1. Home
  2. Mapping Frameworks
  3. VERIS Home

VERIS

The Vocabulary for Event Recording and Incident Sharing (VERIS) provides a common language for describing security incidents in a structured and repeatable manner that allows for the analysis of data across a variety of incidents. These mappings provide the context to better connect the who, what, and why captured in VERIS incident representation with the when and how described in MITRE ATT&CK® adversary behavioral tactics and techniques.

VERIS Versions: 1.4.1, 1.4.0, 1.3.7, 1.3.5 ATT&CK Versions: 19.1, 16.1, 12.1, 9.0 ATT&CK Domain: Enterprise, ICS, Mobile

VERIS Mapping Methodology

Download Mapping Artifacts:

download JSON

download YAML

download CSV

download Excel

download STIX Bundles

download Navigator Layers

SELECT VERSIONS

VERIS Version

ATT&CK Version

ATT&CK Domain

Capability Groups

ID Capability Group Name Number of Mappings Number of Capabilities
action.hacking action.hacking 538 68
action.malware action.malware 405 54
attribute.integrity attribute.integrity 91 13
attribute.confidentiality attribute.confidentiality 73 1
attribute.availability attribute.availability 44 6
action.social action.social 78 23
value_chain.development value_chain.development 25 12

All Mappings

This is a very large mapping. To reduce the size, we have only downloaded the first 550 of 1,254 mappings. Load all data (1.5 MB)

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036.008 Masquerade File Type
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036.009 Break Process Trees
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036.001 Invalid Code Signature
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036.005 Match Legitimate Resource Name or Location
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036.006 Space after Filename
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036.007 Double File Extension
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036.010 Masquerade Account Name
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036 Masquerading
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036.004 Masquerade Task or Service
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036.003 Rename Legitimate Utilities
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.015 Compression
action.malware.variety.Other Other related-to T1080 Taint Shared Content
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'. related-to T1059 Command and Scripting Interpreter
action.hacking.variety.Other Other related-to T1677 Poisoned Pipeline Execution
action.hacking.variety.Disable controls Disable or interfere with security controls related-to T1489 Service Stop
action.hacking.variety.Exploit vuln Exploit vulnerability in code (vs misconfig or weakness). This can be used with other hacking enumerations, (such as XSS when an XSS vuln exists.). Parent of many hacking varieties. related-to T1687 Exploitation for Defense Impairment
action.hacking.variety.Disable controls Disable or interfere with security controls related-to T1685.003 Modify or Spoof Tool UI
action.hacking.variety.Disable controls Disable or interfere with security controls related-to T1685.005 Clear Windows Event Logs
action.social.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1684 Social Engineering
action.social.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1684.001 Impersonation
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1673 Virtual Machine Discovery
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1678 Delay Execution
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1679 Selective Exclusion
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1027.011 Fileless Storage
action.hacking.variety.Other Other related-to T1001 Data Obfuscation
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1680 Local Storage Discovery
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1564.014 Extended Attributes
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1675 ESXi Administration Command
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1578 Modify Cloud Compute Infrastructure
action.hacking.variety.DoS Denial of service related-to T1667 Email Bombing
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1569 System Services
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1564.013 Bind Mounts
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1564.014 Extended Attributes
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1564.013 Bind Mounts
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1564.012 File/Path Exclusions
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1518.001 Security Software Discovery
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1505.001 SQL Stored Procedures
action.hacking.vector.Physical access Physical access or connection (i.e., at keyboard or via cable) related-to T1200 Hardware Additions
action.malware.variety.Adminware System or network utilities (e.g., PsTools, Netcat) related-to T1219 Remote Access Tools
action.hacking.vector.Desktop sharing software Superset of 'Desktop sharing' and '3rd party desktop'. Please use in place of the other two related-to T1219 Remote Access Tools
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1213 Data from Information Repositories
action.malware.variety.Other Other related-to T1204.004 Malicious Copy and Paste
action.malware.variety.Other Other related-to T1204.001 Malicious Link
Action.Malware.Vector.Other Other related-to T1176.001 Browser Extensions
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1127.001 MSBuild
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.012 Hypervisor CLI
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.009 Cloud API
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1684.002 Email Spoofing
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036.002 Right-to-Left Override
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1036.004 Masquerade Task or Service
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1027.018 Invisible Unicode
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036.011 Overwrite Process Arguments
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.017 SVG Smuggling
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027 Obfuscated Files or Information
Action.Hacking.Variety.Soap array abuse Soap array abuse. Child of 'Exploit vuln'. related-to T1190 Exploit Public-Facing Application
Action.Hacking.Variety.Soap array abuse Soap array abuse. Child of 'Exploit vuln'. related-to T1210 Exploitation of Remote Services
Action.Hacking.Variety.Soap array abuse Soap array abuse. Child of 'Exploit vuln'. related-to T1071.001 Web Protocols
Action.Hacking.Variety.Reverse engineering Reverse engineering. Child of 'Exploit vuln'. related-to T1203 Exploitation for Client Execution
Value_chain.development.variety.Email Develop an email such as for phishing. related-to T1683.001 Written Content
Attribute.Integrity.Variety.Hardware tampering Hardware tampering or physical alteration related-to T1200 Hardware Additions
Attribute.Availability.Variety.Acceleration Acceleration related-to T1498 Network Denial of Service
Action.Hacking.Variety.Mail command injection Mail command injection. Child of 'Exploit vuln'. related-to T1566.001 Spearphishing Attachment
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1036.011 Overwrite Process Arguments
Action.Hacking.Variety.CSRF Cross-site request forgery. Child of 'Exploit vuln'. related-to T1203 Exploitation for Client Execution
Action.Hacking.Variety.Mail command injection Mail command injection. Child of 'Exploit vuln'. related-to T1566.002 Spearphishing Link
Action.Hacking.Variety.Path traversal Path traversal. Child of 'Exploit vuln'. related-to T1190 Exploit Public-Facing Application
Action.Hacking.Variety.Reverse engineering Reverse engineering. Child of 'Exploit vuln'. related-to T1190 Exploit Public-Facing Application
Action.Hacking.Variety.RFI Remote file inclusion. Child of 'Exploit vuln'. related-to T1190 Exploit Public-Facing Application
Action.Hacking.Variety.Special element injection Special element injection. Child of 'Exploit vuln'. related-to T1190 Exploit Public-Facing Application
Action.Hacking.Variety.SSI injection SSI injection. Child of 'Exploit vuln'. related-to T1190 Exploit Public-Facing Application
Action.Hacking.Variety.URL redirector abuse URL redirector abuse. Child of 'Exploit vuln'. related-to T1190 Exploit Public-Facing Application
Action.Hacking.Variety.User breakout Elevation of privilege by another customer in shared environment. Child of 'Exploit vuln'. related-to T1068 Exploitation for Privilege Escalation
Action.Hacking.Variety.XML attribute blowup XML attribute blowup. Child of 'Exploit vuln'. related-to T1499 Endpoint Denial of Service
Action.Hacking.Variety.XML entity expansion XML entity expansion. Child of 'Exploit vuln'. related-to T1499 Endpoint Denial of Service
Action.Hacking.Variety.XQuery injection XQuery injection. Child of 'Exploit vuln'. related-to T1190 Exploit Public-Facing Application
Action.Hacking.Variety.XSS Cross-site scripting. Child of 'Exploit vuln'. related-to T1190 Exploit Public-Facing Application
Action.Hacking.Vector.Other Other related-to T1669 Wi-Fi Networks
Action.Malware.Variety.Spam Send spam related-to T1566 Phishing
Action.Malware.Vector.Email autoexecute Email via automatic execution. Child of 'Email' related-to T1203 Exploitation for Client Execution
Action.Malware.Vector.Other Other related-to T1176.002 IDE Extensions
Action.Social.Variety.Baiting Prepare malicious content in a location where a victim is likely to interact with it. (e.g. SEO - vect: websites, left usbs- vect: removable media, etc) related-to T1204 User Execution
Action.Social.Variety.Bribery Bribery or solicitation related-to T1684 Social Engineering
Action.Social.Variety.Elicitation Elicitation (subtle extraction of info through conversation) related-to T1684 Social Engineering
Action.Social.Variety.Extortion Extortion or blackmail related-to T1684 Social Engineering
Action.Social.Variety.Prompt Bombing Bombarding the user with MFA prompts to get them to accept the login request related-to T1621 Multi-Factor Authentication Request Generation
Action.Social.Variety.Propaganda Propaganda or disinformation related-to T1566 Phishing
Action.Social.Variety.Scam Online scam or hoax (e.g., scareware, 419 scam, auction fraud) related-to T1203 Exploitation for Client Execution
Action.Social.Variety.Spam Spam (unsolicited or undesired email and advertisements) related-to T1566 Phishing
Action.Social.Vector.Documents Documents related-to T1203 Exploitation for Client Execution
Action.Social.Vector.IM Instant messaging related-to T1203 Exploitation for Client Execution
Action.Social.Vector.Phone Phone related-to T1598.004 Spearphishing Voice
Action.Social.Vector.SMS SMS or texting related-to T1566 Phishing
action.social.vector.Virtual meeting Video call or virtual meeting related-to T1684 Social Engineering
Attribute.Availability.Variety.Acceleration Acceleration related-to T1499 Endpoint Denial of Service
Attribute.Integrity.Variety.Fraudulent transaction Initiate fraudulent transaction related-to T1657 Financial Theft
Attribute.Integrity.Variety.Hardware tampering Hardware tampering or physical alteration related-to T1195.003 Compromise Hardware Supply Chain
Value_chain.development.variety.Physical Development of something physical such as a skimming device related-to T1200 Hardware Additions
action.malware.variety.Other Other related-to T1587.001 Malware
action.social.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1684.002 Email Spoofing
action.hacking.variety.Other Other related-to T1674 Input Injection
action.hacking.variety.Other Other related-to T1001.001 Junk Data
action.hacking.variety.Other Other related-to T1001.002 Steganography
action.hacking.variety.Other Other related-to T1001.003 Protocol or Service Impersonation
action.hacking.variety.Other Other related-to T1071 Application Layer Protocol
action.hacking.variety.Other Other related-to T1071.001 Web Protocols
action.hacking.variety.Other Other related-to T1071.002 File Transfer Protocols
action.hacking.variety.Other Other related-to T1071.003 Mail Protocols
action.hacking.variety.Other Other related-to T1071.004 DNS
action.hacking.variety.Other Other related-to T1105 Ingress Tool Transfer
action.hacking.variety.Other Other related-to T1127.001 MSBuild
action.malware.variety.Other Other related-to T1204 User Execution
action.malware.variety.Other Other related-to T1204.005 Malicious Library
action.malware.variety.Other Other related-to T1204.002 Malicious File
action.malware.variety.Other Other related-to T1204.003 Malicious Image
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1671 Cloud Application Integration
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1027.012 LNK Icon Smuggling
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1027.013 Encrypted/Encoded File
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.013 Container CLI/API
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.010 AutoHotKey & AutoIT
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.011 Lua
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1127.002 ClickOnce
action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1098.006 Additional Container Cluster Roles
action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1098.007 Additional Local or Domain Groups
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.016 Junk Code Insertion
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.001 Binary Padding
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.002 Software Packing
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.003 Steganography
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.004 Compile After Delivery
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.010 Command Obfuscation
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.011 Fileless Storage
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.012 LNK Icon Smuggling
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.013 Encrypted/Encoded File
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.014 Polymorphic Code
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1070.010 Relocate Malware
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1132.002 Non-Standard Encoding
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'. related-to T1059.009 Cloud API
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'. related-to T1059.010 AutoHotKey & AutoIT
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'. related-to T1059.011 Lua
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'. related-to T1127.002 ClickOnce
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1021.007 Cloud Services
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1021.008 Direct Cloud VM Connections
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1134.003 Make and Impersonate Token
action.hacking.vector.Command shell Remote shell related-to T1021.008 Direct Cloud VM Connections
action.hacking.vector.Command shell Remote shell related-to T1027.010 Command Obfuscation
action.hacking.vector.Command shell Remote shell related-to T1059.009 Cloud API
action.hacking.vector.Command shell Remote shell related-to T1059.010 AutoHotKey & AutoIT
action.hacking.vector.Command shell Remote shell related-to T1059.011 Lua
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1071.005 Publish/Subscribe Protocols
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1016.002 Wi-Fi Discovery
action.malware.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036.009 Break Process Trees
action.malware.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1071.005 Publish/Subscribe Protocols
action.malware.variety.Scan network Enumerating the state of the network related-to T1016.002 Wi-Fi Discovery
action.malware.variety.Spyware/Keylogger Spyware, keylogger or form-grabber (capture user input or activity) related-to T1111 Multi-Factor Authentication Interception
action.social.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036.008 Masquerade File Type
action.social.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036.010 Masquerade Account Name
attribute.integrity.variety.Modify privileges Modified privileges or permissions related-to T1098.006 Additional Container Cluster Roles
attribute.integrity.variety.Modify privileges Modified privileges or permissions related-to T1098.007 Additional Local or Domain Groups
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1047 Windows Management Instrumentation
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1053 Scheduled Task/Job
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1053.002 At
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1053.003 Cron
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1053.005 Scheduled Task
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1053.006 Systemd Timers
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1053.007 Container Orchestration Job
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059 Command and Scripting Interpreter
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.001 PowerShell
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.002 AppleScript
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.003 Windows Command Shell
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.004 Unix Shell
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.005 Visual Basic
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.006 Python
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.007 JavaScript
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1059.008 Network Device CLI
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1072 Software Deployment Tools
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1105 Ingress Tool Transfer
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1106 Native API
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1112 Modify Registry
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1127 Trusted Developer Utilities Proxy Execution
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1127.003 JamPlus
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1129 Shared Modules
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1137 Office Application Startup
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1137.001 Office Template Macros
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1137.002 Office Test
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1137.003 Outlook Forms
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1137.004 Outlook Home Page
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1137.005 Outlook Rules
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1187 Forced Authentication
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1202 Indirect Command Execution
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1216 System Script Proxy Execution
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1216.001 PubPrn
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1216.002 SyncAppvPublishingServer
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1218 System Binary Proxy Execution
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1218.001 Compiled HTML File
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1218.002 Control Panel
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1218.003 CMSTP
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1218.004 InstallUtil
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1218.005 Mshta
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1218.007 Msiexec
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1218.008 Odbcconf
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1218.009 Regsvcs/Regasm
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1218.010 Regsvr32
action.hacking.variety.AiTM Adversary-in-the-middle attack. Child of 'Exploit vuln' related-to T1111 Multi-Factor Authentication Interception
action.hacking.variety.AiTM Adversary-in-the-middle attack. Child of 'Exploit vuln' related-to T1185 Browser Session Hijacking
action.hacking.variety.AiTM Adversary-in-the-middle attack. Child of 'Exploit vuln' related-to T1187 Forced Authentication
action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1037 Boot or Logon Initialization Scripts
action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1053 Scheduled Task/Job
action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1078 Valid Accounts
action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1098 Account Manipulation
action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1133 External Remote Services
action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1563.002 RDP Hijacking
action.hacking.variety.Brute force Brute force or password guessing attacks. related-to T1110 Brute Force
action.hacking.variety.Brute force Brute force or password guessing attacks. related-to T1222.002 Linux and Mac Permissions
action.hacking.variety.Brute force Brute force or password guessing attacks. related-to T1565.001 Stored Data Manipulation
action.hacking.variety.Brute force Brute force or password guessing attacks. related-to T1021.003 Distributed Component Object Model
action.hacking.variety.Buffer overflow Buffer overflow. Child of 'Exploit vuln'. related-to T1203 Exploitation for Client Execution
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1001 Data Obfuscation
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1102.001 Dead Drop Resolver
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1602.001 SNMP (MIB Dump)
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1584.002 DNS Server
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1008 Fallback Channels
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036.012 Browser Fingerprint
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1071 Application Layer Protocol
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1090 Proxy
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1102 Web Service
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1104 Multi-Stage Channels
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1132 Data Encoding
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1583.007 Serverless
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1205 Traffic Signaling
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1021.007 Cloud Services
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1053.005 Scheduled Task
action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1211 Exploitation for Stealth
action.hacking.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1190 Exploit Public-Facing Application
action.hacking.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1212 Exploitation for Credential Access
action.hacking.variety.Exploit vuln Exploit vulnerability in code (vs misconfig or weakness). This can be used with other hacking enumerations, (such as XSS when an XSS vuln exists.). Parent of many hacking varieties. related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.Exploit vuln Exploit vulnerability in code (vs misconfig or weakness). This can be used with other hacking enumerations, (such as XSS when an XSS vuln exists.). Parent of many hacking varieties. related-to T1212 Exploitation for Credential Access
action.hacking.variety.Format string attack Format string attack. Child of 'Exploit vuln'. related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.Fuzz testing Fuzz testing. Child of 'Exploit vuln'. related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.Hijack To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes) related-to T1185 Browser Session Hijacking
action.hacking.variety.HTTP request smuggling HTTP request smuggling. Child of 'Exploit vuln'. related-to T1185 Browser Session Hijacking
action.hacking.variety.HTTP request smuggling HTTP request smuggling. Child of 'Exploit vuln'. related-to T1203 Exploitation for Client Execution
action.hacking.variety.HTTP request splitting HTTP request splitting. Child of 'Exploit vuln'. related-to T1185 Browser Session Hijacking
action.hacking.variety.HTTP request splitting HTTP request splitting. Child of 'Exploit vuln'. related-to T1203 Exploitation for Client Execution
action.hacking.variety.HTTP response smuggling HTTP response smuggling. Child of 'Exploit vuln'. related-to T1185 Browser Session Hijacking
action.hacking.variety.HTTP response smuggling HTTP response smuggling. Child of 'Exploit vuln'. related-to T1203 Exploitation for Client Execution
action.hacking.variety.HTTP response splitting HTTP response splitting. Child of 'Exploit vuln'. related-to T1185 Browser Session Hijacking
action.hacking.variety.HTTP response splitting HTTP response splitting. Child of 'Exploit vuln'. related-to T1203 Exploitation for Client Execution
action.hacking.variety.Insecure deserialization iterating over sequential or obvious values. https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization. Child of 'Exploit vuln'. related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.Integer overflows Integer overflows. Child of 'Exploit vuln'. related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.LDAP injection LDAP injection. Child of 'Exploit vuln'. related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.Null byte injection Null byte injection. Child of 'Exploit vuln'. related-to T1027 Obfuscated Files or Information
action.hacking.variety.Offline cracking Offline password or key cracking (e.g., rainbow tables, Hashcat, JtR) related-to T1565.001 Stored Data Manipulation
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'. related-to T1690 Prevent Command History Logging
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'. related-to T1505.005 Terminal Services DLL
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'. related-to T1569 System Services
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'. related-to T1110 Brute Force
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1007 System Service Discovery
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1012 Query Registry
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1033 System Owner/User Discovery
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1057 Process Discovery
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1069 Permission Groups Discovery
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1136.003 Cloud Account
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1082 System Information Discovery
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1083 File and Directory Discovery
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1087 Account Discovery
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1573.001 Symmetric Cryptography
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1119 Automated Collection
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1120 Peripheral Device Discovery
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1124 System Time Discovery
action.hacking.variety.Profile host Enumerating the state of the current host related-to T1201 Password Policy Discovery
action.hacking.variety.Scan network Enumerating the state of the network related-to T1018 Remote System Discovery
action.hacking.variety.Scan network Enumerating the state of the network related-to T1007 System Service Discovery
action.hacking.variety.Scan network Enumerating the state of the network related-to T1046 Network Service Discovery
action.hacking.variety.Scan network Enumerating the state of the network related-to T1049 System Network Connections Discovery
action.hacking.variety.Scan network Enumerating the state of the network related-to T1119 Automated Collection
action.hacking.variety.Scan network Enumerating the state of the network related-to T1135 Network Share Discovery
action.hacking.variety.Session fixation Session fixation. Child of 'Exploit vuln'. related-to T1185 Browser Session Hijacking
action.hacking.variety.Session fixation Session fixation. Child of 'Exploit vuln'. related-to T1212 Exploitation for Credential Access
action.hacking.variety.SQLi SQL injection. Child of 'Exploit vuln'. related-to T1190 Exploit Public-Facing Application
action.hacking.variety.Unknown Unknown related-to T1134 Access Token Manipulation
action.hacking.variety.Unknown Unknown related-to T1127 Trusted Developer Utilities Proxy Execution
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1021 Remote Services
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1027.007 Dynamic API Resolution
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1029 Scheduled Transfer
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1547.004 Winlogon Helper DLL
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1598.003 Spearphishing Link
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1560.001 Archive via Utility
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1583.004 Server
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1078 Valid Accounts
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1011.001 Exfiltration Over Bluetooth
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1550.004 Web Session Cookie
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1601.002 Downgrade System Image
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1569.002 Service Execution
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1133 External Remote Services
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1134 Access Token Manipulation
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1654 Log Enumeration
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1548 Abuse Elevation Control Mechanism
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1041 Exfiltration Over C2 Channel
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1187 Forced Authentication
action.hacking.variety.XML external entities XML external entities. Child of 'Exploit vuln'. related-to T1558.002 Silver Ticket
action.hacking.variety.XPath injection XPath injection. Child of 'Exploit vuln'. related-to T1010 Application Window Discovery
action.hacking.vector.3rd party desktop 3rd party online desktop sharing (LogMeIn, Go2Assist) related-to T1133 External Remote Services
action.hacking.vector.Backdoor Hacking actions taken through a backdoor. C2 is only used by malware. related-to T1037 Boot or Logon Initialization Scripts
action.hacking.vector.Backdoor Hacking actions taken through a backdoor. C2 is only used by malware. related-to T1053 Scheduled Task/Job
action.hacking.vector.Backdoor Hacking actions taken through a backdoor. C2 is only used by malware. related-to T1078 Valid Accounts
action.hacking.vector.Backdoor Hacking actions taken through a backdoor. C2 is only used by malware. related-to T1098 Account Manipulation
action.hacking.vector.Backdoor Hacking actions taken through a backdoor. C2 is only used by malware. related-to T1133 External Remote Services
action.hacking.vector.Backdoor Hacking actions taken through a backdoor. C2 is only used by malware. related-to T1563.002 RDP Hijacking
action.hacking.vector.Command shell Remote shell related-to T1029 Scheduled Transfer
action.hacking.vector.Command shell Remote shell related-to T1547.004 Winlogon Helper DLL
action.hacking.vector.Command shell Remote shell related-to T1598.003 Spearphishing Link
action.hacking.vector.Command shell Remote shell related-to T1583.004 Server
action.hacking.vector.Command shell Remote shell related-to T1047 Windows Management Instrumentation
action.hacking.vector.Command shell Remote shell related-to T1059 Command and Scripting Interpreter
action.hacking.vector.Command shell Remote shell related-to T1552.008 Chat Messages
action.hacking.vector.Command shell Remote shell related-to T1505.005 Terminal Services DLL
action.hacking.vector.Command shell Remote shell related-to T1569 System Services
action.hacking.vector.Command shell Remote shell related-to T1110 Brute Force
action.hacking.vector.Command shell Remote shell related-to T1071.001 Web Protocols
action.hacking.vector.Command shell Remote shell related-to T1127.002 ClickOnce
action.hacking.vector.Command shell Remote shell related-to T1546.013 PowerShell Profile
action.hacking.vector.Command shell Remote shell related-to T1584.005 Botnet
action.hacking.vector.Desktop sharing software Superset of 'Desktop sharing' and '3rd party desktop'. Please use in place of the other two related-to T1027.007 Dynamic API Resolution
action.hacking.vector.Desktop sharing software Superset of 'Desktop sharing' and '3rd party desktop'. Please use in place of the other two related-to T1560.001 Archive via Utility
action.hacking.vector.Desktop sharing software Superset of 'Desktop sharing' and '3rd party desktop'. Please use in place of the other two related-to T1133 External Remote Services
action.hacking.vector.Other network service Network service that is not remote access or a web application. related-to T1008 Fallback Channels
action.hacking.vector.Other network service Network service that is not remote access or a web application. related-to T1071 Application Layer Protocol
action.hacking.vector.Other network service Network service that is not remote access or a web application. related-to T1090 Proxy
action.hacking.vector.Other network service Network service that is not remote access or a web application. related-to T1095 Non-Application Layer Protocol
action.hacking.vector.Other network service Network service that is not remote access or a web application. related-to T1102 Web Service
action.hacking.vector.Other network service Network service that is not remote access or a web application. related-to T1104 Multi-Stage Channels
action.hacking.vector.Other network service Network service that is not remote access or a web application. related-to T1105 Ingress Tool Transfer
action.hacking.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1195 Supply Chain Compromise
action.hacking.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1499.003 Application Exhaustion Flood
action.hacking.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1589.001 Credentials
action.hacking.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1499.002 Service Exhaustion Flood
action.hacking.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1199 Trusted Relationship
action.hacking.vector.Physical access Physical access or connection (i.e., at keyboard or via cable) related-to T1219.003 Remote Access Hardware
action.hacking.vector.VPN VPN related-to T1133 External Remote Services
action.hacking.vector.Web application Web application related-to T1090.002 External Proxy
action.malware.variety.Adminware System or network utilities (e.g., PsTools, Netcat) related-to T1072 Software Deployment Tools
action.malware.variety.Adware Adware related-to T1199 Trusted Relationship
action.malware.variety.Backdoor Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'. related-to T1037 Boot or Logon Initialization Scripts
action.malware.variety.Backdoor Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'. related-to T1098 Account Manipulation
action.malware.variety.Backdoor Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'. related-to T1133 External Remote Services
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1008 Fallback Channels
action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1098 Account Manipulation
action.malware.variety.Brute force Brute force attack related-to T1110 Brute Force
action.malware.variety.Brute force Brute force attack related-to T1222.002 Linux and Mac Permissions
action.malware.variety.Brute force Brute force attack related-to T1565.001 Stored Data Manipulation
action.malware.variety.Brute force Brute force attack related-to T1021.003 Distributed Component Object Model
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1102.001 Dead Drop Resolver
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1008 Fallback Channels
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1071 Application Layer Protocol
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1584.007 Serverless
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1055.014 VDSO Hijacking
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1021 Remote Services
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1561 Disk Wipe
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1090 Proxy
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1566.003 Spearphishing via Service
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1070.005 Network Share Connection Removal
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1578.005 Modify Cloud Compute Configurations
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1095 Non-Application Layer Protocol
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1102 Web Service
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1216 System Script Proxy Execution
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1036.003 Rename Legitimate Utilities
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1546.014 Emond
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1104 Multi-Stage Channels
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1132 Data Encoding
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1583.007 Serverless
action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1485 Data Destruction
action.malware.variety.Capture app data Capture data from application or system process related-to T1056 Input Capture
action.malware.variety.Capture app data Capture data from application or system process related-to T1596.003 Digital Certificates
action.malware.variety.Capture app data Capture data from application or system process related-to T1547.006 Kernel Modules and Extensions
action.malware.variety.Capture app data Capture data from application or system process related-to T1090.002 External Proxy
action.malware.variety.Capture app data Capture data from application or system process related-to T1546.017 Udev Rules
action.malware.variety.Capture app data Capture data from application or system process related-to T1113 Screen Capture
action.malware.variety.Capture app data Capture data from application or system process related-to T1114 Email Collection
action.malware.variety.Capture app data Capture data from application or system process related-to T1110.002 Password Cracking
action.malware.variety.Capture app data Capture data from application or system process related-to T1556.006 Multi-Factor Authentication
action.malware.variety.Capture app data Capture data from application or system process related-to T1546.009 AppCert DLLs
action.malware.variety.Capture app data Capture data from application or system process related-to T1123 Audio Capture
action.malware.variety.Capture app data Capture data from application or system process related-to T1125 Video Capture
action.malware.variety.Capture app data Capture data from application or system process related-to T1176 Software Extensions
action.malware.variety.Capture app data Capture data from application or system process related-to T1185 Browser Session Hijacking
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1114 Email Collection
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1587 Develop Capabilities
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1558.003 Kerberoasting
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1565.002 Transmitted Data Manipulation
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1005 Data from Local System
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1010 Application Window Discovery
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1025 Data from Removable Media
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1033 System Owner/User Discovery
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1039 Data from Network Shared Drive
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1083 File and Directory Discovery
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1119 Automated Collection
action.malware.variety.Client-side attack Client-side or browser attack (e.g., redirection, XSS, AitB) related-to T1203 Exploitation for Client Execution
action.malware.variety.Destroy data Destroy or corrupt stored data related-to T1542.002 Component Firmware
action.malware.variety.Destroy data Destroy or corrupt stored data related-to T1092 Communication Through Removable Media
action.malware.variety.Destroy data Destroy or corrupt stored data related-to T1566.002 Spearphishing Link
action.malware.variety.Destroy data Destroy or corrupt stored data related-to T1600.001 Reduce Key Space
action.malware.variety.Destroy data Destroy or corrupt stored data related-to T1027.010 Command Obfuscation
action.malware.variety.Destroy data Destroy or corrupt stored data related-to T1496.001 Compute Hijacking
action.malware.variety.Destroy data Destroy or corrupt stored data related-to T1218 System Binary Proxy Execution
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1006 Direct Volume Access
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1027 Obfuscated Files or Information
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1563 Remote Service Session Hijacking
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1111 Multi-Factor Authentication Interception
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1095 Non-Application Layer Protocol
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1499 Endpoint Denial of Service
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1059.011 Lua
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1036 Masquerading
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1505.004 IIS Components
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1195.002 Compromise Software Supply Chain
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1568 Dynamic Resolution
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1074.001 Local Data Staging
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1622 Debugger Evasion
action.malware.variety.Downloader Downloader (pull updates or other malware) related-to T1204 User Execution
action.malware.variety.Downloader Downloader (pull updates or other malware) related-to T1001.002 Steganography
action.malware.variety.Downloader Downloader (pull updates or other malware) related-to T1559.002 Dynamic Data Exchange
action.malware.variety.Downloader Downloader (pull updates or other malware) related-to T1027.005 Indicator Removal from Tools
action.malware.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1014 Rootkit
action.malware.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036 Masquerading
action.malware.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1068 Exploitation for Privilege Escalation
action.malware.variety.Export data Export data to another site or system related-to T1558.003 Kerberoasting
action.malware.variety.Export data Export data to another site or system related-to T1011 Exfiltration Over Other Network Medium
action.malware.variety.Export data Export data to another site or system related-to T1021.006 Windows Remote Management
action.malware.variety.Export data Export data to another site or system related-to T1020 Automated Exfiltration
action.malware.variety.Export data Export data to another site or system related-to T1055.004 Asynchronous Procedure Call
action.malware.variety.Export data Export data to another site or system related-to T1029 Scheduled Transfer
action.malware.variety.Export data Export data to another site or system related-to T1030 Data Transfer Size Limits
action.malware.variety.Export data Export data to another site or system related-to T1072 Software Deployment Tools
action.malware.variety.Export data Export data to another site or system related-to T1048 Exfiltration Over Alternative Protocol
action.malware.variety.Export data Export data to another site or system related-to T1070 Indicator Removal
action.malware.variety.Export data Export data to another site or system related-to T1552.006 Group Policy Preferences
action.malware.variety.Export data Export data to another site or system related-to T1213.005 Messaging Applications
action.malware.variety.Export data Export data to another site or system related-to T1052 Exfiltration Over Physical Medium
action.malware.variety.Export data Export data to another site or system related-to T1074 Data Staged
action.malware.variety.Export data Export data to another site or system related-to T1218.013 Mavinject
action.malware.variety.Export data Export data to another site or system related-to T1574.014 AppDomainManager
action.malware.variety.Export data Export data to another site or system related-to T1197 BITS Jobs
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1115 Clipboard Data
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1055 Process Injection
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1053.002 At
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1612 Build Image on Host
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1560.002 Archive via Library
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1538 Cloud Service Dashboard
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1548.006 TCC Manipulation
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1059.003 Windows Command Shell
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1585.001 Social Media Accounts
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1125 Video Capture
action.malware.variety.In-memory (malware never stored to persistent storage) related-to T1546.001 Change Default File Association
action.malware.variety.Modify data Malware which compromises a legitimate file rather than creating new filess related-to T1563.002 RDP Hijacking
action.malware.variety.Packet sniffer Packet sniffer (capture data from network) related-to T1007 System Service Discovery
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1003 OS Credential Dumping
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1222 File and Directory Permissions Modification
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1114 Email Collection
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1587 Develop Capabilities
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1547 Boot or Logon Autostart Execution
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1598.004 Spearphishing Voice
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1558.003 Kerberoasting
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1115 Clipboard Data
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1565.002 Transmitted Data Manipulation
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1546.017 Udev Rules
action.malware.variety.Profile host Enumerating the state of the current host related-to T1007 System Service Discovery
action.malware.variety.Profile host Enumerating the state of the current host related-to T1012 Query Registry
action.malware.variety.Profile host Enumerating the state of the current host related-to T1033 System Owner/User Discovery
action.malware.variety.Profile host Enumerating the state of the current host related-to T1082 System Information Discovery
action.malware.variety.Profile host Enumerating the state of the current host related-to T1083 File and Directory Discovery
action.malware.variety.RAM scraper RAM scraper or memory parser (capture data from volatile memory) related-to T1222 File and Directory Permissions Modification
action.malware.variety.RAM scraper RAM scraper or memory parser (capture data from volatile memory) related-to T1114 Email Collection
action.malware.variety.RAM scraper RAM scraper or memory parser (capture data from volatile memory) related-to T1547 Boot or Logon Autostart Execution
action.malware.variety.RAM scraper RAM scraper or memory parser (capture data from volatile memory) related-to T1598.004 Spearphishing Voice
action.malware.variety.Rootkit Rootkit (maintain local privileges and stealth) related-to T1014 Rootkit
action.malware.variety.Rootkit Rootkit (maintain local privileges and stealth) related-to T1195.002 Compromise Software Supply Chain
action.malware.variety.Scan network Enumerating the state of the network related-to T1016 System Network Configuration Discovery
action.malware.variety.Scan network Enumerating the state of the network related-to T1496.003 SMS Pumping
action.malware.variety.Scan network Enumerating the state of the network related-to T1018 Remote System Discovery
action.malware.variety.Scan network Enumerating the state of the network related-to T1007 System Service Discovery
action.malware.variety.Scan network Enumerating the state of the network related-to T1046 Network Service Discovery
action.malware.variety.Scan network Enumerating the state of the network related-to T1049 System Network Connections Discovery
action.malware.variety.Scan network Enumerating the state of the network related-to T1135 Network Share Discovery
action.malware.variety.Spyware/Keylogger Spyware, keylogger or form-grabber (capture user input or activity) related-to T1546.017 Udev Rules
action.malware.variety.Trojan An application which appears legitimate but hides malicious functionality. Child of 'RAT' when combined with 'Backdoor' related-to T1027.005 Indicator Removal from Tools
action.malware.variety.Unknown Unknown related-to T1140 Deobfuscate/Decode Files or Information
action.malware.variety.Worm Worm (propagate to other systems or devices) related-to T1080 Taint Shared Content
action.malware.variety.Worm Worm (propagate to other systems or devices) related-to T1091 Replication Through Removable Media
action.malware.vector.Direct install Directly installed or inserted by threat agent (after system access) related-to T1047 Windows Management Instrumentation
action.malware.vector.Email attachment Email via user-executed attachment. Child of 'Email' related-to T1036 Masquerading
action.malware.vector.Email attachment Email via user-executed attachment. Child of 'Email' related-to T1071.001 Web Protocols
action.malware.vector.Email attachment Email via user-executed attachment. Child of 'Email' related-to T1546.013 PowerShell Profile
action.malware.vector.Email attachment Email via user-executed attachment. Child of 'Email' related-to T1203 Exploitation for Client Execution
action.malware.vector.Email attachment Email via user-executed attachment. Child of 'Email' related-to T1559.002 Dynamic Data Exchange
action.malware.vector.Email link Email via embedded link. Child of 'Email' related-to T1598.004 Spearphishing Voice
action.malware.vector.Email link Email via embedded link. Child of 'Email' related-to T1001.002 Steganography
action.malware.vector.Network propagation Network propagation related-to T1021 Remote Services
action.malware.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1195 Supply Chain Compromise
action.malware.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1199 Trusted Relationship
action.malware.vector.Remote injection Remotely injected by agent (i.e. via SQLi) related-to T1133 External Remote Services
action.malware.vector.Removable media Removable storage media or devices related-to T1091 Replication Through Removable Media
action.malware.vector.Removable media Removable storage media or devices related-to T1092 Communication Through Removable Media
action.malware.vector.Software update Included in automated software update related-to T1072 Software Deployment Tools
action.malware.vector.Software update Included in automated software update related-to T1195 Supply Chain Compromise
action.malware.vector.Web application Web application. Parent of 'Web application - download' and 'Web application - drive-by. related-to T1133 External Remote Services
action.malware.vector.Web application - drive-by Web via auto-executed or "drive-by" infection. Child of 'Web application'. related-to T1176 Software Extensions
action.malware.vector.Web application - drive-by Web via auto-executed or "drive-by" infection. Child of 'Web application'. related-to T1189 Drive-by Compromise
action.social.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036 Masquerading
action.social.variety.Forgery Forgery or counterfeiting (fake hardware, software, documents, etc) related-to T1686.001 Cloud Firewall
action.social.variety.Phishing Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting. related-to T1686.001 Cloud Firewall
action.social.variety.Phishing Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting. related-to T1204 User Execution
action.social.variety.Phishing Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting. related-to T1001.002 Steganography
action.social.variety.Phishing Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting. related-to T1559.002 Dynamic Data Exchange
action.social.variety.Phishing Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting. related-to T1027.005 Indicator Removal from Tools
action.social.variety.Pretexting Pretexting (dialogue leveraging invented scenario). Unlike 'Phishing', does not transfer data. (A fraudulent transfer or changing a bank account on a business account is not really disclosing data. related-to T1027.005 Indicator Removal from Tools
action.social.vector.Email Email related-to T1204 User Execution
action.social.vector.Email Email related-to T1001.002 Steganography
action.social.vector.Email Email related-to T1559.002 Dynamic Data Exchange
action.social.vector.Email Email related-to T1027.005 Indicator Removal from Tools
action.social.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1499.002 Service Exhaustion Flood
action.social.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1199 Trusted Relationship
action.social.vector.Removable media Removable storage media related-to T1091 Replication Through Removable Media
action.social.vector.Social media Social media or networking related-to T1204 User Execution
action.social.vector.Social media Social media or networking related-to T1001.002 Steganography
action.social.vector.Social media Social media or networking related-to T1559.002 Dynamic Data Exchange
action.social.vector.Social media Social media or networking related-to T1027.005 Indicator Removal from Tools
action.social.vector.Software Software related-to T1499.003 Application Exhaustion Flood
action.social.vector.Software Software related-to T1589.001 Credentials
action.social.vector.Web application Web application related-to T1189 Drive-by Compromise
attribute.confidentiality.data_disclosure Confirmed or potential data disclosure related-to T1003 OS Credential Dumping
attribute.confidentiality.data_disclosure Confirmed or potential data disclosure related-to T1222 File and Directory Permissions Modification
attribute.confidentiality.data_disclosure Confirmed or potential data disclosure related-to T1587 Develop Capabilities
attribute.confidentiality.data_disclosure Confirmed or potential data disclosure related-to T1547 Boot or Logon Autostart Execution
attribute.confidentiality.data_disclosure Confirmed or potential data disclosure related-to T1598.004 Spearphishing Voice
attribute.confidentiality.data_disclosure Confirmed or potential data disclosure related-to T1558.003 Kerberoasting
attribute.confidentiality.data_disclosure Confirmed or potential data disclosure related-to T1003.008 /etc/passwd and /etc/shadow
attribute.confidentiality.data_disclosure Confirmed or potential data disclosure related-to T1005 Data from Local System
attribute.confidentiality.data_disclosure Confirmed or potential data disclosure related-to T1011 Exfiltration Over Other Network Medium
attribute.confidentiality.data_disclosure Confirmed or potential data disclosure related-to T1011.001 Exfiltration Over Bluetooth
attribute.confidentiality.data_disclosure Confirmed or potential data disclosure related-to T1020 Automated Exfiltration
attribute.confidentiality.data_disclosure Confirmed or potential data disclosure related-to T1020.001 Traffic Duplication
attribute.confidentiality.data_disclosure Confirmed or potential data disclosure related-to T1025 Data from Removable Media
attribute.confidentiality.data_disclosure Confirmed or potential data disclosure related-to T1029 Scheduled Transfer
attribute.confidentiality.data_disclosure Confirmed or potential data disclosure related-to T1030 Data Transfer Size Limits
attribute.confidentiality.data_disclosure Confirmed or potential data disclosure related-to T1039 Data from Network Shared Drive
attribute.confidentiality.data_disclosure Confirmed or potential data disclosure related-to T1040 Network Sniffing
attribute.confidentiality.data_disclosure Confirmed or potential data disclosure related-to T1041 Exfiltration Over C2 Channel
attribute.confidentiality.data_disclosure Confirmed or potential data disclosure related-to T1048 Exfiltration Over Alternative Protocol
attribute.confidentiality.data_disclosure Confirmed or potential data disclosure related-to T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol
attribute.confidentiality.data_disclosure Confirmed or potential data disclosure related-to T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
attribute.confidentiality.data_disclosure Confirmed or potential data disclosure related-to T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Non-Mappable Capabilities

Non-mappable capabilities are either out of scope or unable to be mapped to any ATT&CK objects
Capability ID Capability Description
Value_chain.development.variety.NA No type of development was necessary
Attribute.Availability.Variety.Other Other
action.hacking.variety.Prompt injection Malicious actions taken against an LLM model
Action.Hacking.Vector.Unknown Unknown
Action.Malware.Vector.Email other Email sub-variety known, but not one of those listed (attachment, link, autoexecute, etc). Child of 'Email'
Action.Social.Vector.Unknown Unknown
Action.Social.Variety.Unknown Unknown
Action.Social.Variety.Influence Influence tactics (Leveraging authority or obligation, framing, etc)
Action.Social.Vector.Other Other
Attribute.Integrity.Variety.Other Other
Action.Malware.Variety.Other Other
Action.Malware.Vector.Email unknown Email but sub-variety (attachment, autoexecute, link, etc) not known. Child of 'Email'
Action.Social.Vector.In-person In-person
Action.Malware.Vector.Unknown Unknown
Action.Social.Variety.Other Other
Attribute.Availability.Variety.Unknown Unknown