Currently viewing ATT&CK v7.2 which was live between July 8, 2020 and October 26, 2020. Learn more about the versioning system or see the live site.
Register to stream the next session of ATT&CKcon Power Hour November 12
MATRICES
Enterprise
Cloud
Mobile
  1. Home
  2. Matrices
  3. Enterprise

Enterprise Matrix

Below are the tactics and techniques representing the MITRE ATT&CK® Matrix for Enterprise. The Matrix contains information for the following platforms: Windows, macOS, Linux, AWS, GCP, Azure, Azure AD, Office 365, SaaS.

View on the ATT&CK® Navigator
About the Enterprise domain
Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
9 techniques 10 techniques 18 techniques 12 techniques 34 techniques 14 techniques 24 techniques 9 techniques 16 techniques 16 techniques 9 techniques 13 techniques
Drive-by Compromise
Exploit Public-Facing Application
External Remote Services
Hardware Additions
Phishing (3)
=
Replication Through Removable Media
Supply Chain Compromise (3)
=
Trusted Relationship
Valid Accounts (4)
=
Command and Scripting Interpreter (7)
=
Exploitation for Client Execution
Inter-Process Communication (2)
=
Native API
Scheduled Task/Job (5)
=
Shared Modules
Software Deployment Tools
System Services (2)
=
User Execution (2)
=
Windows Management Instrumentation
Account Manipulation (4)
=
BITS Jobs
Boot or Logon Autostart Execution (11)
=
Boot or Logon Initialization Scripts (5)
=
Browser Extensions
Compromise Client Software Binary
Create Account (3)
=
Create or Modify System Process (4)
=
Event Triggered Execution (15)
=
External Remote Services
Hijack Execution Flow (11)
=
Implant Container Image
Office Application Startup (6)
=
Pre-OS Boot (3)
=
Scheduled Task/Job (5)
=
Server Software Component (3)
=
Traffic Signaling (1)
=
Valid Accounts (4)
=
Abuse Elevation Control Mechanism (4)
=
Access Token Manipulation (5)
=
Boot or Logon Autostart Execution (11)
=
Boot or Logon Initialization Scripts (5)
=
Create or Modify System Process (4)
=
Event Triggered Execution (15)
=
Exploitation for Privilege Escalation
Group Policy Modification
Hijack Execution Flow (11)
=
Process Injection (11)
=
Scheduled Task/Job (5)
=
Valid Accounts (4)
=
Abuse Elevation Control Mechanism (4)
=
Access Token Manipulation (5)
=
BITS Jobs
Deobfuscate/Decode Files or Information
Direct Volume Access
Execution Guardrails (1)
=
Exploitation for Defense Evasion
File and Directory Permissions Modification (2)
=
Group Policy Modification
Hide Artifacts (6)
=
Hijack Execution Flow (11)
=
Impair Defenses (6)
=
Indicator Removal on Host (6)
=
Indirect Command Execution
Masquerading (6)
=
Modify Authentication Process (3)
=
Modify Cloud Compute Infrastructure (4)
=
Modify Registry
Obfuscated Files or Information (5)
=
Pre-OS Boot (3)
=
Process Injection (11)
=
Rogue Domain Controller
Rootkit
Signed Binary Proxy Execution (10)
=
Signed Script Proxy Execution (1)
=
Subvert Trust Controls (4)
=
Template Injection
Traffic Signaling (1)
=
Trusted Developer Utilities Proxy Execution (1)
=
Unused/Unsupported Cloud Regions
Use Alternate Authentication Material (4)
=
Valid Accounts (4)
=
Virtualization/Sandbox Evasion (3)
=
XSL Script Processing
Brute Force (4)
=
Credentials from Password Stores (3)
=
Exploitation for Credential Access
Forced Authentication
Input Capture (4)
=
Man-in-the-Middle (1)
=
Modify Authentication Process (3)
=
Network Sniffing
OS Credential Dumping (8)
=
Steal Application Access Token
Steal or Forge Kerberos Tickets (3)
=
Steal Web Session Cookie
Two-Factor Authentication Interception
Unsecured Credentials (6)
=
Account Discovery (4)
=
Application Window Discovery
Browser Bookmark Discovery
Cloud Service Dashboard
Cloud Service Discovery
Domain Trust Discovery
File and Directory Discovery
Network Service Scanning
Network Share Discovery
Network Sniffing
Password Policy Discovery
Peripheral Device Discovery
Permission Groups Discovery (3)
=
Process Discovery
Query Registry
Remote System Discovery
Software Discovery (1)
=
System Information Discovery
System Network Configuration Discovery
System Network Connections Discovery
System Owner/User Discovery
System Service Discovery
System Time Discovery
Virtualization/Sandbox Evasion (3)
=
Exploitation of Remote Services
Internal Spearphishing
Lateral Tool Transfer
Remote Service Session Hijacking (2)
=
Remote Services (6)
=
Replication Through Removable Media
Software Deployment Tools
Taint Shared Content
Use Alternate Authentication Material (4)
=
Archive Collected Data (3)
=
Audio Capture
Automated Collection
Clipboard Data
Data from Cloud Storage Object
Data from Information Repositories (2)
=
Data from Local System
Data from Network Shared Drive
Data from Removable Media
Data Staged (2)
=
Email Collection (3)
=
Input Capture (4)
=
Man in the Browser
Man-in-the-Middle (1)
=
Screen Capture
Video Capture
Application Layer Protocol (4)
=
Communication Through Removable Media
Data Encoding (2)
=
Data Obfuscation (3)
=
Dynamic Resolution (3)
=
Encrypted Channel (2)
=
Fallback Channels
Ingress Tool Transfer
Multi-Stage Channels
Non-Application Layer Protocol
Non-Standard Port
Protocol Tunneling
Proxy (4)
=
Remote Access Software
Traffic Signaling (1)
=
Web Service (3)
=
Automated Exfiltration
Data Transfer Size Limits
Exfiltration Over Alternative Protocol (3)
=
Exfiltration Over C2 Channel
Exfiltration Over Other Network Medium (1)
=
Exfiltration Over Physical Medium (1)
=
Exfiltration Over Web Service (2)
=
Scheduled Transfer
Transfer Data to Cloud Account
Account Access Removal
Data Destruction
Data Encrypted for Impact
Data Manipulation (3)
=
Defacement (2)
=
Disk Wipe (2)
=
Endpoint Denial of Service (4)
=
Firmware Corruption
Inhibit System Recovery
Network Denial of Service (2)
=
Resource Hijacking
Service Stop
System Shutdown/Reboot
Last modified: 02 July 2020
Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
9 techniques 10 techniques 18 techniques 12 techniques 34 techniques 14 techniques 24 techniques 9 techniques 16 techniques 16 techniques 9 techniques 13 techniques
Drive-by Compromise
Exploit Public-Facing Application
External Remote Services
Hardware Additions
=
Phishing (3)
Replication Through Removable Media
=
Supply Chain Compromise (3)
Trusted Relationship
=
Valid Accounts (4)
=
Command and Scripting Interpreter (7)
Exploitation for Client Execution
=
Inter-Process Communication (2)
Native API
=
Scheduled Task/Job (5)
Shared Modules
Software Deployment Tools
=
System Services (2)
=
User Execution (2)
Windows Management Instrumentation
=
Account Manipulation (4)
BITS Jobs
=
Boot or Logon Autostart Execution (11)
=
Boot or Logon Initialization Scripts (5)
Browser Extensions
Compromise Client Software Binary
=
Create Account (3)
=
Create or Modify System Process (4)
=
Event Triggered Execution (15)
External Remote Services
=
Hijack Execution Flow (11)
Implant Container Image
=
Office Application Startup (6)
=
Pre-OS Boot (3)
=
Scheduled Task/Job (5)
=
Server Software Component (3)
=
Traffic Signaling (1)
=
Valid Accounts (4)
=
Abuse Elevation Control Mechanism (4)
=
Access Token Manipulation (5)
=
Boot or Logon Autostart Execution (11)
=
Boot or Logon Initialization Scripts (5)
=
Create or Modify System Process (4)
=
Event Triggered Execution (15)
Exploitation for Privilege Escalation
Group Policy Modification
=
Hijack Execution Flow (11)
=
Process Injection (11)
=
Scheduled Task/Job (5)
=
Valid Accounts (4)
=
Abuse Elevation Control Mechanism (4)
=
Access Token Manipulation (5)
BITS Jobs
Deobfuscate/Decode Files or Information
Direct Volume Access
=
Execution Guardrails (1)
Exploitation for Defense Evasion
=
File and Directory Permissions Modification (2)
Group Policy Modification
=
Hide Artifacts (6)
=
Hijack Execution Flow (11)
=
Impair Defenses (6)
=
Indicator Removal on Host (6)
Indirect Command Execution
=
Masquerading (6)
=
Modify Authentication Process (3)
=
Modify Cloud Compute Infrastructure (4)
Modify Registry
=
Obfuscated Files or Information (5)
=
Pre-OS Boot (3)
=
Process Injection (11)
Rogue Domain Controller
Rootkit
=
Signed Binary Proxy Execution (10)
=
Signed Script Proxy Execution (1)
=
Subvert Trust Controls (4)
Template Injection
=
Traffic Signaling (1)
=
Trusted Developer Utilities Proxy Execution (1)
Unused/Unsupported Cloud Regions
=
Use Alternate Authentication Material (4)
=
Valid Accounts (4)
=
Virtualization/Sandbox Evasion (3)
XSL Script Processing
=
Brute Force (4)
=
Credentials from Password Stores (3)
Exploitation for Credential Access
Forced Authentication
=
Input Capture (4)
=
Man-in-the-Middle (1)
=
Modify Authentication Process (3)
Network Sniffing
=
OS Credential Dumping (8)
Steal Application Access Token
=
Steal or Forge Kerberos Tickets (3)
Steal Web Session Cookie
Two-Factor Authentication Interception
=
Unsecured Credentials (6)
=
Account Discovery (4)
Application Window Discovery
Browser Bookmark Discovery
Cloud Service Dashboard
Cloud Service Discovery
Domain Trust Discovery
File and Directory Discovery
Network Service Scanning
Network Share Discovery
Network Sniffing
Password Policy Discovery
Peripheral Device Discovery
=
Permission Groups Discovery (3)
Process Discovery
Query Registry
Remote System Discovery
=
Software Discovery (1)
System Information Discovery
System Network Configuration Discovery
System Network Connections Discovery
System Owner/User Discovery
System Service Discovery
System Time Discovery
=
Virtualization/Sandbox Evasion (3)
Exploitation of Remote Services
Internal Spearphishing
Lateral Tool Transfer
=
Remote Service Session Hijacking (2)
=
Remote Services (6)
Replication Through Removable Media
Software Deployment Tools
Taint Shared Content
=
Use Alternate Authentication Material (4)
=
Archive Collected Data (3)
Audio Capture
Automated Collection
Clipboard Data
Data from Cloud Storage Object
=
Data from Information Repositories (2)
Data from Local System
Data from Network Shared Drive
Data from Removable Media
=
Data Staged (2)
=
Email Collection (3)
=
Input Capture (4)
Man in the Browser
=
Man-in-the-Middle (1)
Screen Capture
Video Capture
=
Application Layer Protocol (4)
Communication Through Removable Media
=
Data Encoding (2)
=
Data Obfuscation (3)
=
Dynamic Resolution (3)
=
Encrypted Channel (2)
Fallback Channels
Ingress Tool Transfer
Multi-Stage Channels
Non-Application Layer Protocol
Non-Standard Port
Protocol Tunneling
=
Proxy (4)
Remote Access Software
=
Traffic Signaling (1)
=
Web Service (3)
Automated Exfiltration
Data Transfer Size Limits
=
Exfiltration Over Alternative Protocol (3)
Exfiltration Over C2 Channel
=
Exfiltration Over Other Network Medium (1)
=
Exfiltration Over Physical Medium (1)
=
Exfiltration Over Web Service (2)
Scheduled Transfer
Transfer Data to Cloud Account
Account Access Removal
Data Destruction
Data Encrypted for Impact
=
Data Manipulation (3)
=
Defacement (2)
=
Disk Wipe (2)
=
Endpoint Denial of Service (4)
Firmware Corruption
Inhibit System Recovery
=
Network Denial of Service (2)
Resource Hijacking
Service Stop
System Shutdown/Reboot
Last modified: 02 July 2020