ENTERPRISE FRAMEWORK

MITRE ATT&CK Technique Matrix

Adversary techniques substantiated with verbatim evidence excerpts from federal indictments, sentencing memorandums, and official government advisories.

Key Facts

97 MITRE ATT&CK techniques and sub-techniques cataloged.
84 techniques substantiated with verbatim primary evidence excerpts.
Organized across enterprise tactics from Initial Access through Impact.
Every mapped technique cites specific page numbers or paragraph locators in court filings.

Initial Access

9 techniques

Exploit Public-Facing Application

T1566.001 10 cases

Spearphishing Attachment

T1566.002 8 cases

Spearphishing Link

T1566.004 3 cases

Spearphishing Voice

T1195.002 2 cases

Compromise Software Supply Chain

External Remote Services

T1195.001 1 case

Compromise Software Dependencies and Development Tools

Cloud Accounts

Phishing

Execution

6 techniques

T1059.001 3 cases

PowerShell

Command and Scripting Interpreter

T1059.003 1 case

Windows Command Shell

T1569.002 1 case

Service Execution

Windows Management Instrumentation

Cloud Administration Command

Persistence

9 techniques

T1574.002 2 cases

DLL Side-Loading

T1053.005 1 case

Scheduled Task

T1547.001 1 case

Registry Run Keys / Startup Folder

T1543.003 1 case

Windows Service

T1546.003 1 case

Windows Management Instrumentation Event Subscription

T1505.003 1 case

Web Shell

T1574.006 1 case

Dynamic Linker Hijacking

Account Manipulation

Pre-OS Boot

Privilege Escalation

2 techniques

T1548.002 1 case

Bypass User Account Control

Exploitation for Privilege Escalation

Defense Evasion

9 techniques

Valid Accounts

T1562.001 3 cases

Disable or Modify Tools

Process Injection

Indicator Removal

Obfuscated Files or Information

T1055.012 1 case

Process Hollowing

Masquerading

T1036.005 1 case

Match Legitimate Name or Location

Modify Registry

Credential Access

9 techniques

OS Credential Dumping

T1056.001 7 cases

Keylogging

Credentials from Password Stores

Brute Force

T1558.003 1 case

Kerberoasting

Network Sniffing

Steal Web Session Cookie

Adversary-in-the-Middle

Password Spraying

Discovery

10 techniques

System Information Discovery

Account Discovery

File and Directory Discovery

Process Discovery

Network Service Discovery

System Service Discovery

Remote System Discovery

System Network Configuration Discovery

System Owner/User Discovery

System Time Discovery

Lateral Movement

6 techniques

T1021.002 3 cases

SMB / Windows Admin Shares

T1021.001 1 case

Remote Desktop Protocol

Lateral Tool Transfer

Replication Through Removable Media

Exploitation of Remote Services

SSH Lateral Movement

Collection

8 techniques

Screen Capture

Data from Cloud Storage

Archive Collected Data

T1560.001 1 case

Archive via Utility

T1074.001 1 case

Local Data Staging

T1114.002 1 case

Remote Email Collection

Data from Local System

Browser Session Hijacking

Command and Control

10 techniques

Proxy

T1071.001 3 cases

Web Protocols

Data Encoding

T1001.002 1 case

Steganography

Web Service: Dead Drop Resolver

Non-Standard Port

Encrypted Channel

T1071.004 1 case

DNS Tunneling

T1090.003 1 case

Multi-hop Proxy

Ingress Tool Transfer

Exfiltration

5 techniques

Exfiltration Over Web Service

Exfiltration Over C2 Channel

T1567.002 2 cases

Exfiltration to Cloud Storage

Automated Exfiltration

Exfiltration Over Alternative Protocol

Impact

8 techniques

Data Encrypted for Impact

Data Destruction

Inhibit System Recovery

Service Stop

Network Denial of Service

Endpoint Denial of Service

Firmware Corruption

Stored Data Manipulation

Resource Development

3 techniques

Compromise Infrastructure

T1588.002 1 case

Obtain Tool

T1583.001 1 case

Domains

Impair Process Control

3 techniques

Brute Force I/O

Manipulation of Control

Change Operating Mode