detection.wiki

ATT&CK Detection Rule Coverage

16127 detection rules mapped to 655 MITRE ATT&CK techniques and sub-techniques. Click a technique to see every rule written for it, grouped by vendor for easy comparison. Use the vendor chips to show or hide each rule source.

Reconnaissance 8

Active Scanning (3)
Gather Victim Network Information (3)
Gather Victim Host Information (3)
Gather Victim Identity Information (3)
Phishing for Information (1)
Gather Victim Org Information (1)
Search Open Websites/Domains (1)
Search Open Technical Databases (1)

Resource Development 7

Compromise Accounts (1)
Develop Capabilities (3)
Obtain Capabilities (3)
Stage Capabilities (3)
Compromise Infrastructure (2)
Acquire Infrastructure (2)
Establish Accounts (1)

Initial Access 10

Valid Accounts (4)
Exploit Public-Facing Application (552)
Phishing (3)
External Remote Services (223)
Supply Chain Compromise (2)
Drive-by Compromise (52)
Trusted Relationship (18)
Hardware Additions (15)
Replication Through Removable Media (11)
Content Injection (4)

Execution 17

Command and Scripting Interpreter (12)
User Execution (5)
Hijack Execution Flow (12)
Scheduled Task/Job (5)
Windows Management Instrumentation (140)
Exploitation for Client Execution (134)
System Services (2)
Trusted Developer Utilities Proxy Execution (2)
Native API (58)
BITS Jobs (39)
Inter-Process Communication (3)
Container Administration Command (36)
Deploy Container (33)
Software Deployment Tools (30)
Cloud Administration Command (27)
Shared Modules (23)
Serverless Execution (17)

Discovery 33

Account Discovery (4)
System Information Discovery (167)
Permission Groups Discovery (3)
Network Service Discovery (101)
Remote System Discovery (86)
System Owner/User Discovery (84)
System Network Configuration Discovery (1)
File and Directory Discovery (71)
Domain Trust Discovery (66)
Container and Resource Discovery (53)
Cloud Service Discovery (49)
Software Discovery (1)
Cloud Infrastructure Discovery (42)
Process Discovery (37)
System Network Connections Discovery (36)
Network Share Discovery (36)
Query Registry (34)
Password Policy Discovery (32)
System Service Discovery (25)
Network Sniffing (25)
Virtualization/Sandbox Evasion (2)
Group Policy Discovery (11)
Cloud Storage Object Discovery (7)
System Time Discovery (6)
Browser Information Discovery (6)
System Location Discovery (1)
Peripheral Device Discovery (5)
Cloud Service Dashboard (4)
Virtual Machine Discovery (4)
Log Enumeration (3)
Application Window Discovery (2)
Debugger Evasion (2)
Device Driver Discovery (1)

Credential Access 17

OS Credential Dumping (8)
Brute Force (4)
Unsecured Credentials (8)
Modify Authentication Process (7)
Credentials from Password Stores (5)
Steal or Forge Kerberos Tickets (5)
Steal Application Access Token (83)
Adversary-in-the-Middle (3)
Input Capture (3)
Steal Web Session Cookie (34)
Steal or Forge Authentication Certificates (34)
Multi-Factor Authentication Request Generation (31)
Forced Authentication (30)
Network Sniffing (25)
Exploitation for Credential Access (23)
Forge Web Credentials (2)
Multi-Factor Authentication Interception (4)

Privilege Escalation 13

Valid Accounts (4)
Account Manipulation (7)
Abuse Elevation Control Mechanism (6)
Process Injection (9)
Boot or Logon Autostart Execution (13)
Create or Modify System Process (5)
Event Triggered Execution (17)
Exploitation for Privilege Escalation (237)
Scheduled Task/Job (5)
Access Token Manipulation (5)
Domain or Tenant Policy Modification (2)
Escape to Host (62)
Boot or Logon Initialization Scripts (4)

Lateral Movement 9

Remote Services (8)
Use Alternate Authentication Material (4)
Exploitation of Remote Services (83)
Lateral Tool Transfer (48)
Software Deployment Tools (30)
Remote Service Session Hijacking (2)
Replication Through Removable Media (11)
Taint Shared Content (4)
Internal Spearphishing (4)

Persistence 21

Valid Accounts (4)
Account Manipulation (7)
Modify Registry (307)
Boot or Logon Autostart Execution (13)
Create or Modify System Process (5)
Event Triggered Execution (17)
Scheduled Task/Job (5)
External Remote Services (223)
Create Account (3)
Modify Authentication Process (7)
Server Software Component (6)
Boot or Logon Initialization Scripts (4)
BITS Jobs (39)
Compromise Host Software Binary (38)
Office Application Startup (6)
Pre-OS Boot (3)
Software Extensions (1)
Implant Internal Image (5)
Redundant Access (3)
Traffic Signaling (1)
Power Settings (1)

Stealth 28

Valid Accounts (4)
System Binary Proxy Execution (13)
Process Injection (9)
Hijack Execution Flow (12)
Masquerading (9)
Obfuscated Files or Information (11)
Indicator Removal (6)
Hide Artifacts (6)
Deobfuscate/Decode Files or Information (100)
Access Token Manipulation (5)
Indirect Command Execution (71)
Trusted Developer Utilities Proxy Execution (2)
Reflective Code Loading (44)
BITS Jobs (39)
Rootkit (38)
Exploitation for Stealth (28)
System Script Proxy Execution (1)
Virtualization/Sandbox Evasion (2)
XSL Script Processing (20)
Pre-OS Boot (3)
Unused/Unsupported Cloud Regions (10)
Direct Volume Access (8)
Redundant Access (3)
Template Injection (2)
Execution Guardrails (2)
Debugger Evasion (2)
Traffic Signaling (1)
Social Engineering (1)

Defense Impairment 17

Disable or Modify Tools (5)
Modify Registry (307)
Modify Authentication Process (7)
Disable or Modify System Firewall (3)
Domain or Tenant Policy Modification (2)
File and Directory Permissions Modification (2)
Subvert Trust Controls (6)
Modify Cloud Compute Infrastructure (5)
Plist File Modification (14)
Rogue Domain Controller (13)
Network Boundary Bridging (1)
Downgrade Attack (7)
Prevent Command History Logging (4)
Weaken Encryption (1)
Modify System Image (1)
Modify Cloud Resource Hierarchy (1)
Safe Mode Boot (1)

Collection 16

Data from Cloud Storage (87)
Data from Local System (77)
Email Collection (3)
Adversary-in-the-Middle (3)
Data from Information Repositories (3)
Archive Collected Data (3)
Data Staged (2)
Automated Collection (41)
Input Capture (3)
Screen Capture (27)
Clipboard Data (21)
Browser Session Hijacking (17)
Data from Network Shared Drive (15)
Audio Capture (11)
Video Capture (10)
Data from Removable Media (5)

Command & Control 15

Application Layer Protocol (4)
Ingress Tool Transfer (341)
Remote Access Tools (1)
Protocol Tunneling (97)
Proxy (4)
Web Service (3)
Non-Application Layer Protocol (46)
Dynamic Resolution (2)
Encrypted Channel (1)
Non-Standard Port (26)
Fallback Channels (17)
Data Encoding (1)
Data Obfuscation (1)
Content Injection (4)
Traffic Signaling (1)

Exfiltration 9

Exfiltration Over Web Service (4)
Exfiltration Over Alternative Protocol (3)
Exfiltration Over C2 Channel (84)
Transfer Data to Cloud Account (56)
Automated Exfiltration (1)
Data Transfer Size Limits (27)
Exfiltration Over Physical Medium (1)
Exfiltration Over Other Network Medium (1)
Scheduled Transfer (3)

Impact 14

Data Destruction (1)
Inhibit System Recovery (115)
Data Encrypted for Impact (88)
Service Stop (85)
Data Manipulation (2)
Account Access Removal (67)
Resource Hijacking (2)
Network Denial of Service (2)
Endpoint Denial of Service (4)
System Shutdown/Reboot (35)
Defacement (2)
Disk Wipe (2)
Financial Theft (3)
Firmware Corruption (2)

MITRE ATT&CK Mobile

Network Effects 0

No techniques tracked.

Remote Service Effects 0

No techniques tracked.

Initial Access 3

Supply Chain Compromise (2)
Drive-By Compromise (1)
Phishing (1)

Execution 1

Command and Scripting Interpreter (1)

Persistence 3

Foreground Persistence (1)
Event Triggered Execution (1)
Hijack Execution Flow (1)

Privilege Escalation 3

Abuse Elevation Control Mechanism (2)
Exploitation for Privilege Escalation (1)
Process Injection (1)

Defense Evasion 11

Impair Defenses (7)
Indicator Removal on Host (2)
Obfuscated Files or Information (1)
Input Injection (1)
Foreground Persistence (1)
Hooking (1)
Execution Guardrails (1)
Hide Artifacts (1)
Process Injection (1)
Virtualization/Sandbox Evasion (1)
Masquerading (1)

Credential Access 5

Input Capture (2)
Steal Application Access Token (2)
Clipboard Data (1)
Access Notifications (1)
Credentials from Password Store (1)

Discovery 5

Software Discovery (3)
Process Discovery (2)
System Network Configuration Discovery (1)
Network Service Scanning (1)
Location Tracking (1)

Lateral Movement 1

Exploitation of Remote Services (1)

Collection 12

Input Capture (2)
Protected User Data (1)
Stored Application Data (1)
Clipboard Data (1)
Audio Capture (1)
Location Tracking (1)
Video Capture (1)
Screen Capture (1)
Access Notifications (1)
Archive Collected Data (1)
Call Control (1)
Adversary-in-the-Middle (1)

Command and Control 4

Web Service (1)
Non-Standard Port (1)
Ingress Tool Transfer (1)
Call Control (1)

Exfiltration 1

Exfiltration Over Alternative Protocol (1)

Impact 8

Data Manipulation (2)
Data Encrypted for Impact (1)
Input Injection (1)
SMS Control (1)
Call Control (1)
Account Access Removal (1)
Endpoint Denial of Service (1)
Generate Traffic from Victim (1)

MITRE ATT&CK ICS

Initial Access 8

Spearphishing Attachment (5)
Exploitation of Remote Services (5)
Remote Services (4)
Exploit Public-Facing Application (3)
External Remote Services (1)
Rogue Master (1)
Supply Chain Compromise (1)
Internet Accessible Device (1)

Execution 5

Scripting (7)
Execution through API (5)
Change Operating Mode (4)
User Execution (4)
Native API (1)

Persistence 5

Valid Accounts (7)
Project File Infection (3)
System Firmware (2)
Module Firmware (1)
Modify Program (1)

Privilege Escalation 1

Exploitation for Privilege Escalation (4)

Evasion 2

Change Operating Mode (4)
Rootkit (1)

Discovery 4

Network Sniffing (4)
Network Connection Enumeration (1)
Remote System Discovery (1)
Remote System Information Discovery (1)

Lateral Movement 4

Valid Accounts (7)
Exploitation of Remote Services (5)
Remote Services (4)
Program Download (2)

Collection 1

Program Upload (1)

Command and Control 2

Connection Proxy (1)
Commonly Used Port (1)

Inhibit Response Function 5

System Firmware (2)
Denial of Service (1)
Device Restart/Shutdown (1)
Rootkit (1)
Service Stop (1)

Impair Process Control 4

Unauthorized Command Message (3)
Brute Force I/O (1)
Modify Parameter (1)
Module Firmware (1)

Impact 8

Loss of Availability (4)
Denial of Control (3)
Loss of Control (2)
Loss of Productivity and Revenue (2)
Theft of Operational Information (2)
Manipulation of Control (1)
Loss of Protection (1)
Damage to Property (1)