERIS incident representation with the when and how described in MITRE ATT&CK® adversary behavioral tactics and techniques.

VERIS Versions: 1.4.0, 1.3.7, 1.3.5 ATT&CK Versions: 16.1, 12.1, 9.0 ATT&CK Domain: Enterprise, ICS, Mobile

VERIS Mapping Methodology

Download Mapping Artifacts:

download JSON

download YAML

download CSV

download Excel

download STIX Bundles

download Navigator Layers

SELECT VERSIONS

VERIS Version

ATT&CK Version

ATT&CK Domain

Capability Groups

ID Capability Group Name Number of Mappings Number of Capabilities
action.hacking action.hacking 478 53
action.malware action.malware 422 51
attribute.integrity attribute.integrity 88 11
attribute.confidentiality attribute.confidentiality 75 1
attribute.availability attribute.availability 42 5
action.social action.social 64 10
value_chain.development value_chain.development 23 10

All Mappings

This is a very large mapping. To reduce the size, we have only downloaded the first 500 of 1,192 mappings. Load all data (1.4 MB)

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1001 Data Obfuscation
action.hacking.variety.Other Other related-to T1001 Data Obfuscation
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1001.001 Data Obfuscation: Junk Data
action.hacking.variety.Other Other related-to T1001.001 Data Obfuscation: Junk Data
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1001.001 Data Obfuscation: Junk Data
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1001.001 Data Obfuscation: Junk Data
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1001.002 Data Obfuscation: Steganography
action.hacking.variety.Other Other related-to T1001.002 Data Obfuscation: Steganography
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1001.003 Data Obfuscation: Protocol Impersonation
action.hacking.variety.Other Other related-to T1001.003 Data Obfuscation: Protocol Impersonation
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1003 OS Credential Dumping
attribute.confidentiality.data_disclosure None related-to T1003 OS Credential Dumping
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1003.001 OS Credential Dumping: LSASS Memory
action.malware.variety.RAM scraper RAM scraper or memory parser (capture data from volatile memory) related-to T1003.001 OS Credential Dumping: LSASS Memory
attribute.confidentiality.data_disclosure None related-to T1003.001 OS Credential Dumping: LSASS Memory
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1003.002 OS Credential Dumping: Security Account Manager
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1003.002 OS Credential Dumping: Security Account Manager
action.malware.variety.RAM scraper RAM scraper or memory parser (capture data from volatile memory) related-to T1003.002 OS Credential Dumping: Security Account Manager
attribute.confidentiality.data_disclosure None related-to T1003.002 OS Credential Dumping: Security Account Manager
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1003.003 OS Credential Dumping: NTDS
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1003.003 OS Credential Dumping: NTDS
attribute.confidentiality.data_disclosure None related-to T1003.003 OS Credential Dumping: NTDS
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1003.004 OS Credential Dumping: LSA Secrets
action.malware.variety.RAM scraper RAM scraper or memory parser (capture data from volatile memory) related-to T1003.004 OS Credential Dumping: LSA Secrets
attribute.confidentiality.data_disclosure None related-to T1003.004 OS Credential Dumping: LSA Secrets
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1003.005 OS Credential Dumping: Cached Domain Credentials
action.malware.variety.RAM scraper RAM scraper or memory parser (capture data from volatile memory) related-to T1003.005 OS Credential Dumping: Cached Domain Credentials
action.malware.vector.Email link Email via embedded link. Child of 'Email' related-to T1003.005 OS Credential Dumping: Cached Domain Credentials
attribute.confidentiality.data_disclosure None related-to T1003.005 OS Credential Dumping: Cached Domain Credentials
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1003.006 OS Credential Dumping: DCSync
action.malware.variety.Export data Export data to another site or system related-to T1003.006 OS Credential Dumping: DCSync
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1003.006 OS Credential Dumping: DCSync
attribute.confidentiality.data_disclosure None related-to T1003.006 OS Credential Dumping: DCSync
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1003.007 OS Credential Dumping: Proc Filesystem
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1003.007 OS Credential Dumping: Proc Filesystem
attribute.confidentiality.data_disclosure None related-to T1003.007 OS Credential Dumping: Proc Filesystem
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1003.008 OS Credential Dumping: /etc/passwd and /etc/shadow
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1003.008 OS Credential Dumping: /etc/passwd and /etc/shadow
attribute.confidentiality.data_disclosure None related-to T1003.008 OS Credential Dumping: /etc/passwd and /etc/shadow
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1005 Data from Local System
attribute.confidentiality.data_disclosure None related-to T1005 Data from Local System
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1006 Direct Volume Access
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1007 System Service Discovery
action.malware.variety.Profile host Enumerating the state of the current host related-to T1007 System Service Discovery
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1008 Fallback Channels
action.hacking.vector.Other network service Network service that is not remote access or a web application. related-to T1008 Fallback Channels
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1008 Fallback Channels
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1008 Fallback Channels
action.hacking.variety.XPath injection XPath injection. Child of 'Exploit vuln'. related-to T1010 Application Window Discovery
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1010 Application Window Discovery
action.malware.variety.Export data Export data to another site or system related-to T1011 Exfiltration Over Other Network Medium
attribute.confidentiality.data_disclosure None related-to T1011 Exfiltration Over Other Network Medium
action.malware.variety.Export data Export data to another site or system related-to T1011.001 Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth
attribute.confidentiality.data_disclosure None related-to T1011.001 Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1012 Query Registry
action.malware.variety.Profile host Enumerating the state of the current host related-to T1012 Query Registry
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1014 Rootkit
action.malware.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1014 Rootkit
action.malware.variety.Rootkit Rootkit (maintain local privileges and stealth) related-to T1014 Rootkit
action.social.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1014 Rootkit
action.malware.variety.Scan network Enumerating the state of the network related-to T1016 System Network Configuration Discovery
action.malware.variety.Scan network Enumerating the state of the network related-to T1016.001 System Network Configuration Discovery: Internet Connection Discovery
action.malware.variety.Scan network Enumerating the state of the network related-to T1016.002 Wi-Fi Discovery
action.hacking.variety.Scan network Enumerating the state of the network related-to T1018 Remote System Discovery
action.malware.variety.Scan network Enumerating the state of the network related-to T1018 Remote System Discovery
action.malware.variety.Export data Export data to another site or system related-to T1020 Automated Exfiltration
attribute.confidentiality.data_disclosure None related-to T1020 Automated Exfiltration
action.malware.variety.Export data Export data to another site or system related-to T1020.001 Automated Exfiltration: Traffic Duplication
attribute.confidentiality.data_disclosure None related-to T1020.001 Automated Exfiltration: Traffic Duplication
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1021 Remote Services
action.malware.vector.Network propagation Network propagation related-to T1021 Remote Services
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1021.001 Remote Services: Remote Desktop Protocol
action.hacking.vector.Desktop sharing software Superset of 'Desktop sharing' and '3rd party desktop'. Please use in place of the other two related-to T1021.001 Remote Services: Remote Desktop Protocol
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1021.002 Remote Services: SMB/Windows Admin Shares
action.hacking.vector.Command shell Remote shell related-to T1021.002 Remote Services: SMB/Windows Admin Shares
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1021.003 Remote Services: Distributed Component Object Model
action.hacking.vector.Command shell Remote shell related-to T1021.003 Remote Services: Distributed Component Object Model
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1021.004 Remote Services: SSH
action.hacking.vector.Command shell Remote shell related-to T1021.004 Remote Services: SSH
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1021.005 Remote Services: VNC
action.hacking.vector.Desktop sharing software Superset of 'Desktop sharing' and '3rd party desktop'. Please use in place of the other two related-to T1021.005 Remote Services: VNC
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1021.006 Remote Services: Windows Remote Management
action.hacking.vector.Command shell Remote shell related-to T1021.006 Remote Services: Windows Remote Management
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1021.007 Cloud Services
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1021.008 Direct Cloud VM Connections
action.hacking.vector.Command shell Remote shell related-to T1021.008 Direct Cloud VM Connections
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1025 Data from Removable Media
attribute.confidentiality.data_disclosure None related-to T1025 Data from Removable Media
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027 Obfuscated Files or Information
action.hacking.variety.Null byte injection Null byte injection. Child of 'Exploit vuln'. related-to T1027 Obfuscated Files or Information
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1027 Obfuscated Files or Information
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.001 Obfuscated Files or Information: Binary Padding
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1027.001 Obfuscated Files or Information: Binary Padding
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1027.002 Obfuscated Files or Information: Software Packaging
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.003 Obfuscated Files or Information: Steganography
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1027.003 Obfuscated Files or Information: Steganography
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1027.004 Obfuscated Files or Information: Compile After Dilevery
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1027.005 Obfuscated Files or Information: Indicator Removal from Tools
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.010 Command Obfuscation
action.hacking.vector.Command shell Remote shell related-to T1027.010 Command Obfuscation
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1027.011 Fileless Storage
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.011 Fileless Storage
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1027.012 LNK Icon Smuggling
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.012 LNK Icon Smuggling
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1027.013 Encrypted/Encoded File
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.013 Encrypted/Encoded File
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.014 Polymorphic Code
action.malware.variety.Export data Export data to another site or system related-to T1029 Scheduled Transfer
attribute.confidentiality.data_disclosure None related-to T1029 Scheduled Transfer
action.malware.variety.Export data Export data to another site or system related-to T1030 Data Transfer Size Limits
attribute.confidentiality.data_disclosure None related-to T1030 Data Transfer Size Limits
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1033 System Owner/User Discovery
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1033 System Owner/User Discovery
action.malware.variety.Profile host Enumerating the state of the current host related-to T1033 System Owner/User Discovery
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036 Masquerading
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1036 Masquerading
action.malware.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036 Masquerading
action.malware.vector.Email attachment Email via user-executed attachment. Child of 'Email' related-to T1036 Masquerading
action.social.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036 Masquerading
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1036.001 Masquerading: Invalid Code Signature
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1036.002 Masquerading: Right-to-Left Override
action.social.variety.Forgery Forgery or counterfeiting (fake hardware, software, documents, etc) related-to T1036.002 Masquerading: Right-to-Left Override
action.social.variety.Phishing Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting. related-to T1036.002 Masquerading: Right-to-Left Override
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1036.003 Masquerading: Rename System Utilities
action.malware.variety.Rootkit Rootkit (maintain local privileges and stealth) related-to T1036.003 Masquerading: Rename System Utilities
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1036.004 Masquerading: Masquerade Task or Service
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1036.005 Masquerading: Match Legitimate Name or Location
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1036.006 Masquerading: Space after Filename
action.social.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036.008 Masquerade File Type
action.malware.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036.009 Break Process Trees
action.social.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036.010 Masquerade Account Name
action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1037 Boot or Logon Initialization Scripts
action.hacking.vector.Backdoor Hacking actions taken through a backdoor. C2 is only used by malware. related-to T1037 Boot or Logon Initialization Scripts
action.malware.variety.Backdoor Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'. related-to T1037 Boot or Logon Initialization Scripts
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1037 Boot or Logon Initialization Scripts
attribute.integrity.variety.Modify configuration Modified configuration or services related-to T1037 Boot or Logon Initialization Scripts
attribute.integrity.variety.Modify configuration Modified configuration or services related-to T1037.001 Boot or Logon Initialization Scripts: Logon Script (Windows)
attribute.integrity.variety.Modify configuration Modified configuration or services related-to T1037.002 Boot or Logon Initialization Scripts: Logon Script (Mac)
attribute.integrity.variety.Modify configuration Modified configuration or services related-to T1037.003 Boot or Logon Initialization Scripts: Network Logon Script
attribute.integrity.variety.Modify configuration Modified configuration or services related-to T1037.004 Boot or Logon Initialization Scripts: RC Scripts
attribute.integrity.variety.Modify configuration Modified configuration or services related-to T1037.005 Boot or Logon Initialization Scripts: Startup Items
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1039 Data from Network Shared Drive
attribute.confidentiality.data_disclosure None related-to T1039 Data from Network Shared Drive
action.hacking.variety.Scan network Enumerating the state of the network related-to T1040 Network Sniffing
action.malware.variety.Packet sniffer Packet sniffer (capture data from network) related-to T1040 Network Sniffing
action.malware.variety.Scan network Enumerating the state of the network related-to T1040 Network Sniffing
attribute.confidentiality.data_disclosure None related-to T1040 Network Sniffing
action.malware.variety.Export data Export data to another site or system related-to T1041 Exfiltration Over C2 Channels
attribute.confidentiality.data_disclosure None related-to T1041 Exfiltration Over C2 Channels
action.hacking.variety.Scan network Enumerating the state of the network related-to T1046 Network Service Discovery
action.malware.variety.Scan network Enumerating the state of the network related-to T1046 Network Service Discovery
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1047 Windows Management Instrumentation
action.hacking.vector.Command shell Remote shell related-to T1047 Windows Management Instrumentation
action.malware.vector.Direct install Directly installed or inserted by threat agent (after system access) related-to T1047 Windows Management Instrumentation
action.malware.variety.Export data Export data to another site or system related-to T1048 Exfiltration Over Alternative Protocol
attribute.confidentiality.data_disclosure None related-to T1048 Exfiltration Over Alternative Protocol
action.malware.variety.Export data Export data to another site or system related-to T1048.001 Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol
attribute.confidentiality.data_disclosure None related-to T1048.001 Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol
action.malware.variety.Export data Export data to another site or system related-to T1048.002 Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
attribute.confidentiality.data_disclosure None related-to T1048.002 Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
action.malware.variety.Export data Export data to another site or system related-to T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protcol
attribute.confidentiality.data_disclosure None related-to T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protcol
action.hacking.variety.Scan network Enumerating the state of the network related-to T1049 System Network Connections Discovery
action.malware.variety.Scan network Enumerating the state of the network related-to T1049 System Network Connections Discovery
action.malware.variety.Export data Export data to another site or system related-to T1052 Exfiltration Over Physical Medium
attribute.confidentiality.data_disclosure None related-to T1052 Exfiltration Over Physical Medium
action.malware.variety.Export data Export data to another site or system related-to T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB
attribute.confidentiality.data_disclosure None related-to T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1053 Scheduled Task/Job
action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1053 Scheduled Task/Job
action.hacking.vector.Backdoor Hacking actions taken through a backdoor. C2 is only used by malware. related-to T1053 Scheduled Task/Job
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1053.002 Scheduled Task/Job: At
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1053.003 Scheduled Task/Job: Cron
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1053.005 Scheduled Task/Job: Scheduled Task
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1053.006 Scheduled Task/Job: Systemd Timers
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1053.007 Scheduled Task/Job: Container Orchestration Job
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1055 Process Injection
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1055.001 Process Injection: Dynamic-link Library Injection
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1055.002 Process Injection: Portable Executable Injection
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1055.003 Process Injection: Thread Execution Hijacking
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1055.004 Process Injection: Asynchronous Procedure Call
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1055.005 Process Injection: Thread Local Storage
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1055.008 Process Injection: Ptrace System Calls
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1055.009 Process Injection: Proc Memory
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1055.011 Process Injection: Extra Window Memory Injection
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1055.012 Process Injection: Process Hollowing
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1055.013 Process Injection: Process Doppelganging
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1055.014 Process Injection: VDSO Hijacking
action.malware.variety.Capture app data Capture data from application or system process related-to T1056 Input Capture
attribute.confidentiality.data_disclosure None related-to T1056 Input Capture
action.malware.variety.Capture app data Capture data from application or system process related-to T1056.001 Input Capture: Keylogging
attribute.confidentiality.data_disclosure None related-to T1056.001 Input Capture: Keylogging
action.malware.variety.Capture app data Capture data from application or system process related-to T1056.002 Input Capture: GUI Input Capture
attribute.confidentiality.data_disclosure None related-to T1056.002 Input Capture: GUI Input Capture
action.hacking.vector.Web application Web application related-to T1056.003 Input Capture: Web Portal Capture
action.malware.variety.Capture app data Capture data from application or system process related-to T1056.003 Input Capture: Web Portal Capture
attribute.confidentiality.data_disclosure None related-to T1056.003 Input Capture: Web Portal Capture
action.malware.variety.Capture app data Capture data from application or system process related-to T1056.004 Input Capture: Credential API Hooking
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1056.004 Input Capture: Credential API Hooking
action.malware.variety.Spyware/Keylogger Spyware, keylogger or form-grabber (capture user input or activity) related-to T1056.004 Input Capture: Credential API Hooking
attribute.confidentiality.data_disclosure None related-to T1056.004 Input Capture: Credential API Hooking
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1057 Process Discovery
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059 Command and Scripting Interpreter
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'. related-to T1059 Command and Scripting Interpreter
action.hacking.vector.Command shell Remote shell related-to T1059 Command and Scripting Interpreter
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.001 Command and Scripting Interpreter: PowerShell
action.hacking.vector.Command shell Remote shell related-to T1059.001 Command and Scripting Interpreter: PowerShell
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.002 Command and Scripting Interpreter: AppleScript
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'. related-to T1059.002 Command and Scripting Interpreter: AppleScript
action.hacking.vector.Command shell Remote shell related-to T1059.002 Command and Scripting Interpreter: AppleScript
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.003 Command and Scripting Interpreter: Windows Command Shell
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'. related-to T1059.003 Command and Scripting Interpreter: Windows Command Shell
action.hacking.vector.Command shell Remote shell related-to T1059.003 Command and Scripting Interpreter: Windows Command Shell
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.004 Command and Scripting Interpreter: Unix Shell
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'. related-to T1059.004 Command and Scripting Interpreter: Unix Shell
action.hacking.vector.Command shell Remote shell related-to T1059.004 Command and Scripting Interpreter: Unix Shell
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.005 Command and Scripting Interpreter: Visual Basic
action.hacking.vector.Command shell Remote shell related-to T1059.005 Command and Scripting Interpreter: Visual Basic
action.malware.vector.Email attachment Email via user-executed attachment. Child of 'Email' related-to T1059.005 Command and Scripting Interpreter: Visual Basic
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.006 Command and Scripting Interpreter: Python
action.hacking.vector.Command shell Remote shell related-to T1059.006 Command and Scripting Interpreter: Python
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.007 Command and Scripting Interpreter: JavaScript
action.hacking.vector.Command shell Remote shell related-to T1059.007 Command and Scripting Interpreter: JavaScript
action.malware.vector.Email attachment Email via user-executed attachment. Child of 'Email' related-to T1059.007 Command and Scripting Interpreter: JavaScript
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.008 Command and Scripting Interpreter: Network Device CLI
action.hacking.vector.Command shell Remote shell related-to T1059.008 Command and Scripting Interpreter: Network Device CLI
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.009 Cloud API
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'. related-to T1059.009 Cloud API
action.hacking.vector.Command shell Remote shell related-to T1059.009 Cloud API
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.010 AutoHotKey & AutoIT
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'. related-to T1059.010 AutoHotKey & AutoIT
action.hacking.vector.Command shell Remote shell related-to T1059.010 AutoHotKey & AutoIT
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.011 Lua
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'. related-to T1059.011 Lua
action.hacking.vector.Command shell Remote shell related-to T1059.011 Lua
action.hacking.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.Exploit vuln Exploit vulnerability in code (vs misconfig or weakness). This can be used with other hacking enumerations, (such as XSS when an XSS vuln exists.). Parent of many hacking varieties. related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.Format string attack Format string attack. Child of 'Exploit vuln'. related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.Fuzz testing Fuzz testing. Child of 'Exploit vuln'. related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.Insecure deserialization iterating over sequential or obvious values. https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization. Child of 'Exploit vuln'. related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.Integer overflows Integer overflows. Child of 'Exploit vuln'. related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.LDAP injection LDAP injection. Child of 'Exploit vuln'. related-to T1068 Exploitation for Privilege Escalation
action.malware.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1069 Permission Groups Discovery
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1069.001 Permission Groups Discovery: Local Groups
action.malware.variety.Destroy data Destroy or corrupt stored data related-to T1070 Indicator Removal on Host
action.malware.variety.Destroy data Destroy or corrupt stored data related-to T1070.001 Indicator Removal on Host: Clear Windows Event Logs
attribute.integrity.variety.Log tampering Log tampering or modification related-to T1070.001 Indicator Removal on Host: Clear Windows Event Logs
action.malware.variety.Destroy data Destroy or corrupt stored data related-to T1070.002 Indicator Removal on Host: Clear Linux or Mac System Logs
attribute.integrity.variety.Log tampering Log tampering or modification related-to T1070.002 Indicator Removal on Host: Clear Linux or Mac System Logs
action.malware.variety.Destroy data Destroy or corrupt stored data related-to T1070.003 Indicator Removal on Host: Clear Command History
action.malware.variety.Destroy data Destroy or corrupt stored data related-to T1070.004 Indicator Removal on Host: File Deletion
action.malware.variety.Destroy data Destroy or corrupt stored data related-to T1070.005 Indicator Removal on Host: Network Share Connection Removal
action.malware.variety.Destroy data Destroy or corrupt stored data related-to T1070.006 Indicator Removal on Host: Timestomp
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1070.010 Relocate Malware
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1071 Application Layer Protocol
action.hacking.variety.Other Other related-to T1071 Application Layer Protocol
action.hacking.vector.Other network service Network service that is not remote access or a web application. related-to T1071 Application Layer Protocol
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1071 Application Layer Protocol
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1071 Application Layer Protocol
action.hacking.variety.Other Other related-to T1071.001 Application Layer Protocol: Web Protocols
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1071.001 Application Layer Protocol: Web Protocols
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1071.001 Application Layer Protocol: Web Protocols
action.hacking.variety.Other Other related-to T1071.002 Application Layer Protocol: File Transfer Protocol
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1071.002 Application Layer Protocol: File Transfer Protocol
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1071.002 Application Layer Protocol: File Transfer Protocol
action.hacking.variety.Other Other related-to T1071.003 Application Layer Protocol: Mail Protocols
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1071.003 Application Layer Protocol: Mail Protocols
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1071.003 Application Layer Protocol: Mail Protocols
action.hacking.variety.Other Other related-to T1071.004 Application Layer Protocol: DNS
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1071.004 Application Layer Protocol: DNS
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1071.004 Application Layer Protocol: DNS
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1071.005 Publish/Subscribe Protocols
action.malware.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1071.005 Publish/Subscribe Protocols
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1072 Software Deployment Tools
action.malware.variety.Adminware System or network utilities (e.g., PsTools, Netcat) related-to T1072 Software Deployment Tools
action.malware.vector.Software update Included in automated software update related-to T1072 Software Deployment Tools
attribute.integrity.variety.Software installation Software installation or code modification related-to T1072 Software Deployment Tools
action.malware.variety.Export data Export data to another site or system related-to T1074 Data Staged
action.malware.variety.Export data Export data to another site or system related-to T1074.001 Data Staged: Local Data Staging
action.malware.variety.Export data Export data to another site or system related-to T1074.002 Data Staged: Remote Data Staging
action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1078 Valid Accounts
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1078 Valid Accounts
action.hacking.vector.Backdoor Hacking actions taken through a backdoor. C2 is only used by malware. related-to T1078 Valid Accounts
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1078.001 Valid Accounts: Default Accounts
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1078.002 Valid Accounts: Domain Accounts
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1078.003 Valid Accounts: Local Accounts
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1078.004 Valid Accounts: Cloud Accounts
action.malware.variety.Other Other related-to T1080 Taint Shared Content
action.malware.variety.Worm Worm (propagate to other systems or devices) related-to T1080 Taint Shared Content
attribute.integrity.variety.Software installation Software installation or code modification related-to T1080 Taint Shared Content
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1082 System Information Discovery
action.malware.variety.Profile host Enumerating the state of the current host related-to T1082 System Information Discovery
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1083 File and Directory Discovery
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1083 File and Directory Discovery
action.malware.variety.Profile host Enumerating the state of the current host related-to T1083 File and Directory Discovery
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1087 Account Discovery
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1087.001 Account Discovery: Local Account
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1090 Proxy
action.hacking.vector.Other network service Network service that is not remote access or a web application. related-to T1090 Proxy
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1090 Proxy
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1090 Proxy
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1090.001 Proxy: Internal Proxy
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1090.001 Proxy: Internal Proxy
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1090.002 Proxy: External Proxy
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1090.002 Proxy: External Proxy
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1090.003 Proxy: Multi-hop Proxy
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1090.003 Proxy: Multi-hop Proxy
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1090.004 Proxy: Domain Fronting
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1090.004 Proxy: Domain Fronting
action.malware.variety.Worm Worm (propagate to other systems or devices) related-to T1091 Replication Through Removable Media
action.malware.vector.Removable media Removable storage media or devices related-to T1091 Replication Through Removable Media
action.social.vector.Removable media Removable storage media related-to T1091 Replication Through Removable Media
action.malware.vector.Removable media Removable storage media or devices related-to T1092 Communication Through Removable Media
action.hacking.vector.Other network service Network service that is not remote access or a web application. related-to T1095 Non-Application Layer Protocol
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1095 Non-Application Layer Protocol
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1095 Non-Application Layer Protocol
action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1098 Account Manipulation
action.hacking.vector.Backdoor Hacking actions taken through a backdoor. C2 is only used by malware. related-to T1098 Account Manipulation
action.malware.variety.Backdoor Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'. related-to T1098 Account Manipulation
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1098 Account Manipulation
attribute.integrity.variety.Modify privileges Modified privileges or permissions related-to T1098 Account Manipulation
attribute.integrity.variety.Modify privileges Modified privileges or permissions related-to T1098.001 Account Manipulation: Additional Cloud Credentials
attribute.integrity.variety.Modify privileges Modified privileges or permissions related-to T1098.002 Account Manipulation: Exchange Email Delegate Permissions
attribute.integrity.variety.Modify privileges Modified privileges or permissions related-to T1098.003 Account Manipulation: Add Office 365 Global Administrator Role
attribute.integrity.variety.Modify privileges Modified privileges or permissions related-to T1098.004 Account Manipulation: SSH Authorized Keys
action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1098.006 Additional Container Cluster Roles
attribute.integrity.variety.Modify privileges Modified privileges or permissions related-to T1098.006 Additional Container Cluster Roles
action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1098.007 Additional Local or Domain Groups
attribute.integrity.variety.Modify privileges Modified privileges or permissions related-to T1098.007 Additional Local or Domain Groups
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1102 Web Service
action.hacking.vector.Other network service Network service that is not remote access or a web application. related-to T1102 Web Service
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1102 Web Service
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1102 Web Service
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1102.001 Web Service: Dead Drop Resolver
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1102.001 Web Service: Dead Drop Resolver
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1102.002 Web Service: Bidirectional Communication
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1102.002 Web Service: Bidirectional Communication
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1102.003 Web Service: One-Way Communication
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1102.003 Web Service: One-Way Communication
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1104 Multi-Stage Channels
action.hacking.vector.Other network service Network service that is not remote access or a web application. related-to T1104 Multi-Stage Channels
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1104 Multi-Stage Channels
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1104 Multi-Stage Channels
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1105 Ingress Tool Transfer
action.hacking.variety.Other Other related-to T1105 Ingress Tool Transfer
action.hacking.vector.Other network service Network service that is not remote access or a web application. related-to T1105 Ingress Tool Transfer
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1106 Native API
action.hacking.variety.Brute force Brute force or password guessing attacks. related-to T1110 Brute Force
action.malware.variety.Brute force Brute force attack related-to T1110 Brute Force
action.hacking.variety.Brute force Brute force or password guessing attacks. related-to T1110.001 Brute Force: Password Guessing
action.malware.variety.Brute force Brute force attack related-to T1110.001 Brute Force: Password Guessing
action.hacking.variety.Brute force Brute force or password guessing attacks. related-to T1110.002 Brute Force: Password Cracking
action.hacking.variety.Offline cracking Offline password or key cracking (e.g., rainbow tables, Hashcat, JtR) related-to T1110.002 Brute Force: Password Cracking
action.malware.variety.Brute force Brute force attack related-to T1110.002 Brute Force: Password Cracking
action.hacking.variety.Brute force Brute force or password guessing attacks. related-to T1110.003 Brute Force: Password Spraying
action.malware.variety.Brute force Brute force attack related-to T1110.003 Brute Force: Password Spraying
action.hacking.variety.Brute force Brute force or password guessing attacks. related-to T1110.004 Brute Force: Credential Stuffing
action.malware.variety.Brute force Brute force attack related-to T1110.004 Brute Force: Credential Stuffing
action.hacking.variety.AiTM Adversary-in-the-middle attack. Child of 'Exploit vuln' related-to T1111 Two-Factor Authentication Interception
action.hacking.variety.Unknown Unknown related-to T1111 Two-Factor Authentication Interception
action.malware.variety.Spyware/Keylogger Spyware, keylogger or form-grabber (capture user input or activity) related-to T1111 Two-Factor Authentication Interception
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1112 Modify Registry
action.malware.variety.Capture app data Capture data from application or system process related-to T1113 Screen Capture
attribute.confidentiality.data_disclosure None related-to T1113 Screen Capture
action.malware.variety.Capture app data Capture data from application or system process related-to T1114 Email Collection
attribute.confidentiality.data_disclosure None related-to T1114 Email Collection
action.malware.variety.Capture app data Capture data from application or system process related-to T1114.001 Email Collection: Local Email Collection
attribute.confidentiality.data_disclosure None related-to T1114.001 Email Collection: Local Email Collection
action.malware.variety.Capture app data Capture data from application or system process related-to T1114.002 Email Collection: Remote Email Collection
attribute.confidentiality.data_disclosure None related-to T1114.002 Email Collection: Remote Email Collection
action.malware.variety.Capture app data Capture data from application or system process related-to T1114.003 Email Collection: Email Forwarding Rule
attribute.confidentiality.data_disclosure None related-to T1114.003 Email Collection: Email Forwarding Rule
attribute.integrity.variety.Alter behavior Influence or alter human behavior related-to T1114.003 Email Collection: Email Forwarding Rule
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1115 Clipboard Data
attribute.confidentiality.data_disclosure None related-to T1115 Clipboard Data
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1119 Automated Collection
action.hacking.variety.Scan network Enumerating the state of the network related-to T1119 Automated Collection
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1119 Automated Collection
attribute.confidentiality.data_disclosure None related-to T1119 Automated Collection
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1120 Peripheral Device Discovery
action.malware.variety.Capture app data Capture data from application or system process related-to T1123 Audio Capture
attribute.confidentiality.data_disclosure None related-to T1123 Audio Capture
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1124 System Time Discovery
action.malware.variety.Capture app data Capture data from application or system process related-to T1125 Video Capture
attribute.confidentiality.data_disclosure None related-to T1125 Video Capture
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1127 Trusted Developer Utilities Proxy Execution
action.hacking.variety.Unknown Unknown related-to T1127 Trusted Developer Utilities Proxy Execution
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1127.001 Tursted Developer Utilities Proxy Execution: MSBuild
action.hacking.variety.Other Other related-to T1127.001 Tursted Developer Utilities Proxy Execution: MSBuild
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1127.002 ClickOnce
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'. related-to T1127.002 ClickOnce
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1129 Shared Modules
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1132 Data Encoding
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1132 Data Encoding
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1132 Data Encoding
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1132.001 Data Encoding: Standard Encoding
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1132.001 Data Encoding: Standard Encoding
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1132.001 Data Encoding: Standard Encoding
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1132.002 Data Encoding: Non-Standard Encoding
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1132.002 Data Encoding: Non-Standard Encoding
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1132.002 Data Encoding: Non-Standard Encoding
action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1133 External Remote Services
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1133 External Remote Services
action.hacking.vector.3rd party desktop 3rd party online desktop sharing (LogMeIn, Go2Assist) related-to T1133 External Remote Services
action.hacking.vector.Backdoor Hacking actions taken through a backdoor. C2 is only used by malware. related-to T1133 External Remote Services
action.hacking.vector.Desktop sharing software Superset of 'Desktop sharing' and '3rd party desktop'. Please use in place of the other two related-to T1133 External Remote Services
action.hacking.vector.VPN VPN related-to T1133 External Remote Services
action.malware.variety.Backdoor Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'. related-to T1133 External Remote Services
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1133 External Remote Services
action.malware.vector.Remote injection Remotely injected by agent (i.e. via SQLi) related-to T1133 External Remote Services
action.malware.vector.Web application Web application. Parent of 'Web application - download' and 'Web application - drive-by. related-to T1133 External Remote Services
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1134 Access Token Manipulation
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1134.001 Access Token Manipulation: Token Impersonation/Theft
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1134.002 Access Token Manipulation: Create Process with Token
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1134.003 Access Token Manipulation: Make and Impersonate Token
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1134.004 Access Token Manipulation: Parent PID Spoofing
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1134.005 Access Token Manipulation: SID-History Injection
action.hacking.variety.Scan network Enumerating the state of the network related-to T1135 Network Share Discovery
action.malware.variety.Scan network Enumerating the state of the network related-to T1135 Network Share Discovery
action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1136 Create Accounts
action.hacking.vector.Backdoor Hacking actions taken through a backdoor. C2 is only used by malware. related-to T1136 Create Accounts
action.malware.variety.Modify data Malware which compromises a legitimate file rather than creating new filess related-to T1136 Create Accounts
attribute.integrity.variety.Created account Created new user account related-to T1136 Create Accounts
attribute.integrity.variety.Created account Created new user account related-to T1136.001 Create Account: Local Account
attribute.integrity.variety.Created account Created new user account related-to T1136.002 Create Account: Domain Account
attribute.integrity.variety.Created account Created new user account related-to T1136.003 Create Account: Cloud Account
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1137 Office Application Startup
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1137.001 Office Application Startup: Office Template Macros
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1137.002 Office Application Startup: Office Test
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1137.003 Office Application Startup: Outlook Forms
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1137.004 Office Application Startup: Outlook Home Page
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1137.005 Office Application Startup: Outlook Rules
action.malware.variety.Unknown Unknown related-to T1140 Deobfuscate/Decode Files or Information
action.malware.variety.Capture app data Capture data from application or system process related-to T1176 Browser Extensions
action.malware.vector.Web application - drive-by Web via auto-executed or "drive-by" infection. Child of 'Web application'. related-to T1176 Browser Extensions
action.hacking.variety.AiTM Adversary-in-the-middle attack. Child of 'Exploit vuln' related-to T1185 Browser Session Hijacking
action.hacking.variety.Hijack To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes) related-to T1185 Browser Session Hijacking
action.hacking.variety.HTTP request smuggling HTTP request smuggling. Child of 'Exploit vuln'. related-to T1185 Browser Session Hijacking
action.hacking.variety.HTTP request splitting HTTP request splitting. Child of 'Exploit vuln'. related-to T1185 Browser Session Hijacking
action.hacking.variety.HTTP response smuggling HTTP response smuggling. Child of 'Exploit vuln'. related-to T1185 Browser Session Hijacking
action.hacking.variety.HTTP response splitting HTTP response splitting. Child of 'Exploit vuln'. related-to T1185 Browser Session Hijacking
action.hacking.variety.Session fixation Session fixation. Child of 'Exploit vuln'. related-to T1185 Browser Session Hijacking
action.malware.variety.Capture app data Capture data from application or system process related-to T1185 Browser Session Hijacking
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1187 Forced Authentication
action.hacking.variety.AiTM Adversary-in-the-middle attack. Child of 'Exploit vuln' related-to T1187 Forced Authentication
attribute.confidentiality.data_disclosure None related-to T1187 Forced Authentication
action.malware.vector.Web application - drive-by Web via auto-executed or "drive-by" infection. Child of 'Web application'. related-to T1189 Drive-by Compromise
action.social.vector.Web application Web application related-to T1189 Drive-by Compromise
action.hacking.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1190 Exploit Public-Facing Application
action.hacking.variety.SQLi SQL injection. Child of 'Exploit vuln'. related-to T1190 Exploit Public-Facing Application
action.hacking.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1195 Supply Chain Compromise
action.malware.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1195 Supply Chain Compromise
action.malware.vector.Software update Included in automated software update related-to T1195 Supply Chain Compromise
action.hacking.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools
action.social.vector.Software Software related-to T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools
action.hacking.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
action.social.vector.Software Software related-to T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
action.hacking.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1195.003 Supply Chain Compromise: Compromise Hardware Supply Chain
action.social.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1195.003 Supply Chain Compromise: Compromise Hardware Supply Chain
action.malware.variety.Export data Export data to another site or system related-to T1197 BITS Jobs
action.hacking.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1199 Trusted Relationship
action.malware.variety.Adware Adware related-to T1199 Trusted Relationship
action.malware.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1199 Trusted Relationship
action.social.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1199 Trusted Relationship
action.hacking.vector.Physical access Physical access or connection (i.e., at keyboard or via cable) related-to T1200 Hardware Additions
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1201 Password Policy Discovery
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1202 Indirect Command Execution
action.hacking.variety.Buffer overflow Buffer overflow. Child of 'Exploit vuln'. related-to T1203 Exploitation for Client Execution
action.hacking.variety.HTTP request smuggling HTTP request smuggling. Child of 'Exploit vuln'. related-to T1203 Exploitation for Client Execution
action.hacking.variety.HTTP request splitting HTTP request splitting. Child of 'Exploit vuln'. related-to T1203 Exploitation for Client Execution
action.hacking.variety.HTTP response smuggling HTTP response smuggling. Child of 'Exploit vuln'. related-to T1203 Exploitation for Client Execution
action.hacking.variety.HTTP response splitting HTTP response splitting. Child of 'Exploit vuln'. related-to T1203 Exploitation for Client Execution
action.malware.variety.Client-side attack Client-side or browser attack (e.g., redirection, XSS, AitB) related-to T1203 Exploitation for Client Execution
action.malware.vector.Email attachment Email via user-executed attachment. Child of 'Email' related-to T1203 Exploitation for Client Execution
action.malware.variety.Downloader Downloader (pull updates or other malware) related-to T1204 User Execution
action.malware.variety.Other Other related-to T1204 User Execution
action.social.variety.Phishing Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting. related-to T1204 User Execution
action.social.vector.Email Email related-to T1204 User Execution
action.social.vector.Social media Social media or networking related-to T1204 User Execution
action.malware.variety.Downloader Downloader (pull updates or other malware) related-to T1204.001 User Execution: Malicious Link
action.malware.variety.Other Other related-to T1204.001 User Execution: Malicious Link
action.malware.vector.Email link Email via embedded link. Child of 'Email' related-to T1204.001 User Execution: Malicious Link
action.social.variety.Phishing Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting. related-to T1204.001 User Execution: Malicious Link
action.social.vector.Email Email related-to T1204.001 User Execution: Malicious Link
action.social.vector.Social media Social media or networking related-to T1204.001 User Execution: Malicious Link
action.malware.variety.Downloader Downloader (pull updates or other malware) related-to T1204.002 User Execution: Malicious File
action.malware.variety.Other Other related-to T1204.002 User Execution: Malicious File
action.malware.vector.Email attachment Email via user-executed attachment. Child of 'Email' related-to T1204.002 User Execution: Malicious File
action.social.variety.Phishing Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting. related-to T1204.002 User Execution: Malicious File
action.social.vector.Email Email related-to T1204.002 User Execution: Malicious File
action.social.vector.Social media Social media or networking related-to T1204.002 User Execution: Malicious File
action.malware.variety.Downloader Downloader (pull updates or other malware) related-to T1204.003 User Execution: Malicious Image
action.malware.variety.Other Other related-to T1204.003 User Execution: Malicious Image
action.malware.variety.Trojan An application which appears legitimate but hides malicious functionality. Child of 'RAT' when combined with 'Backdoor' related-to T1204.003 User Execution: Malicious Image
action.social.variety.Phishing Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting. related-to T1204.003 User Execution: Malicious Image
action.social.variety.Pretexting Pretexting (dialogue leveraging invented scenario). Unlike 'Phishing', does not transfer data. (A fraudulent transfer or changing a bank account on a business account is not really disclosing data. related-to T1204.003 User Execution: Malicious Image
action.social.vector.Email Email related-to T1204.003 User Execution: Malicious Image
action.social.vector.Social media Social media or networking related-to T1204.003 User Execution: Malicious Image
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1205 Traffic Signaling

Non-Mappable Capabilities

Non-mappable capabilities are either out of scope or unable to be mapped to any ATT&CK objects
Capability ID Capability Description
Attribute.Integrity.Variety.Other Other
Action.Hacking.Variety.Soap array abuse Soap array abuse. Child of 'Exploit vuln'.
Action.Social.Vector.Phone Phone
Action.Social.Variety.Spam Spam (unsolicited or undesired email and advertisements)
Action.Malware.Vector.Unknown Unknown
Action.Malware.Vector.Email unknown Email but sub-variety (attachment, autoexecute, link, etc) not known. Child of 'Email'
Action.Hacking.Variety.XSS Cross-site scripting. Child of 'Exploit vuln'.
Action.Malware.Variety.Other Other
Action.Social.Variety.Elicitation Elicitation (subtle extraction of info through conversation)
Action.Hacking.Variety.URL redirector abuse URL redirector abuse. Child of 'Exploit vuln'.
Action.Social.Variety.Unknown Unknown
Action.Hacking.Variety.User breakout Elevation of privilege by another customer in shared environment. Child of 'Exploit vuln'.
Action.Hacking.Variety.Special element injection Special element injection. Child of 'Exploit vuln'.
Action.Hacking.Variety.XML entity expansion XML entity expansion. Child of 'Exploit vuln'.
Action.Social.Vector.Other Other
Action.Social.Variety.Bribery Bribery or solicitation
Action.Hacking.Vector.Unknown Unknown
Action.Social.Variety.Scam Online scam or hoax (e.g., scareware, 419 scam, auction fraud)
Action.Social.Variety.Prompt Bombing Bombarding the user with MFA prompts to get them to accept the login request
Attribute.Integrity.Variety.Fraudulent transaction Initiate fraudulent transaction
Action.Hacking.Variety.Reverse engineering Reverse engineering. Child of 'Exploit vuln'.
Action.Malware.Vector.Email other Email sub-variety known, but not one of those listed (attachment, link, autoexecute, etc). Child of 'Email'
Action.Social.Vector.In-person In-person
Action.Hacking.Variety.SSI injection SSI injection. Child of 'Exploit vuln'.
Action.Hacking.Variety.Other Other
Attribute.Integrity.Variety.Hardware tampering Hardware tampering or physical alteration
Value_chain.development.variety.Email Develop an email such as for phishing.
Action.Social.Vector.Documents Documents
Action.Malware.Vector.Email autoexecute Email via automatic execution. Child of 'Email'
Action.Social.Variety.Propaganda Propaganda or disinformation
Value_chain.development.variety.NA No type of development was necessary
Action.Malware.Variety.Spam Send spam
Action.Social.Vector.Unknown Unknown
Action.Hacking.Variety.Path traversal Path traversal. Child of 'Exploit vuln'.
Attribute.Availability.Variety.Acceleration Acceleration
Action.Hacking.Variety.RFI Remote file inclusion. Child of 'Exploit vuln'.
Action.Social.Variety.Influence Influence tactics (Leveraging authority or obligation, framing, etc)
Attribute.Availability.Variety.Other Other
Action.Social.Vector.IM Instant messaging
Action.Social.Vector.SMS SMS or texting
Action.Hacking.Variety.XML attribute blowup XML attribute blowup. Child of 'Exploit vuln'.
Action.Social.Variety.Extortion Extortion or blackmail
Action.Social.Variety.Baiting Prepare malicious content in a location where a victim is likely to interact with it. (e.g. SEO - vect: websites, left usbs- vect: removable media, etc)
Action.Social.Variety.Other Other
Action.Hacking.Variety.CSRF Cross-site request forgery. Child of 'Exploit vuln'.
Action.Hacking.Variety.Mail command injection Mail command injection. Child of 'Exploit vuln'.
Value_chain.development.variety.Physical Development of something physical such as a skimming device
Attribute.Availability.Variety.Unknown Unknown
Action.Hacking.Variety.XQuery injection XQuery injection. Child of 'Exploit vuln'.
Action.Malware.Vector.Other Other
Action.Hacking.Vector.Other Other