MITRE ATT&CK coverage
Rules in this catalog reference 171 of the 222 enterprise techniques in ATT&CK v19.2. Coverage reflects rule tags only — it does not claim complete detection coverage of any technique.
- no rules
- 1 rule
- 2–4 rules
- 5–14 rules
- 15+ rules
Credential Access
16/17 techniques with rules
- Adversary-in-the-Middle
T1557- Name Resolution Poisoning and SMB RelayT1557.001 (10)
- DHCP SpoofingT1557.003 (1)
- Brute Force
T1110- Password GuessingT1110.001 (3)
- Password CrackingT1110.002 (1)
- Credentials from Password Stores
T1555- KeychainT1555.001 (1)
- Credentials from Web BrowsersT1555.003 (8)
- Windows Credential ManagerT1555.004 (4)
- Password ManagersT1555.005 (1)
- Exploitation for Credential Access
T1212 - Forced Authentication
T1187 - Forge Web Credentials
T1606 - Input Capture
T1056- KeyloggingT1056.001 (3)
- GUI Input CaptureT1056.002 (3)
- Modify Authentication Process
T1556- Password Filter DLLT1556.002 (3)
- Network Device AuthenticationT1556.004 (1)
- Multi-Factor AuthenticationT1556.006 (3)
- Multi-Factor Authentication Interception
T1111No rules
- Multi-Factor Authentication Request Generation
T1621 - Network Sniffing
T1040 - OS Credential Dumping
T1003- LSASS MemoryT1003.001 (79)
- Security Account ManagerT1003.002 (28)
- NTDST1003.003 (24)
- LSA SecretsT1003.004 (12)
- Cached Domain CredentialsT1003.005 (8)
- DCSyncT1003.006 (7)
- Steal Application Access Token
T1528 - Steal or Forge Authentication Certificates
T1649 - Steal or Forge Kerberos Tickets
T1558- Golden TicketT1558.001 (1)
- Silver TicketT1558.002 (1)
- KerberoastingT1558.003 (18)
- Steal Web Session Cookie
T1539 - Unsecured Credentials
T1552- Credentials In FilesT1552.001 (24)
- Credentials in RegistryT1552.002 (5)
- Shell HistoryT1552.003 (3)
- Private KeysT1552.004 (7)
- Group Policy PreferencesT1552.006 (6)
- Container APIT1552.007 (4)
Defense Impairment
12/18 techniques with rules
- Disable or Modify System Firewall
T1686- Cloud FirewallT1686.001 (5)
- Network Device FirewallT1686.002 (2)
- Windows Host FirewallT1686.003 (20)
- Disable or Modify Tools
T1685- Disable or Modify Windows Event LogT1685.001 (28)
- Disable or Modify Cloud LogT1685.002 (3)
- Disable or Modify Linux Audit System LogT1685.004 (1)
- Clear Windows Event LogsT1685.005 (8)
- Clear Linux or Mac System LogsT1685.006 (4)
- Domain or Tenant Policy Modification
T1484- Group Policy ModificationT1484.001 (6)
- Trust ModificationT1484.002 (2)
- Downgrade Attack
T1689 - Exploitation for Defense Impairment
T1687No rules
- File and Directory Permissions Modification
T1222- Windows PermissionsT1222.001 (5)
- Linux and Mac PermissionsT1222.002 (4)
- Modify Authentication Process
T1556- Password Filter DLLT1556.002 (3)
- Network Device AuthenticationT1556.004 (1)
- Multi-Factor AuthenticationT1556.006 (3)
- Modify Cloud Compute Infrastructure
T1578- Delete Cloud InstanceT1578.003 (1)
- Modify Cloud Resource Hierarchy
T1666No rules
- Modify Registry
T1112 - Modify System Image
T1601No rules
- Network Boundary Bridging
T1599- Network Address Translation TraversalT1599.001 (1)
- Plist File Modification
T1647No rules
- Prevent Command History Logging
T1690 - Rogue Domain Controller
T1207 - Safe Mode Boot
T1688No rules
- Subvert Trust Controls
T1553- Gatekeeper BypassT1553.001 (1)
- Code SigningT1553.002 (1)
- SIP and Trust Provider HijackingT1553.003 (2)
- Install Root CertificateT1553.004 (10)
- Mark-of-the-Web BypassT1553.005 (6)
- Weaken Encryption
T1600No rules
Execution
14/20 techniques with rules
- BITS Jobs
T1197 - Cloud Administration Command
T1651No rules
- Command and Scripting Interpreter
T1059- PowerShellT1059.001 (220)
- AppleScriptT1059.002 (9)
- Windows Command ShellT1059.003 (46)
- Unix ShellT1059.004 (18)
- Visual BasicT1059.005 (29)
- PythonT1059.006 (13)
- JavaScriptT1059.007 (29)
- Cloud APIT1059.009 (3)
- Hypervisor CLIT1059.012 (9)
- Container Administration Command
T1609 - Deploy Container
T1610No rules
- ESXi Administration Command
T1675No rules
- Exploitation for Client Execution
T1203 - Hijack Execution Flow
T1574- DLLT1574.001 (93)
- Executable Installer File Permissions WeaknessT1574.005 (2)
- Dynamic Linker HijackingT1574.006 (2)
- Path Interception by PATH Environment VariableT1574.007 (2)
- Path Interception by Search Order HijackingT1574.008 (2)
- Services Registry Permissions WeaknessT1574.011 (11)
- COR_PROFILERT1574.012 (2)
- Input Injection
T1674No rules
- Inter-Process Communication
T1559- Component Object ModelT1559.001 (4)
- Dynamic Data ExchangeT1559.002 (1)
- Native API
T1106 - Poisoned Pipeline Execution
T1677No rules
- Scheduled Task/Job
T1053- AtT1053.002 (8)
- CronT1053.003 (6)
- Scheduled TaskT1053.005 (51)
- Serverless Execution
T1648No rules
- Shared Modules
T1129 - Software Deployment Tools
T1072 - System Services
T1569- LaunchctlT1569.001 (1)
- Service ExecutionT1569.002 (43)
- Trusted Developer Utilities Proxy Execution
T1127- MSBuildT1127.001 (1)
- User Execution
T1204- Malicious LinkT1204.001 (4)
- Malicious FileT1204.002 (39)
- Malicious Copy and PasteT1204.004 (6)
- Windows Management Instrumentation
T1047
Impact
13/15 techniques with rules
- Account Access Removal
T1531 - Data Destruction
T1485 - Data Encrypted for Impact
T1486 - Data Manipulation
T1565- Stored Data ManipulationT1565.001 (6)
- Transmitted Data ManipulationT1565.002 (2)
- Defacement
T1491- Internal DefacementT1491.001 (4)
- Disk Wipe
T1561- Disk Content WipeT1561.001 (1)
- Disk Structure WipeT1561.002 (1)
- Email Bombing
T1667No rules
- Endpoint Denial of Service
T1499- OS Exhaustion FloodT1499.001 (1)
- Application or System ExploitationT1499.004 (3)
- Financial Theft
T1657No rules
- Firmware Corruption
T1495 - Inhibit System Recovery
T1490 - Network Denial of Service
T1498 - Resource Hijacking
T1496 - Service Stop
T1489 - System Shutdown/Reboot
T1529
Persistence
19/22 techniques with rules
- Account Manipulation
T1098- Additional Cloud CredentialsT1098.001 (3)
- Additional Cloud RolesT1098.003 (7)
- Device RegistrationT1098.005 (1)
- BITS Jobs
T1197 - Boot or Logon Autostart Execution
T1547- Registry Run Keys / Startup FolderT1547.001 (39)
- Authentication PackageT1547.002 (1)
- Time ProvidersT1547.003 (1)
- Winlogon Helper DLLT1547.004 (4)
- Security Support ProviderT1547.005 (1)
- Kernel Modules and ExtensionsT1547.006 (2)
- LSASS DriverT1547.008 (1)
- Shortcut ModificationT1547.009 (4)
- Port MonitorsT1547.010 (4)
- Active SetupT1547.014 (1)
- Login ItemsT1547.015 (1)
- Boot or Logon Initialization Scripts
T1037- Logon Script (Windows)T1037.001 (3)
- Startup ItemsT1037.005 (1)
- Cloud Application Integration
T1671No rules
- Compromise Host Software Binary
T1554 - Create Account
T1136- Local AccountT1136.001 (18)
- Domain AccountT1136.002 (6)
- Cloud AccountT1136.003 (3)
- Create or Modify System Process
T1543- Launch AgentT1543.001 (2)
- Systemd ServiceT1543.002 (4)
- Windows ServiceT1543.003 (47)
- Launch DaemonT1543.004 (3)
- Event Triggered Execution
T1546- Change Default File AssociationT1546.001 (5)
- ScreensaverT1546.002 (4)
- Windows Management Instrumentation Event SubscriptionT1546.003 (12)
- Unix Shell Configuration ModificationT1546.004 (1)
- Netsh Helper DLLT1546.007 (4)
- Accessibility FeaturesT1546.008 (6)
- AppCert DLLsT1546.009 (2)
- AppInit DLLsT1546.010 (1)
- Application ShimmingT1546.011 (6)
- Image File Execution Options InjectionT1546.012 (2)
- PowerShell ProfileT1546.013 (3)
- EmondT1546.014 (1)
- Component Object Model HijackingT1546.015 (9)
- Exclusive Control
T1668No rules
- External Remote Services
T1133 - Implant Internal Image
T1525 - Modify Authentication Process
T1556- Password Filter DLLT1556.002 (3)
- Network Device AuthenticationT1556.004 (1)
- Multi-Factor AuthenticationT1556.006 (3)
- Modify Registry
T1112 - Office Application Startup
T1137- Office TestT1137.002 (2)
- Outlook FormsT1137.003 (1)
- Add-insT1137.006 (4)
- Power Settings
T1653 - Pre-OS Boot
T1542- System FirmwareT1542.001 (2)
- BootkitT1542.003 (1)
- Scheduled Task/Job
T1053- AtT1053.002 (8)
- CronT1053.003 (6)
- Scheduled TaskT1053.005 (51)
- Server Software Component
T1505- SQL Stored ProceduresT1505.001 (2)
- Transport AgentT1505.002 (3)
- Web ShellT1505.003 (35)
- IIS ComponentsT1505.004 (5)
- Terminal Services DLLT1505.005 (1)
- Software Extensions
T1176- Browser ExtensionsT1176.001 (2)
- Traffic Signaling
T1205No rules
- Valid Accounts
T1078- Default AccountsT1078.001 (4)
- Domain AccountsT1078.002 (7)
- Local AccountsT1078.003 (5)
- Cloud AccountsT1078.004 (41)
Privilege Escalation
13/13 techniques with rules
- Abuse Elevation Control Mechanism
T1548- Setuid and SetgidT1548.001 (2)
- Bypass User Account ControlT1548.002 (56)
- Sudo and Sudo CachingT1548.003 (3)
- Access Token Manipulation
T1134- Token Impersonation/TheftT1134.001 (9)
- Create Process with TokenT1134.002 (7)
- Make and Impersonate TokenT1134.003 (4)
- Parent PID SpoofingT1134.004 (1)
- SID-History InjectionT1134.005 (1)
- Account Manipulation
T1098- Additional Cloud CredentialsT1098.001 (3)
- Additional Cloud RolesT1098.003 (7)
- Device RegistrationT1098.005 (1)
- Boot or Logon Autostart Execution
T1547- Registry Run Keys / Startup FolderT1547.001 (39)
- Authentication PackageT1547.002 (1)
- Time ProvidersT1547.003 (1)
- Winlogon Helper DLLT1547.004 (4)
- Security Support ProviderT1547.005 (1)
- Kernel Modules and ExtensionsT1547.006 (2)
- LSASS DriverT1547.008 (1)
- Shortcut ModificationT1547.009 (4)
- Port MonitorsT1547.010 (4)
- Active SetupT1547.014 (1)
- Login ItemsT1547.015 (1)
- Boot or Logon Initialization Scripts
T1037- Logon Script (Windows)T1037.001 (3)
- Startup ItemsT1037.005 (1)
- Create or Modify System Process
T1543- Launch AgentT1543.001 (2)
- Systemd ServiceT1543.002 (4)
- Windows ServiceT1543.003 (47)
- Launch DaemonT1543.004 (3)
- Domain or Tenant Policy Modification
T1484- Group Policy ModificationT1484.001 (6)
- Trust ModificationT1484.002 (2)
- Escape to Host
T1611 - Event Triggered Execution
T1546- Change Default File AssociationT1546.001 (5)
- ScreensaverT1546.002 (4)
- Windows Management Instrumentation Event SubscriptionT1546.003 (12)
- Unix Shell Configuration ModificationT1546.004 (1)
- Netsh Helper DLLT1546.007 (4)
- Accessibility FeaturesT1546.008 (6)
- AppCert DLLsT1546.009 (2)
- AppInit DLLsT1546.010 (1)
- Application ShimmingT1546.011 (6)
- Image File Execution Options InjectionT1546.012 (2)
- PowerShell ProfileT1546.013 (3)
- EmondT1546.014 (1)
- Component Object Model HijackingT1546.015 (9)
- Exploitation for Privilege Escalation
T1068 - Process Injection
T1055- Dynamic-link Library InjectionT1055.001 (8)
- Thread Execution HijackingT1055.003 (2)
- Proc MemoryT1055.009 (2)
- Extra Window Memory InjectionT1055.011 (1)
- Process HollowingT1055.012 (5)
- Scheduled Task/Job
T1053- AtT1053.002 (8)
- CronT1053.003 (6)
- Scheduled TaskT1053.005 (51)
- Valid Accounts
T1078- Default AccountsT1078.001 (4)
- Domain AccountsT1078.002 (7)
- Local AccountsT1078.003 (5)
- Cloud AccountsT1078.004 (41)
Lateral Movement
7/9 techniques with rules
- Exploitation of Remote Services
T1210 - Internal Spearphishing
T1534No rules
- Lateral Tool Transfer
T1570 - Remote Service Session Hijacking
T1563- RDP HijackingT1563.002 (2)
- Remote Services
T1021- Remote Desktop ProtocolT1021.001 (16)
- SMB/Windows Admin SharesT1021.002 (38)
- Distributed Component Object ModelT1021.003 (13)
- SSHT1021.004 (5)
- VNCT1021.005 (1)
- Windows Remote ManagementT1021.006 (11)
- Cloud ServicesT1021.007 (1)
- Replication Through Removable Media
T1091 - Software Deployment Tools
T1072 - Taint Shared Content
T1080No rules
- Use Alternate Authentication Material
T1550- Application Access TokenT1550.001 (4)
- Pass the HashT1550.002 (6)
- Pass the TicketT1550.003 (7)
Stealth
23/30 techniques with rules
- Access Token Manipulation
T1134- Token Impersonation/TheftT1134.001 (9)
- Create Process with TokenT1134.002 (7)
- Make and Impersonate TokenT1134.003 (4)
- Parent PID SpoofingT1134.004 (1)
- SID-History InjectionT1134.005 (1)
- BITS Jobs
T1197 - Build Image on Host
T1612No rules
- Debugger Evasion
T1622 - Delay Execution
T1678No rules
- Deobfuscate/Decode Files or Information
T1140 - Direct Volume Access
T1006 - Execution Guardrails
T1480No rules
- Exploitation for Stealth
T1211 - Hide Artifacts
T1564- Hidden Files and DirectoriesT1564.001 (9)
- Hidden UsersT1564.002 (4)
- Hidden WindowT1564.003 (8)
- NTFS File AttributesT1564.004 (23)
- Run Virtual InstanceT1564.006 (2)
- Email Hiding RulesT1564.008 (4)
- Hijack Execution Flow
T1574- DLLT1574.001 (93)
- Executable Installer File Permissions WeaknessT1574.005 (2)
- Dynamic Linker HijackingT1574.006 (2)
- Path Interception by PATH Environment VariableT1574.007 (2)
- Path Interception by Search Order HijackingT1574.008 (2)
- Services Registry Permissions WeaknessT1574.011 (11)
- COR_PROFILERT1574.012 (2)
- Indicator Removal
T1070- Clear Command HistoryT1070.003 (9)
- File DeletionT1070.004 (15)
- Network Share Connection RemovalT1070.005 (4)
- TimestompT1070.006 (6)
- Clear Mailbox DataT1070.008 (2)
- Indirect Command Execution
T1202 - Masquerading
T1036- Right-to-Left OverrideT1036.002 (3)
- Rename Legitimate UtilitiesT1036.003 (27)
- Masquerade Task or ServiceT1036.004 (3)
- Match Legitimate Resource Name or LocationT1036.005 (21)
- Space after FilenameT1036.006 (1)
- Double File ExtensionT1036.007 (3)
- Masquerade File TypeT1036.008 (1)
- Obfuscated Files or Information
T1027- Binary PaddingT1027.001 (3)
- Software PackingT1027.002 (1)
- SteganographyT1027.003 (5)
- Compile After DeliveryT1027.004 (6)
- Indicator Removal from ToolsT1027.005 (4)
- Embedded PayloadsT1027.009 (2)
- Command ObfuscationT1027.010 (10)
- Fileless StorageT1027.011 (1)
- Pre-OS Boot
T1542- System FirmwareT1542.001 (2)
- BootkitT1542.003 (1)
- Process Injection
T1055- Dynamic-link Library InjectionT1055.001 (8)
- Thread Execution HijackingT1055.003 (2)
- Proc MemoryT1055.009 (2)
- Extra Window Memory InjectionT1055.011 (1)
- Process HollowingT1055.012 (5)
- Reflective Code Loading
T1620 - Rootkit
T1014 - Selective Exclusion
T1679No rules
- Social Engineering
T1684No rules
- System Binary Proxy Execution
T1218- Compiled HTML FileT1218.001 (6)
- Control PanelT1218.002 (1)
- CMSTPT1218.003 (7)
- MshtaT1218.005 (8)
- MsiexecT1218.007 (10)
- OdbcconfT1218.008 (8)
- Regsvcs/RegasmT1218.009 (4)
- Regsvr32T1218.010 (19)
- Rundll32T1218.011 (43)
- MavinjectT1218.013 (2)
- MMCT1218.014 (2)
- System Script Proxy Execution
T1216- PubPrnT1216.001 (2)
- Template Injection
T1221 - Traffic Signaling
T1205No rules
- Trusted Developer Utilities Proxy Execution
T1127- MSBuildT1127.001 (1)
- Unused/Unsupported Cloud Regions
T1535No rules
- Valid Accounts
T1078- Default AccountsT1078.001 (4)
- Domain AccountsT1078.002 (7)
- Local AccountsT1078.003 (5)
- Cloud AccountsT1078.004 (41)
- Virtualization/Sandbox Evasion
T1497- System ChecksT1497.001 (3)
- XSL Script Processing
T1220
Exfiltration
6/9 techniques with rules
- Automated Exfiltration
T1020 - Data Transfer Size Limits
T1030 - Exfiltration Over Alternative Protocol
T1048- Exfiltration Over Symmetric Encrypted Non-C2 ProtocolT1048.001 (1)
- Exfiltration Over Unencrypted Non-C2 ProtocolT1048.003 (9)
- Exfiltration Over C2 Channel
T1041 - Exfiltration Over Other Network Medium
T1011No rules
- Exfiltration Over Physical Medium
T1052No rules
- Exfiltration Over Web Service
T1567- Exfiltration to Code RepositoryT1567.001 (2)
- Exfiltration to Cloud StorageT1567.002 (14)
- Scheduled Transfer
T1029No rules
- Transfer Data to Cloud Account
T1537
Discovery
29/34 techniques with rules
- Account Discovery
T1087- Local AccountT1087.001 (13)
- Domain AccountT1087.002 (21)
- Cloud AccountT1087.004 (3)
- Application Window Discovery
T1010 - Browser Information Discovery
T1217 - Cloud Infrastructure Discovery
T1580 - Cloud Service Dashboard
T1538No rules
- Cloud Service Discovery
T1526 - Cloud Storage Object Discovery
T1619 - Container and Resource Discovery
T1613 - Debugger Evasion
T1622 - Device Driver Discovery
T1652No rules
- Domain Trust Discovery
T1482 - File and Directory Discovery
T1083 - Group Policy Discovery
T1615 - Local Storage Discovery
T1680No rules
- Log Enumeration
T1654No rules
- Network Service Discovery
T1046 - Network Share Discovery
T1135 - Network Sniffing
T1040 - Password Policy Discovery
T1201 - Peripheral Device Discovery
T1120 - Permission Groups Discovery
T1069- Local GroupsT1069.001 (16)
- Domain GroupsT1069.002 (15)
- Cloud GroupsT1069.003 (1)
- Process Discovery
T1057 - Query Registry
T1012 - Remote System Discovery
T1018 - Software Discovery
T1518- Security Software DiscoveryT1518.001 (9)
- System Information Discovery
T1082 - System Location Discovery
T1614- System Language DiscoveryT1614.001 (2)
- System Network Configuration Discovery
T1016 - System Network Connections Discovery
T1049 - System Owner/User Discovery
T1033 - System Service Discovery
T1007 - System Time Discovery
T1124 - Virtual Machine Discovery
T1673No rules
- Virtualization/Sandbox Evasion
T1497- System ChecksT1497.001 (3)
Collection
14/17 techniques with rules
- Adversary-in-the-Middle
T1557- Name Resolution Poisoning and SMB RelayT1557.001 (10)
- DHCP SpoofingT1557.003 (1)
- Archive Collected Data
T1560- Archive via UtilityT1560.001 (17)
- Audio Capture
T1123 - Automated Collection
T1119 - Browser Session Hijacking
T1185 - Clipboard Data
T1115 - Data from Cloud Storage
T1530No rules
- Data from Configuration Repository
T1602No rules
- Data from Information Repositories
T1213- Code RepositoriesT1213.003 (5)
- Data from Local System
T1005 - Data from Network Shared Drive
T1039 - Data from Removable Media
T1025No rules
- Data Staged
T1074- Local Data StagingT1074.001 (4)
- Email Collection
T1114- Local Email CollectionT1114.001 (1)
- Email Forwarding RuleT1114.003 (6)
- Input Capture
T1056- KeyloggingT1056.001 (3)
- GUI Input CaptureT1056.002 (3)
- Screen Capture
T1113 - Video Capture
T1125
Resource Development
5/9 techniques with rules
- Acquire Access
T1650No rules
- Acquire Infrastructure
T1583No rules
- Compromise Accounts
T1586- Cloud AccountsT1586.003 (1)
- Compromise Infrastructure
T1584 - Develop Capabilities
T1587- MalwareT1587.001 (11)
- Establish Accounts
T1585No rules
- Generate Content
T1683No rules
- Obtain Capabilities
T1588- MalwareT1588.001 (1)
- ToolT1588.002 (9)
- Stage Capabilities
T1608- Install Digital CertificateT1608.003 (1)
Reconnaissance
7/12 techniques with rules
- Active Scanning
T1595- Scanning IP BlocksT1595.001 (1)
- Vulnerability ScanningT1595.002 (1)
- Gather Victim Host Information
T1592- Client ConfigurationsT1592.004 (3)
- Gather Victim Identity Information
T1589- Email AddressesT1589.002 (1)
- Gather Victim Network Information
T1590- Domain PropertiesT1590.001 (1)
- DNST1590.002 (1)
- Gather Victim Org Information
T1591- Identify RolesT1591.004 (2)
- Phishing for Information
T1598- Spearphishing AttachmentT1598.002 (1)
- Query Public AI Services
T1682No rules
- Search Closed Sources
T1597No rules
- Search Open Technical Databases
T1596No rules
- Search Open Websites/Domains
T1593- Code RepositoriesT1593.003 (2)
- Search Threat Vendor Data
T1681No rules
- Search Victim-Owned Websites
T1594No rules
Command and Control
13/18 techniques with rules
- Application Layer Protocol
T1071- Web ProtocolsT1071.001 (42)
- DNST1071.004 (17)
- Communication Through Removable Media
T1092No rules
- Content Injection
T1659No rules
- Data Encoding
T1132- Standard EncodingT1132.001 (4)
- Data Obfuscation
T1001- Protocol or Service ImpersonationT1001.003 (2)
- Dynamic Resolution
T1568- Domain Generation AlgorithmsT1568.002 (2)
- Encrypted Channel
T1573 - Fallback Channels
T1008 - Hide Infrastructure
T1665No rules
- Ingress Tool Transfer
T1105 - Multi-Stage Channels
T1104No rules
- Non-Application Layer Protocol
T1095 - Non-Standard Port
T1571 - Protocol Tunneling
T1572 - Proxy
T1090- Internal ProxyT1090.001 (6)
- External ProxyT1090.002 (2)
- Multi-hop ProxyT1090.003 (3)
- Domain FrontingT1090.004 (1)
- Remote Access Tools
T1219- Remote Desktop SoftwareT1219.002 (46)
- Traffic Signaling
T1205No rules
- Web Service
T1102- Dead Drop ResolverT1102.001 (4)
- Bidirectional CommunicationT1102.002 (4)
- One-Way CommunicationT1102.003 (2)
Initial Access
9/11 techniques with rules
- Content Injection
T1659No rules
- Drive-by Compromise
T1189 - Exploit Public-Facing Application
T1190 - External Remote Services
T1133 - Hardware Additions
T1200 - Phishing
T1566- Spearphishing AttachmentT1566.001 (24)
- Spearphishing LinkT1566.002 (4)
- Replication Through Removable Media
T1091 - Supply Chain Compromise
T1195- Compromise Software Dependencies and Development ToolsT1195.001 (2)
- Compromise Software Supply ChainT1195.002 (17)
- Trusted Relationship
T1199 - Valid Accounts
T1078- Default AccountsT1078.001 (4)
- Domain AccountsT1078.002 (7)
- Local AccountsT1078.003 (5)
- Cloud AccountsT1078.004 (41)
- Wi-Fi Networks
T1669No rules