VERIS MAPPINGS

The Vocabulary for Event Recording and Incident Sharing (VERIS) provides a common language for describing security incidents in a structured and repeatable manner that allows for the analysis of data across a variety of incidents. This project provides mappings to better connect the who, what, and why captured in VERIS incident representation with the when and how described in MITRE ATT&CK® adversary behavioral tactics and techniques.

VERIS Versions: 1.3.7, 1.3.5 ATT&CK Versions: 12.1, 9.0 ATT&CK Domain: Enterprise, ICS, Mobile

VERIS Mapping Methodology

SELECT VERSIONS

VERIS Version

ATT&CK Version

ATT&CK Domain

Capability Groups

ID Capability Group Name Number of Mappings Number of Capabilities
action.hacking action.hacking 379 41
action.malware action.malware 337 42
attribute.integrity attribute.integrity 72 10
value_chain.development value_chain.development 23 10
value_chain.distribution value_chain.distribution 18 5
value_chain.non-distribution_services value_chain.non-distribution_services 12 1
value_chain.targeting value_chain.targeting 43 4
action.social action.social 29 4

All Mappings

This is a very large mapping. To reduce the size, we have only downloaded the first 500 of 913 mappings. Load all data (936.7 KB)

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1047 Windows Management Instrumentation
action.hacking.vector.Command shell Remote shell related-to T1047 Windows Management Instrumentation
action.malware.vector.Direct install Directly installed or inserted by threat agent (after system access) related-to T1047 Windows Management Instrumentation
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1053 Scheduled Task/Job
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1053 Scheduled Task/Job
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1053.001 Scheduled Task/Job: At (Linux)
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1053.002 Scheduled Task/Job: At (Windows)
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1053.003 Scheduled Task/Job: Cron
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1053.004 Scheduled Task/Job: Launchd
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1053.005 Scheduled Task/Job: Scheduled Task
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1053.006 Scheduled Task/Job: Systemd Timers
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1053.007 Scheduled Task/Job: Container Orchestration Job
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1059 Command and Scripting Interpreter
action.hacking.vector.Command shell Remote shell related-to T1059 Command and Scripting Interpreter
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1059.001 Command and Scripting Interpreter: PowerShell
action.hacking.vector.Command shell Remote shell related-to T1059.001 Command and Scripting Interpreter: PowerShell
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1059.002 Command and Scripting Interpreter: AppleScript
action.hacking.vector.Command shell Remote shell related-to T1059.002 Command and Scripting Interpreter: AppleScript
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1059.003 Command and Scripting Interpreter: Windows Command Shell
action.hacking.vector.Command shell Remote shell related-to T1059.003 Command and Scripting Interpreter: Windows Command Shell
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1059.004 Command and Scripting Interpreter: Unix Shell
action.hacking.vector.Command shell Remote shell related-to T1059.004 Command and Scripting Interpreter: Unix Shell
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1059.005 Command and Scripting Interpreter: Visual Basic
action.hacking.vector.Command shell Remote shell related-to T1059.005 Command and Scripting Interpreter: Visual Basic
action.malware.vector.Email attachment Email via user-executed attachment. Child of 'Email' related-to T1059.005 Command and Scripting Interpreter: Visual Basic
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1059.006 Command and Scripting Interpreter: Python
action.hacking.vector.Command shell Remote shell related-to T1059.006 Command and Scripting Interpreter: Python
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1059.007 Command and Scripting Interpreter: JavaScript
action.hacking.vector.Command shell Remote shell related-to T1059.007 Command and Scripting Interpreter: JavaScript
action.malware.vector.Email attachment Email via user-executed attachment. Child of 'Email' related-to T1059.007 Command and Scripting Interpreter: JavaScript
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1059.008 Command and Scripting Interpreter: Network Device CLI
action.hacking.vector.Command shell Remote shell related-to T1059.008 Command and Scripting Interpreter: Network Device CLI
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1072 Software Deployment Tools
action.malware.variety.Adminware System or network utilities (e.g., PsTools, Netcat) related-to T1072 Software Deployment Tools
action.malware.vector.Software update Included in automated software update related-to T1072 Software Deployment Tools
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1106 Native API
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1112 Modify Registry
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1127 Trusted Developer Utilities Proxy Execution
action.hacking.variety.Unknown Unknown related-to T1127 Trusted Developer Utilities Proxy Execution
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1127.001 Tursted Developer Utilities Proxy Execution: MSBuild
action.hacking.variety.Unknown Unknown related-to T1127.001 Tursted Developer Utilities Proxy Execution: MSBuild
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1129 Shared Modules
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1137 Office Application Startup
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1137 Office Application Startup
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1137.001 Office Application Startup: Office Template Macros
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1137.002 Office Application Startup: Office Test
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1137.003 Office Application Startup: Outlook Forms
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1137.004 Office Application Startup: Outlook Home Page
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1137.005 Office Application Startup: Outlook Rules
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1187 Forced Authentication
action.hacking.variety.MitM Man-in-the-middle attack. Child of 'Exploit vuln'. related-to T1187 Forced Authentication
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1202 Indirect Command Execution
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1216 Signed Script Proxy Execution
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1216.001 Signed Script Proxy Execution: PubPrn
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1218 Signed Binary Proxy Execution
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1218.001 Signed Binary Proxy Execution: Compiled HTML File
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1218.002 Signed Binary Proxy Execution: Control Panel
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1218.003 Signed Binary Proxy Execution: CMSTP
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1218.004 Signed Binary Proxy Execution: InstallUtil
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1218.005 Signed Binary Proxy Execution: Mshta
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1218.007 Signed Binary Proxy Execution: Msiexec
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1218.008 Signed Binary Proxy Execution: Odbcconf
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1218.009 Signed Binary Proxy Execution: Regsvcs/Regasm
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1218.010 Signed Binary Proxy Execution: Regsvr32
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1218.011 Signed Binary Proxy Execution: Rundll32
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1218.012 Signed Binary Proxy Execution: Verclsid
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1220 XSL Script Processing
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1505.001 Server Software Component: SQL Stored Procedures
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1505.001 Server Software Component: SQL Stored Procedures
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1505.001 Server Software Component: SQL Stored Procedures
action.malware.variety.Backdoor Backdoor (enable remote access). Child of 'RAT' when combined with 'Trojan' related-to T1505.001 Server Software Component: SQL Stored Procedures
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1505.002 Server Software Component: Transport Agent
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1505.002 Server Software Component: Transport Agent
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1505.002 Server Software Component: Transport Agent
action.malware.variety.Backdoor Backdoor (enable remote access). Child of 'RAT' when combined with 'Trojan' related-to T1505.002 Server Software Component: Transport Agent
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1529 System Shutdown/Reboot
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1543 Create or Modify System Process
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1543 Create or Modify System Process
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1543 Create or Modify System Process
action.malware.variety.Backdoor Backdoor (enable remote access). Child of 'RAT' when combined with 'Trojan' related-to T1543 Create or Modify System Process
action.malware.variety.Rootkit Rootkit (maintain local privileges and stealth) related-to T1543 Create or Modify System Process
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1543.001 Create or Modify System Process: Launch Agent
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1543.002 Create or Modify System Process: Systemd Service
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1543.003 Create or Modify System Process: Windows Service
action.malware.variety.RAT Remote Access Trojan. Parent of 'Backdoor' and 'Trojan' related-to T1543.003 Create or Modify System Process: Windows Service
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1543.004 Create or Modify System Process: Launch Daemon
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1547 Boot or Logon Autostart Execution
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1547 Boot or Logon Autostart Execution
action.malware.variety.Backdoor Backdoor (enable remote access). Child of 'RAT' when combined with 'Trojan' related-to T1547 Boot or Logon Autostart Execution
attribute.integrity.variety.Modify configuration Modified configuration or services related-to T1547 Boot or Logon Autostart Execution
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1548 Abuse Elevation Control Mechanism
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
action.hacking.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
action.malware.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching
action.hacking.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching
action.malware.variety.Client-side attack Client-side or browser attack (e.g., redirection, XSS, MitB) related-to T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1548.004 Abuse Elevation Control Mechanism: Elevated Execution with Prompt
action.hacking.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1548.004 Abuse Elevation Control Mechanism: Elevated Execution with Prompt
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1559 Inter-Process Communication
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1559.001 Inter-Process Communication: Component Object Model
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1559.002 Inter-Process Communication: Dynamic Data Exchange
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1563 Remote Service Session Hijacking
action.malware.vector.Network propagation Network propagation related-to T1563 Remote Service Session Hijacking
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1563.001 Remote Service Session Hijacking: SSH Hijacking
action.malware.vector.Network propagation Network propagation related-to T1563.001 Remote Service Session Hijacking: SSH Hijacking
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1563.002 Remote Service Session Hijacking: RDP Hijacking
action.malware.vector.Network propagation Network propagation related-to T1563.002 Remote Service Session Hijacking: RDP Hijacking
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1564 Hide Artifacts
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1564.001 Hide Artifacts: Hidden Files and Directories
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1564.002 Hide Artifacts: Hidden Users
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1564.003 Hide Artifacts: Hidden Window
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1564.004 Hide Artifacts: NTFS File Attributes
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1564.005 Hide Artifacts: Hidden File System
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1564.006 Hide Artifacts: Run Virtual Instance
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1564.007 Hide Artifacts: VBA Stomping
action.malware.variety.Trojan An application which appears legitimate but hides malicious functionality. Child of 'RAT' when combined with 'Backdoor' related-to T1564.007 Hide Artifacts: VBA Stomping
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1569 System Services
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1569.001 System Services: Launchctl
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1569.002 System Services: Service Execution
action.malware.vector.Direct install Directly installed or inserted by threat agent (after system access) related-to T1569.002 System Services: Service Execution
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1578 Modify Cloud Computer Infrastructure
action.hacking.vector.Hypervisor Hypervisor break-out attack related-to T1578 Modify Cloud Computer Infrastructure
action.hacking.vector.Inter-tenant Penetration of another VM or web site on shared device or infrastructure related-to T1578 Modify Cloud Computer Infrastructure
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1578.001 Modify Cloud Computer Infrastructure: Create Snapshot
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1578.002 Modify Cloud Computer Infrastructure: Create Cloud Instance
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1578.003 Modify Cloud Computer Infrastructure: Delete Cloud Instance
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1578.004 Modify Cloud Computer Infrastructure: Revert Cloud Instance
action.hacking.variety.Abuse of functionality Abuse of functionality related-to T1609 Container Administration Command
action.hacking.variety.Brute force Brute force or password guessing attacks related-to T1110 Brute Force
action.malware.variety.Brute force Brute force attack related-to T1110 Brute Force
action.hacking.variety.Brute force Brute force or password guessing attacks related-to T1110.001 Brute Force: Password Guessing
action.malware.variety.Brute force Brute force attack related-to T1110.001 Brute Force: Password Guessing
action.hacking.variety.Brute force Brute force or password guessing attacks related-to T1110.002 Brute Force: Password Cracking
action.hacking.variety.Offline cracking Offline password or key cracking (e.g., rainbow tables, Hashcat, JtR) related-to T1110.002 Brute Force: Password Cracking
action.malware.variety.Brute force Brute force attack related-to T1110.002 Brute Force: Password Cracking
action.hacking.variety.Brute force Brute force or password guessing attacks related-to T1110.003 Brute Force: Password Spraying
action.malware.variety.Brute force Brute force attack related-to T1110.003 Brute Force: Password Spraying
action.hacking.variety.Brute force Brute force or password guessing attacks related-to T1110.004 Brute Force: Credential Stuffing
action.malware.variety.Brute force Brute force attack related-to T1110.004 Brute Force: Credential Stuffing
action.hacking.variety.Buffer overflow Buffer overflow. Child of 'Exploit vuln'. related-to T1203 Exploitation for Client Execution
action.hacking.variety.HTTP Response Splitting HTTP Response Splitting. Child of 'Exploit vuln'. related-to T1203 Exploitation for Client Execution
action.hacking.variety.HTTP request smuggling HTTP request smuggling. Child of 'Exploit vuln'. related-to T1203 Exploitation for Client Execution
action.hacking.variety.HTTP request splitting HTTP request splitting. Child of 'Exploit vuln'. related-to T1203 Exploitation for Client Execution
action.hacking.variety.HTTP response smuggling HTTP response smuggling. Child of 'Exploit vuln'. related-to T1203 Exploitation for Client Execution
action.malware.variety.Client-side attack Client-side or browser attack (e.g., redirection, XSS, MitB) related-to T1203 Exploitation for Client Execution
action.malware.vector.Email attachment Email via user-executed attachment. Child of 'Email' related-to T1203 Exploitation for Client Execution
action.hacking.variety.Cryptanalysis Cryptanalysis. Child of 'Exploit vuln'. related-to T1600 Weaken Encryption
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1600 Weaken Encryption
action.hacking.variety.DoS Denial of service related-to T1498 Network Denial of Service
action.malware.variety.DoS DoS attack related-to T1498 Network Denial of Service
action.hacking.variety.DoS Denial of service related-to T1498.001 Network Denial of Service: Direct Network Flood
action.malware.variety.DoS DoS attack related-to T1498.001 Network Denial of Service: Direct Network Flood
action.hacking.variety.DoS Denial of service related-to T1498.002 Network Denial of Service: Reflection Amplification
action.malware.variety.DoS DoS attack related-to T1498.002 Network Denial of Service: Reflection Amplification
action.hacking.variety.DoS Denial of service related-to T1499 Endpoint Denial of Service
action.hacking.variety.Soap array abuse Soap array abuse. Child of 'Exploit vuln'. related-to T1499 Endpoint Denial of Service
action.hacking.variety.XML attribute blowup XML attribute blowup. Child of 'Exploit vuln'. related-to T1499 Endpoint Denial of Service
action.hacking.variety.XML entity expansion XML entity expansion. Child of 'Exploit vuln'. related-to T1499 Endpoint Denial of Service
action.hacking.variety.XML external entities XML external entities. Child of 'Exploit vuln'. related-to T1499 Endpoint Denial of Service
action.malware.variety.DoS DoS attack related-to T1499 Endpoint Denial of Service
action.hacking.variety.DoS Denial of service related-to T1499.001 Endpoint Denial of Service: OS Exhaustion Flood
action.malware.variety.DoS DoS attack related-to T1499.001 Endpoint Denial of Service: OS Exhaustion Flood
action.hacking.variety.DoS Denial of service related-to T1499.002 Endpoint Denial of Service: Service Exhaustion Flood
action.malware.variety.DoS DoS attack related-to T1499.002 Endpoint Denial of Service: Service Exhaustion Flood
action.hacking.variety.DoS Denial of service related-to T1499.003 Endpoint Denial of Service: Application Exhaustion Flood
action.malware.variety.DoS DoS attack related-to T1499.003 Endpoint Denial of Service: Application Exhaustion Flood
action.hacking.variety.DoS Denial of service related-to T1499.004 Endpoint Denial of Service: Application or System Exploitation
action.malware.variety.DoS DoS attack related-to T1499.004 Endpoint Denial of Service: Application or System Exploitation
action.hacking.variety.DoS Denial of service related-to T1583.005 Acquire Infrastructure: Botnet
action.hacking.variety.Unknown Unknown related-to T1583.005 Acquire Infrastructure: Botnet
value_chain.development.variety.Bot A small program that can be distributed, installed, and controlled en mass. related-to T1583.005 Acquire Infrastructure: Botnet
value_chain.distribution.variety.Botnet For content distributed from a collection of bots. related-to T1583.005 Acquire Infrastructure: Botnet
action.hacking.variety.DoS Denial of service related-to T1584.005 Compromise Infrastructure: Botnet
action.hacking.variety.Unknown Unknown related-to T1584.005 Compromise Infrastructure: Botnet
value_chain.distribution.variety.Other The variety of distribution was known, but is not listed related-to T1584.005 Compromise Infrastructure: Botnet
value_chain.non-distribution services.variety.Other The variety of non-distribution service required is known, but is not listed related-to T1584.005 Compromise Infrastructure: Botnet
action.hacking.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.Exploit vuln Exploit vulnerability in code (vs misconfig or weakness). This can be used with other hacking enumerations, (such as XSS when an XSS vuln exists.). Parent of many hacking varieties. related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.Format string attack Format string attack. Child of 'Exploit vuln'. related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.Fuzz testing Fuzz testing. Child of 'Exploit vuln'. related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.Insecure deserialization iterating over sequential or obvious values. https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization. Child of 'Exploit vuln'. related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.Integer overflows Integer overflows. Child of 'Exploit vuln'. related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.LDAP injection LDAP injection. Child of 'Exploit vuln'. related-to T1068 Exploitation for Privilege Escalation
action.malware.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1068 Exploitation for Privilege Escalation
action.hacking.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1190 Exploit Public-Facing Application
action.malware.variety.Exploit vuln Exploit vulnerability in code (vs misconfig or weakness). This can be used with other malware enumerations, (such as Remote injection when a Remote injection vuln exists.) related-to T1190 Exploit Public-Facing Application
action.hacking.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1210 Exploitation of Remote Services
action.malware.variety.Exploit vuln Exploit vulnerability in code (vs misconfig or weakness). This can be used with other malware enumerations, (such as Remote injection when a Remote injection vuln exists.) related-to T1210 Exploitation of Remote Services
action.hacking.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1212 Exploitation for Credential Access
action.hacking.variety.Exploit vuln Exploit vulnerability in code (vs misconfig or weakness). This can be used with other hacking enumerations, (such as XSS when an XSS vuln exists.). Parent of many hacking varieties. related-to T1212 Exploitation for Credential Access
action.hacking.variety.Session fixation Session fixation. Child of 'Exploit vuln'. related-to T1212 Exploitation for Credential Access
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1212 Exploitation for Credential Access
action.malware.variety.Exploit vuln Exploit vulnerability in code (vs misconfig or weakness). This can be used with other malware enumerations, (such as Remote injection when a Remote injection vuln exists.) related-to T1212 Exploitation for Credential Access
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1212 Exploitation for Credential Access
action.malware.vector.Web application - drive-by Web via auto-executed or "drive-by" infection. Child of 'Web application'. related-to T1212 Exploitation for Credential Access
action.hacking.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1558.004 Steal or Forge Kerberos Tickets: AS-REP Roasting
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1558.004 Steal or Forge Kerberos Tickets: AS-REP Roasting
action.malware.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1558.004 Steal or Forge Kerberos Tickets: AS-REP Roasting
action.hacking.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1574.001 Hijack Execution Flow: DLL Search Order Hijacking
action.hacking.variety.Exploit vuln Exploit vulnerability in code (vs misconfig or weakness). This can be used with other hacking enumerations, (such as XSS when an XSS vuln exists.). Parent of many hacking varieties. related-to T1574.001 Hijack Execution Flow: DLL Search Order Hijacking
action.hacking.variety.Unknown Unknown related-to T1574.001 Hijack Execution Flow: DLL Search Order Hijacking
action.hacking.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1574.002 Hijack Execution Flow: DLL Side-Loading
action.hacking.variety.Exploit vuln Exploit vulnerability in code (vs misconfig or weakness). This can be used with other hacking enumerations, (such as XSS when an XSS vuln exists.). Parent of many hacking varieties. related-to T1574.002 Hijack Execution Flow: DLL Side-Loading
action.hacking.variety.Unknown Unknown related-to T1574.002 Hijack Execution Flow: DLL Side-Loading
action.hacking.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1574.005 Hijack Execution Flow: Executable Installer File Permissions Weakness
action.hacking.variety.Unknown Unknown related-to T1574.005 Hijack Execution Flow: Executable Installer File Permissions Weakness
action.hacking.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1574.010 Hijack Execution Flow: Services File Permissions Weakness
action.hacking.variety.Exploit misconfig Exploit a misconfiguration (vs vuln or weakness) related-to T1574.011 Hijack Execution Flow: Services Registry Permissions Weakness
action.hacking.variety.Exploit vuln Exploit vulnerability in code (vs misconfig or weakness). This can be used with other hacking enumerations, (such as XSS when an XSS vuln exists.). Parent of many hacking varieties. related-to T1574.004 Hijack Execution Flow: Dylib Hijacking
action.hacking.variety.Unknown Unknown related-to T1574.004 Hijack Execution Flow: Dylib Hijacking
action.hacking.variety.Exploit vuln Exploit vulnerability in code (vs misconfig or weakness). This can be used with other hacking enumerations, (such as XSS when an XSS vuln exists.). Parent of many hacking varieties. related-to T1595.002 Active Scanning: Vulnerability Scanning
action.malware.variety.Exploit vuln Exploit vulnerability in code (vs misconfig or weakness). This can be used with other malware enumerations, (such as Remote injection when a Remote injection vuln exists.) related-to T1595.002 Active Scanning: Vulnerability Scanning
action.malware.variety.Scan network Scan or footprint network related-to T1595.002 Active Scanning: Vulnerability Scanning
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1595.002 Active Scanning: Vulnerability Scanning
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1007 System Service Discovery
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1012 Query Registry
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1057 Process Discovery
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1069 Permission Groups Discovery
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1069.001 Permission Groups Discovery: Local Groups
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1069.002 Permission Groups Discovery: Domain Groups
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1069.003 Permission Groups Discovery: Cloud Groups
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1082 System Information Discovery
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1087 Account Discovery
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1087.001 Account Discovery: Local Account
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1087.002 Account Discovery: Domain Account
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1087.003 Account Discovery: Email Account
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1087.004 Account Discovery: Cloud Account
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1119 Automated Collection
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1119 Automated Collection
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1120 Peripheral Device Discovery
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1124 System Time Discovery
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1201 Password Policy Discovery
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1480 Execution Guardrails
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1480.001 Execution Guardrails: Environmental Keying
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1518 Software Discovery
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1518.001 Software Discovery: Security Software Discovery
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1526 Cloud Service Discovery
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1538 Cloud Service Dashboard
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1580 Cloud Infrastructure Discovery
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1589 Gather Victim Identity Information
value_chain.targeting.variety.Personal Information Information on individuals such as title, interests, physical location, etc, used to pick an organization as a target related-to T1589 Gather Victim Identity Information
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1589.001 Gather Victim Identity Information: Credentials
value_chain.targeting.variety.Lost or stolen credentials lost or stolen credentials, including credental stuffing, used to pick an organization as a target related-to T1589.001 Gather Victim Identity Information: Credentials
value_chain.targeting.variety.Personal Information Information on individuals such as title, interests, physical location, etc, used to pick an organization as a target related-to T1589.001 Gather Victim Identity Information: Credentials
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1589.002 Gather Victim Identity Information: Email Addresses
value_chain.targeting.variety.Email addresses Email addresses related-to T1589.002 Gather Victim Identity Information: Email Addresses
value_chain.targeting.variety.Personal Information Information on individuals such as title, interests, physical location, etc, used to pick an organization as a target related-to T1589.002 Gather Victim Identity Information: Email Addresses
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1589.003 Gather Victim Identity Information: Employee Names
value_chain.targeting.variety.Personal Information Information on individuals such as title, interests, physical location, etc, used to pick an organization as a target related-to T1589.003 Gather Victim Identity Information: Employee Names
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1590 Gather Victim Network Information
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1590 Gather Victim Network Information
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1590.001 Gather Victim Network Information: Domain Properties
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1590.001 Gather Victim Network Information: Domain Properties
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1590.002 Gather Victim Network Information: DNS
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1590.002 Gather Victim Network Information: DNS
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1590.003 Gather Victim Network Information: Network Trust Dependencies
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1590.003 Gather Victim Network Information: Network Trust Dependencies
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1590.004 Gather Victim Network Information: Network Topology
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1590.004 Gather Victim Network Information: Network Topology
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1590.005 Gather Victim Network Information: IP Addresses
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1590.005 Gather Victim Network Information: IP Addresses
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1590.006 Gather Victim Network Information: Network Security Appliances
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1590.006 Gather Victim Network Information: Network Security Appliances
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1591 Gather Victim Org Information
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1591 Gather Victim Org Information
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1591.001 Gather Victim Org Information: Determine Physical Locations
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1591.001 Gather Victim Org Information: Determine Physical Locations
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1591.002 Gather Victim Org Information: Business Relationships
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1591.002 Gather Victim Org Information: Business Relationships
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1591.003 Gather Victim Org Information: Identify Business Tempo
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1591.003 Gather Victim Org Information: Identify Business Tempo
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1591.004 Gather Victim Org Information: Identify Roles
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1591.004 Gather Victim Org Information: Identify Roles
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1592 Gather Victim Host Information
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1592 Gather Victim Host Information
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1592.001 Gather Victim Host Information: Hardware
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1592.001 Gather Victim Host Information: Hardware
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1592.002 Gather Victim Host Information: Software
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1592.002 Gather Victim Host Information: Software
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1592.003 Gather Victim Host Information: Firmware
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1592.003 Gather Victim Host Information: Firmware
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1592.004 Gather Victim Host Information: Client Configurations
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1592.004 Gather Victim Host Information: Client Configurations
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1593 Search Open Websites/Domains
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1593 Search Open Websites/Domains
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1593.001 Search Open Websites/Domains: Social Media
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1593.001 Search Open Websites/Domains: Social Media
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1593.002 Search Open Websites/Domains: Search Engines
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1593.002 Search Open Websites/Domains: Search Engines
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1594 Search Victim-Owned Websites
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1594 Search Victim-Owned Websites
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1596 Search Open Technical Databases
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1596 Search Open Technical Databases
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1596.001 Search Open Technical Databases: DNS/Passive DNS
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1596.001 Search Open Technical Databases: DNS/Passive DNS
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1596.002 Search Open Technical Databases: WHOIS
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1596.002 Search Open Technical Databases: WHOIS
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1596.003 Search Open Technical Databases: Digital Certificates
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1596.003 Search Open Technical Databases: Digital Certificates
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1596.004 Search Open Technical Databases: CDNs
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1596.004 Search Open Technical Databases: CDNs
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1596.005 Search Open Technical Databases: Scan Databases
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1596.005 Search Open Technical Databases: Scan Databases
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1597 Search Closed Sources
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1597 Search Closed Sources
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1597.001 Search Closed Sources: Threat Intel Vendors
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1597.001 Search Closed Sources: Threat Intel Vendors
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1597.002 Search Closed Sources: Purchase Technical Data
value_chain.targeting.variety.Organizational Information Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target related-to T1597.002 Search Closed Sources: Purchase Technical Data
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1602 Data from Configuration Repository
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1602 Data from Configuration Repository
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1602.001 Data from Configuration Repository: SNMP (MIB Dump)
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1602.002 Data from Configuration Repository: Network Device Configuration Dump
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1613 Container and Resource Discovery
action.hacking.variety.Footprinting Footprinting and fingerprinting related-to T1614 System Location Discovery
action.hacking.variety.Forced browsing Forced browsing or predictable resource location. Child of 'Exploit vuln'. related-to T1539 Steal Web Session Cookie
action.hacking.variety.MitM Man-in-the-middle attack. Child of 'Exploit vuln'. related-to T1539 Steal Web Session Cookie
action.malware.variety.Capture app data Capture data from application or system process related-to T1539 Steal Web Session Cookie
action.hacking.variety.Forced browsing Forced browsing or predictable resource location. Child of 'Exploit vuln'. related-to T1583.003 Acquire Infrastructure: Virtual Private Server
action.hacking.variety.Unknown Unknown related-to T1583.003 Acquire Infrastructure: Virtual Private Server
value_chain.distribution.variety.Other The variety of distribution was known, but is not listed related-to T1583.003 Acquire Infrastructure: Virtual Private Server
value_chain.non-distribution services.variety.Other The variety of non-distribution service required is known, but is not listed related-to T1583.003 Acquire Infrastructure: Virtual Private Server
action.hacking.variety.Forced browsing Forced browsing or predictable resource location. Child of 'Exploit vuln'. related-to T1583.004 Acquire Infrastructure: Server
action.hacking.variety.Unknown Unknown related-to T1583.004 Acquire Infrastructure: Server
value_chain.distribution.variety.Other The variety of distribution was known, but is not listed related-to T1583.004 Acquire Infrastructure: Server
value_chain.non-distribution services.variety.Other The variety of non-distribution service required is known, but is not listed related-to T1583.004 Acquire Infrastructure: Server
action.hacking.variety.Forced browsing Forced browsing or predictable resource location. Child of 'Exploit vuln'. related-to T1583.006 Acquire Infrastructure: Web Services
action.hacking.variety.Unknown Unknown related-to T1583.006 Acquire Infrastructure: Web Services
action.malware.variety.C2 Command and control (C2) related-to T1583.006 Acquire Infrastructure: Web Services
value_chain.development.variety.Website Development of any full website controlled by the attacker related-to T1583.006 Acquire Infrastructure: Web Services
value_chain.distribution.variety.Other The variety of distribution was known, but is not listed related-to T1583.006 Acquire Infrastructure: Web Services
value_chain.non-distribution services.variety.Other The variety of non-distribution service required is known, but is not listed related-to T1583.006 Acquire Infrastructure: Web Services
action.hacking.variety.HTTP Response Splitting HTTP Response Splitting. Child of 'Exploit vuln'. related-to T1185 Man in the Browser
action.hacking.variety.HTTP request smuggling HTTP request smuggling. Child of 'Exploit vuln'. related-to T1185 Man in the Browser
action.hacking.variety.HTTP request splitting HTTP request splitting. Child of 'Exploit vuln'. related-to T1185 Man in the Browser
action.hacking.variety.HTTP response smuggling HTTP response smuggling. Child of 'Exploit vuln'. related-to T1185 Man in the Browser
action.hacking.variety.MitM Man-in-the-middle attack. Child of 'Exploit vuln'. related-to T1185 Man in the Browser
action.hacking.variety.Session fixation Session fixation. Child of 'Exploit vuln'. related-to T1185 Man in the Browser
action.malware.variety.Capture app data Capture data from application or system process related-to T1185 Man in the Browser
action.hacking.variety.MitM Man-in-the-middle attack. Child of 'Exploit vuln'. related-to T1557 Man-in-the-Middle
action.hacking.variety.Routing detour Routing detour. Child of 'Exploit vuln'. related-to T1557 Man-in-the-Middle
action.hacking.variety.MitM Man-in-the-middle attack. Child of 'Exploit vuln'. related-to T1557.001 Man-in-the-Middle: LLMNR/NBT-NS Poisoning and Relay
action.hacking.variety.MitM Man-in-the-middle attack. Child of 'Exploit vuln'. related-to T1557.002 Man-in-the-Middle: ARP Cache Poisoning
action.hacking.variety.Pass-the-hash Pass-the-hash related-to T1550.002 Use Alternate Authentication Material: Pass the Hash
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1550.002 Use Alternate Authentication Material: Pass the Hash
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1550.002 Use Alternate Authentication Material: Pass the Hash
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1001 Data Obfuscation
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1001 Data Obfuscation
action.malware.variety.Unknown Unknown related-to T1001 Data Obfuscation
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1008 Fallback Channels
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1008 Fallback Channels
action.malware.variety.C2 Command and control (C2) related-to T1008 Fallback Channels
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1071 Application Layer Protocol
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1071 Application Layer Protocol
action.malware.variety.C2 Command and control (C2) related-to T1071 Application Layer Protocol
action.malware.variety.Unknown Unknown related-to T1071 Application Layer Protocol
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1078 Valid Accounts
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1078 Valid Accounts
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1078 Valid Accounts
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1090 Proxy
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1090 Proxy
action.malware.variety.C2 Command and control (C2) related-to T1090 Proxy
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1095 Non-Application Layer Protocol
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1095 Non-Application Layer Protocol
action.malware.variety.C2 Command and control (C2) related-to T1095 Non-Application Layer Protocol
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1102 Web Service
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1102 Web Service
action.malware.variety.C2 Command and control (C2) related-to T1102 Web Service
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1104 Multi-Stage Channels
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1104 Multi-Stage Channels
action.malware.variety.C2 Command and control (C2) related-to T1104 Multi-Stage Channels
action.hacking.variety.Unknown Unknown related-to T1105 Ingress Tool Transfer
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1105 Ingress Tool Transfer
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1105 Ingress Tool Transfer
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1132 Data Encoding
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1132 Data Encoding
action.malware.variety.C2 Command and control (C2) related-to T1132 Data Encoding
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1133 External Remote Services
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1133 External Remote Services
action.hacking.vector.3rd party desktop 3rd party online desktop sharing (LogMeIn, Go2Assist) related-to T1133 External Remote Services
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1133 External Remote Services
action.hacking.vector.Desktop sharing software Superset of 'Desktop sharing' and '3rd party desktop'. Please use in place of the other two related-to T1133 External Remote Services
action.malware.variety.Backdoor Backdoor (enable remote access). Child of 'RAT' when combined with 'Trojan' related-to T1133 External Remote Services
action.malware.variety.Exploit vuln Exploit vulnerability in code (vs misconfig or weakness). This can be used with other malware enumerations, (such as Remote injection when a Remote injection vuln exists.) related-to T1133 External Remote Services
action.malware.vector.Remote injection Remotely injected by agent (i.e. via SQLi) related-to T1133 External Remote Services
action.malware.vector.Web application Web application. Parent of 'Web application - download' and 'Web application - drive-by. related-to T1133 External Remote Services
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1205 Traffic Signaling
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1205 Traffic Signaling
action.malware.variety.C2 Command and control (C2) related-to T1205 Traffic Signaling
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1505 Server Software Component
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1505 Server Software Component
action.malware.variety.Backdoor Backdoor (enable remote access). Child of 'RAT' when combined with 'Trojan' related-to T1505 Server Software Component
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1505.003 Server Software Component: Web Shell
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1505.003 Server Software Component: Web Shell
action.malware.variety.Backdoor Backdoor (enable remote access). Child of 'RAT' when combined with 'Trojan' related-to T1505.003 Server Software Component: Web Shell
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1525 Implant Container Image
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1525 Implant Container Image
action.malware.variety.Backdoor Backdoor (enable remote access). Child of 'RAT' when combined with 'Trojan' related-to T1525 Implant Container Image
action.malware.variety.RAT Remote Access Trojan. Parent of 'Backdoor' and 'Trojan' related-to T1525 Implant Container Image
action.malware.variety.Unknown Unknown related-to T1525 Implant Container Image
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1568 Dynamic Resolution
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1568 Dynamic Resolution
action.malware.variety.C2 Command and control (C2) related-to T1568 Dynamic Resolution
action.malware.vector.Download by malware Downloaded and installed by local malware related-to T1568 Dynamic Resolution
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1571 Non-Standard Port
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1571 Non-Standard Port
action.malware.variety.C2 Command and control (C2) related-to T1571 Non-Standard Port
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1572 Protocol Tunneling
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1572 Protocol Tunneling
action.malware.variety.C2 Command and control (C2) related-to T1572 Protocol Tunneling
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1573 Encrypted Channels
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1573 Encrypted Channels
action.malware.variety.C2 Command and control (C2) related-to T1573 Encrypted Channels
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1573.001 Encrypted Channels: Symmetric Cryptography
action.malware.variety.C2 Command and control (C2) related-to T1573.001 Encrypted Channels: Symmetric Cryptography
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1573.002 Encrypted Channels: Asymmetric Cryptography
action.malware.variety.C2 Command and control (C2) related-to T1573.002 Encrypted Channels: Asymmetric Cryptography
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1021 Remote Services
action.malware.vector.Network propagation Network propagation related-to T1021 Remote Services
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1021.001 Remote Services: Remote Desktop Protocol
action.hacking.vector.Desktop sharing software Superset of 'Desktop sharing' and '3rd party desktop'. Please use in place of the other two related-to T1021.001 Remote Services: Remote Desktop Protocol
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1021.002 Remote Services: SMB/Windows Admin Shares
action.hacking.vector.Command shell Remote shell related-to T1021.002 Remote Services: SMB/Windows Admin Shares
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1021.003 Remote Services: Distributed Component Object Model
action.hacking.vector.Command shell Remote shell related-to T1021.003 Remote Services: Distributed Component Object Model
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1021.004 Remote Services: SSH
action.hacking.vector.Command shell Remote shell related-to T1021.004 Remote Services: SSH
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1021.005 Remote Services: VNC
action.hacking.vector.Desktop sharing software Superset of 'Desktop sharing' and '3rd party desktop'. Please use in place of the other two related-to T1021.005 Remote Services: VNC
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1021.006 Remote Services: Windows Remote Management
action.hacking.vector.Command shell Remote shell related-to T1021.006 Remote Services: Windows Remote Management
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1078.001 Valid Accounts: Default Accounts
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1078.002 Valid Accounts: Domain Accounts
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1078.003 Valid Accounts: Local Accounts
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1078.004 Valid Accounts: Cloud Accounts
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1134 Access Token Manipulation
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1134.001 Access Token Manipulation: Token Impersonation/Theft
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1134.002 Access Token Manipulation: Create Process with Token
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1134.003 Access Token Manipulation: Make and Impersonate Token
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1134.004 Access Token Manipulation: Parent PID Spoofing
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1134.005 Access Token Manipulation: SID-History Injection
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1550 Use Alternate Authentication Material
action.malware.vector.Network propagation Network propagation related-to T1550 Use Alternate Authentication Material
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1550.001 Use Alternate Authentication Material: Application Access Token
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1550.003 Use Alternate Authentication Material: Pass the Ticket
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1550.004 Use Alternate Authentication Material: Web Session Cookies
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1558 Steal or Forge Kerberos Tickets
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1558.001 Steal or Forge Kerberos Tickets: Golden Ticket
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1558.002 Steal or Forge Kerberos Tickets: Silver Ticket
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1586 Compromise Account
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1586.001 Compromise Account: Social Media Accounts
action.social.variety.Phishing Phishing (or any type of *ishing) related-to T1586.001 Compromise Account: Social Media Accounts
action.social.variety.Pretexting Pretexting (dialogue leveraging invented scenario) related-to T1586.001 Compromise Account: Social Media Accounts
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1586.002 Compromise Account: Email Accounts
action.hacking.variety.Virtual machine escape Virtual machine escape. Child of 'Exploit vuln'. related-to T1611 Escape to Host
action.hacking.variety.XML external entities XML external entities. Child of 'Exploit vuln'. related-to T1213 Data from Information Repository
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1213 Data from Information Repository
action.hacking.variety.XML injection XML injection. Child of 'Exploit vuln'. related-to T1546 Event Triggered Execution
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1546 Event Triggered Execution
action.malware.variety.Backdoor Backdoor (enable remote access). Child of 'RAT' when combined with 'Trojan' related-to T1546 Event Triggered Execution
attribute.integrity.variety.Alter behavior Influence or alter human behavior related-to T1546 Event Triggered Execution
action.hacking.variety.Unknown Unknown related-to T1574 Hijack Execution Flow
action.hacking.variety.XML injection XML injection. Child of 'Exploit vuln'. related-to T1574 Hijack Execution Flow
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1574 Hijack Execution Flow
action.malware.variety.Backdoor Backdoor (enable remote access). Child of 'RAT' when combined with 'Trojan' related-to T1574 Hijack Execution Flow
action.hacking.variety.XPath injection XPath injection. Child of 'Exploit vuln'. related-to T1010 Application Window Discovery
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1010 Application Window Discovery
action.hacking.variety.Unknown Unknown related-to T1111 Two-Factor Authentication Interception
action.hacking.variety.Unknown Unknown related-to T1583 Acquire Infrastructure
action.malware.vector.Web application - download Web via user-executed or downloaded content. Child of 'Web application'. related-to T1583 Acquire Infrastructure
action.hacking.variety.Unknown Unknown related-to T1583.001 Acquire Infrastructure: Domains
action.malware.variety.C2 Command and control (C2) related-to T1583.001 Acquire Infrastructure: Domains
value_chain.distribution.variety.Other The variety of distribution was known, but is not listed related-to T1583.001 Acquire Infrastructure: Domains
value_chain.non-distribution services.variety.Other The variety of non-distribution service required is known, but is not listed related-to T1583.001 Acquire Infrastructure: Domains
action.hacking.variety.Unknown Unknown related-to T1583.002 Acquire Infrastructure: DNS Server
action.malware.variety.C2 Command and control (C2) related-to T1583.002 Acquire Infrastructure: DNS Server
value_chain.distribution.variety.Other The variety of distribution was known, but is not listed related-to T1583.002 Acquire Infrastructure: DNS Server
value_chain.non-distribution services.variety.Other The variety of non-distribution service required is known, but is not listed related-to T1583.002 Acquire Infrastructure: DNS Server
action.hacking.variety.Unknown Unknown related-to T1584 Compromise Infrastructure
action.malware.vector.Web application - download Web via user-executed or downloaded content. Child of 'Web application'. related-to T1584 Compromise Infrastructure
value_chain.distribution.variety.Other The variety of distribution was known, but is not listed related-to T1584 Compromise Infrastructure
value_chain.non-distribution services.variety.Other The variety of non-distribution service required is known, but is not listed related-to T1584 Compromise Infrastructure
action.hacking.variety.Unknown Unknown related-to T1584.001 Compromise Infrastructure: Domains
action.social.variety.Pretexting Pretexting (dialogue leveraging invented scenario) related-to T1584.001 Compromise Infrastructure: Domains
value_chain.distribution.variety.Other The variety of distribution was known, but is not listed related-to T1584.001 Compromise Infrastructure: Domains
value_chain.non-distribution services.variety.Other The variety of non-distribution service required is known, but is not listed related-to T1584.001 Compromise Infrastructure: Domains
action.hacking.variety.Unknown Unknown related-to T1584.002 Compromise Infrastructure: DNS Server
action.malware.variety.C2 Command and control (C2) related-to T1584.002 Compromise Infrastructure: DNS Server
value_chain.distribution.variety.Compromised server malicious content added to a benign server, such as a webserver, by the actor, without the permission or necessarily knowledge of the server’s owner related-to T1584.002 Compromise Infrastructure: DNS Server
value_chain.non-distribution services.variety.Other The variety of non-distribution service required is known, but is not listed related-to T1584.002 Compromise Infrastructure: DNS Server
action.hacking.variety.Unknown Unknown related-to T1584.003 Compromise Infrastructure: Virtual Private Server
value_chain.distribution.variety.Compromised server malicious content added to a benign server, such as a webserver, by the actor, without the permission or necessarily knowledge of the server’s owner related-to T1584.003 Compromise Infrastructure: Virtual Private Server
value_chain.non-distribution services.variety.Other The variety of non-distribution service required is known, but is not listed related-to T1584.003 Compromise Infrastructure: Virtual Private Server
action.hacking.variety.Unknown Unknown related-to T1584.004 Compromise Infrastructure: Server
value_chain.distribution.variety.Compromised server malicious content added to a benign server, such as a webserver, by the actor, without the permission or necessarily knowledge of the server’s owner related-to T1584.004 Compromise Infrastructure: Server
value_chain.non-distribution services.variety.Other The variety of non-distribution service required is known, but is not listed related-to T1584.004 Compromise Infrastructure: Server
action.hacking.variety.Unknown Unknown related-to T1584.006 Compromise Infrastructure: Web Services

Non-Mappable Capabilities

Non-mappable capabilities are either out of scope or unable to be mapped to any ATT&CK objects
Capability ID Capability Description
action.misuse.result.Exfiltrate The misuse action exfiltrated data from the victim
attribute.integrity.variety.Software installation Software installation or code modification
value_chain.targeting.variety.Vulnerabilities Knowledge of software vulnerabilities, both at an organization or associated with a specific vendor's product, used to pick them as a target.
action.misuse.variety.Data mishandling Handling of data in an unapproved manner
action.hacking.variety.Path traversal Path traversal. Child of 'Exploit vuln'.
action.social.variety.Propaganda Propaganda or disinformation
action.hacking.vector.Other Other
action.hacking.variety.XQuery injection XQuery injection. Child of 'Exploit vuln'.
action.misuse.vector.Remote access Remote access connection to corporate network (i.e. VPN)
action.misuse.vector.Web application Web application
action.malware.result.Unknown The result of the malware action is unknown
action.social.variety.Elicitation Elicitation (subtle extraction of info through conversation)
action.hacking.result.Exfiltrate The hacking action exfiltrated data from the victim
action.misuse.vector.Unknown Unknown
action.social.result.Other The result of the social action is not listed
value_chain.targeting.variety.Other The variety of targeting was known, but is not listed
action.social.vector.Software Software
action.misuse.variety.Illicit content Storage or distribution of illicit content
action.social.result.Infiltrate The social action resulted in additional security access
action.misuse.variety.Net misuse Inappropriate use of network or Web access including cloud services
action.hacking.result.Other The result of the hacking action is not listed
action.social.target.Helpdesk Helpdesk staff
action.social.result.NA The social action did not have a result
action.misuse.variety.Snap picture Actor photographs the confidentiality data variety.
value_chain.distribution.variety.Partner The actor distributed the attack to the victim through a partner, (i.e. supply chain attack).
action.hacking.result.NA The hacking action did not have a result
action.misuse.result.Deploy payload e.g. cryptomining, ransomware, etc
action.social.result.Elevate The social action resulted in additional security permissions
action.hacking.result.Lateral movement The hacking action used security access or permissions already acuired
action.social.result.Exfiltrate The social action exfiltrated data from the victim
action.malware.result.Exfiltrate The malware action exfiltrated data from the victim
action.social.variety.Scam Online scam or hoax (e.g., scareware, 419 scam, auction fraud)
value_chain.non-distribution services.variety.Unknown Nothing is known about the need for or type of non-distribution service investment other than it was present.
action.malware.vector.Email Email. Parent to 'Email attachment', 'Email autoexecute', 'Email link', 'Email unknown'
action.malware.vector.Email autoexecute Email via automatic execution. Child of 'Email'
action.misuse.variety.Unapproved software Use of unapproved software or services
action.social.variety.Bribery Bribery or solicitation
action.misuse.result.Other The result of the misuse action is not listed
action.malware.vector.Email other Email sub-variety known, but not one of those listed (attachment, link, autoexecute, etc). Child of 'Email'
value_chain.non-distribution services.variety.Marketplace Use of a marketplace was required as part of this incident.
action.hacking.result.Unknown The result of the hacking action is unknown
action.hacking.result.Infiltrate The hacking action resulted in additional security access
action.misuse.variety.Unapproved hardware Use of unapproved hardware or devices
action.social.target.Maintenance Maintenance or janitorial staff
action.hacking.result.Elevate The hacking action resulted in additional security permissions
action.malware.result.Deploy payload e.g. cryptomining, ransomware, etc
action.malware.variety.SQL injection SQL injection attack
action.social.target.System admin System or network administrator
action.malware.variety.Other Other
action.misuse.variety.Other Other
action.social.target.Auditor Auditor
action.hacking.variety.Session replay Session replay. Child of 'Exploit vuln'.
action.hacking.variety.Other Other
action.social.target.Cashier Cashier, teller or waiter
value_chain.non-distribution services.variety.Counter AV Services for testing if malware is detected by anti-virus
action.misuse.variety.Privilege abuse Abuse of system access privileges
action.social.variety.Baiting Baiting (planting infected media)
action.social.target.Finance Finance or accounting staff
action.hacking.variety.OS commanding OS commanding. Child of 'Exploit vuln'.
action.social.target.Customer Customer (B2C)
value_chain.targeting.variety.Default credentials Credentials the system came with
attribute.confidentiality.data_disclosure
action.social.variety.Spam Spam (unsolicited or undesired email and advertisements)
action.misuse.variety.Unknown Unknown
value_chain.targeting.variety.Misconfigurations Knowledge of system misconfigurations used to pick an organization as a target
action.malware.result.Lateral movement The malware action used security access or permissions already acuired
value_chain.distribution.variety.Loader malware that loads other malware
action.hacking.variety.RFI Remote file inclusion. Child of 'Exploit vuln'.
value_chain.non-distribution services.variety.Hashcracking i.e. converting hashes into the text that produce them
value_chain.targeting.variety.NA No type of targeting was necessary. (This includes targeted.Targeted since the victim was chosen without targeting.
action.social.vector.In-person In-person
action.misuse.variety.Email misuse Inappropriate use of email or IM
value_chain.targeting.variety.Partner The actor used access to a partner to target the victim.
action.hacking.variety.User breakout Elevation of privilege by another customer in shared environment. Child of 'Exploit vuln'.
action.misuse.result.Unknown The result of the misuse action is unknown
action.misuse.vector.Physical access Physical access within corporate facility
action.misuse.result.NA The misuse action did not have a result
action.social.vector.Social media Social media or networking
action.social.variety.Influence Influence tactics (Leveraging authority or obligation, framing, etc)
value_chain.non-distribution services.variety.C2 Command and control. Separate from distribution of mawlare or bots, this is how they are maintained
action.hacking.vector.Desktop sharing Graphical desktop sharing (RDP, VNC, PCAnywhere, Citrix)
value_chain.development.variety.NA No type of development was necessary
value_chain.non-distribution services.variety.DNS DNS services including fast flux
value_chain.distribution.variety.NA No type of distribution was necessary
action.hacking.variety.Mail command injection Mail command injection. Child of 'Exploit vuln'.
action.social.target.End-user or employee End-user or regular employee not otherwise listed. Parent of 'End-user' or 'Other employee'
action.hacking.variety.SQLi SQL injection. Child of 'Exploit vuln'.
action.hacking.variety.URL redirector abuse URL redirector abuse. Child of 'Exploit vuln'.
value_chain.targeting.variety.Weaknesses Knowledge of weaknesses other than vulnerability and misconfigurations used to pick an organization as a target
action.social.variety.Other Other
action.hacking.variety.Null byte injection Null byte injection. Child of 'Exploit vuln'.
action.social.vector.Documents Documents
action.hacking.variety.Reverse engineering Reverse engineering. Child of 'Exploit vuln'.
action.hacking.vector.Web application Web application
action.social.result.Deploy payload e.g. cryptomining, ransomware, etc
action.malware.variety.Spam Send spam
action.social.vector.SMS SMS or texting
action.misuse.vector.Non-corporate Non-corporate facilities or networks
action.misuse.result.Lateral movement The misuse action used security access or permissions already acuired
value_chain.non-distribution services.variety.Escrow Something kept in the custody of a third party until a condition has been fulfilled.
action.misuse.variety.Possession abuse Abuse of physical access to asset
action.social.variety.Extortion Extortion or blackmail
action.social.vector.IM Instant messaging
action.social.vector.Phone Phone
action.malware.result.Other The result of the malware action is not listed
action.social.target.Partner Partner (B2B)
action.social.target.Unknown Unknown
attribute.integrity.variety.Other Other
action.social.variety.Unknown Unknown
value_chain.distribution.variety.Email Distribution by email including anonymous/one time and spam
action.hacking.variety.Special element injection Special element injection. Child of 'Exploit vuln'.
action.social.target.Other Other
action.hacking.variety.Cache poisoning Cache poisoning. Child of 'Exploit vuln'.
action.social.result.Unknown The result of the social action is unknown
value_chain.distribution.variety.Phone Distribution over the Plain Old Telephone System (POTS).
value_chain.targeting.variety.Unknown Nothing is known about the need for or type of targeting investment other than it was present.
action.social.result.Lateral movement The social action used security access or permissions already acuired
action.misuse.result.Elevate Do not use. Misuse inherently implies having permission so none can be elevated.
action.malware.variety.Downloader Downloader (pull updates or other malware)
action.hacking.vector.Unknown Unknown
action.malware.vector.Email unknown Email but sub-variety (attachment, autoexecute, link, etc) not known. Child of 'Email'
action.social.target.End-user End-user of the victim's products and/or services. Child of 'End-user or employee'
action.social.target.Former employee Former employee
action.hacking.variety.XSS Cross-site scripting. Child of 'Exploit vuln'.
action.social.vector.Other Other
action.social.target.Human resources Human resources staff
action.social.vector.Unknown Unknown
action.social.target.Developer Software developer
action.social.target.Manager Manager or supervisor
action.malware.vector.Other Other
action.misuse.vector.LAN access Local network access within corporate facility
action.hacking.variety.Session prediction Credential or session prediction. Child of 'Exploit vuln'.
action.misuse.result.Infiltrate Do not use. Misuse inherently implies having permission so none can be gained.
value_chain.non-distribution services.variety.Proxy A proxy service (either formally or informally hosted) is used by the actor to obscure their source
action.malware.vector.Unknown Unknown
action.social.target.Call center Call center staff
action.misuse.vector.Other Other
attribute.integrity.variety.Hardware tampering Hardware tampering or physical alteration
action.social.target.Executive Senior staff with legal responsibility such as board members and corporate officers
action.misuse.variety.Unapproved workaround Unapproved workaround or shortcut
value_chain.distribution.variety.Direct Distributed directly from the actor's computer
action.hacking.vector.VPN VPN
action.hacking.variety.SSI injection SSI injection. Child of 'Exploit vuln'.
value_chain.non-distribution services.variety.NA No type of non-distribution service was necessary
action.social.target.Other employee Regular employee not otherwise listed. Child of 'End-user or employee'
action.social.target.Guard Security guard
action.social.vector.Website Website
action.misuse.variety.Knowledge abuse Abuse of private or entrusted knowledge
action.malware.result.NA The malware action did not have a result
action.malware.result.Infiltrate The malware action resulted in additional security access
action.malware.result.Elevate The malware action resulted in additional security permissions
action.hacking.variety.CSRF Cross-site request forgery. Child of 'Exploit vuln'.
action.hacking.result.Deploy payload e.g. cryptomining, ransomware, etc
action.social.vector.Removable media Removable storage media
attribute.integrity.variety.Fraudulent transaction Initiate fraudulent transaction
value_chain.non-distribution services.variety.VPN A VPN service (either formally or informally hosted) is used by the actor to obscure their source