attack --coverage
ATT&CK coverage
Techniques observed and investigated across my published DFIR write-ups, mapped to the MITRE ATT&CK Enterprise matrix. Sub-techniques roll up to their parent technique. Expand a highlighted technique to see the write-ups covering it.
- Published write-ups
- 0
- Techniques covered
- 0 / 227
- Sub-techniques covered
- 0
- Tactics covered
- 0 / 15
No write-ups are published yet, so nothing is highlighted. Coverage appears automatically as retired write-ups are added.
write-ups 0 1 2 3–4 5+
Reconnaissance 0/12
- T1595 Active Scanning (3 sub-techniques)
- T1592 Gather Victim Host Information (4 sub-techniques)
- T1589 Gather Victim Identity Information (3 sub-techniques)
- T1590 Gather Victim Network Information (6 sub-techniques)
- T1591 Gather Victim Org Information (4 sub-techniques)
- T1598 Phishing for Information (4 sub-techniques)
- T1682 Query Public AI Services
- T1597 Search Closed Sources (2 sub-techniques)
- T1596 Search Open Technical Databases (5 sub-techniques)
- T1593 Search Open Websites/Domains (3 sub-techniques)
- T1681 Search Threat Vendor Data
- T1594 Search Victim-Owned Websites
Resource Development 0/9
- T1650 Acquire Access
- T1583 Acquire Infrastructure (8 sub-techniques)
- T1586 Compromise Accounts (3 sub-techniques)
- T1584 Compromise Infrastructure (8 sub-techniques)
- T1587 Develop Capabilities (4 sub-techniques)
- T1585 Establish Accounts (3 sub-techniques)
- T1683 Generate Content (2 sub-techniques)
- T1588 Obtain Capabilities (7 sub-techniques)
- T1608 Stage Capabilities (7 sub-techniques)
Initial Access 0/11
- T1659 Content Injection
- T1189 Drive-by Compromise
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1200 Hardware Additions
- T1566 Phishing (4 sub-techniques)
- T1091 Replication Through Removable Media
- T1195 Supply Chain Compromise (3 sub-techniques)
- T1199 Trusted Relationship
- T1078 Valid Accounts (4 sub-techniques)
- T1669 Wi-Fi Networks
Execution 0/22
- T1197 BITS Jobs
- T1651 Cloud Administration Command
- T1059 Command and Scripting Interpreter (13 sub-techniques)
- T1609 Container Administration Command
- T1610 Deploy Container
- T1699 Direct Prompt Injection
- T1675 ESXi Administration Command
- T1203 Exploitation for Client Execution
- T1574 Hijack Execution Flow (12 sub-techniques)
- T1698 Indirect Prompt Injection
- T1674 Input Injection
- T1559 Inter-Process Communication (3 sub-techniques)
- T1106 Native API
- T1677 Poisoned Pipeline Execution
- T1053 Scheduled Task/Job (5 sub-techniques)
- T1648 Serverless Execution
- T1129 Shared Modules
- T1072 Software Deployment Tools
- T1569 System Services (3 sub-techniques)
- T1127 Trusted Developer Utilities Proxy Execution (3 sub-techniques)
- T1204 User Execution (5 sub-techniques)
- T1047 Windows Management Instrumentation
Persistence 0/22
- T1098 Account Manipulation (7 sub-techniques)
- T1197 BITS Jobs
- T1547 Boot or Logon Autostart Execution (14 sub-techniques)
- T1037 Boot or Logon Initialization Scripts (5 sub-techniques)
- T1671 Cloud Application Integration
- T1554 Compromise Host Software Binary
- T1136 Create Account (3 sub-techniques)
- T1543 Create or Modify System Process (5 sub-techniques)
- T1546 Event Triggered Execution (18 sub-techniques)
- T1668 Exclusive Control
- T1133 External Remote Services
- T1525 Implant Internal Image
- T1556 Modify Authentication Process (9 sub-techniques)
- T1112 Modify Registry
- T1137 Office Application Startup (6 sub-techniques)
- T1653 Power Settings
- T1542 Pre-OS Boot (5 sub-techniques)
- T1053 Scheduled Task/Job (5 sub-techniques)
- T1505 Server Software Component (6 sub-techniques)
- T1176 Software Extensions (2 sub-techniques)
- T1205 Traffic Signaling (2 sub-techniques)
- T1078 Valid Accounts (4 sub-techniques)
Privilege Escalation 0/13
- T1548 Abuse Elevation Control Mechanism (6 sub-techniques)
- T1134 Access Token Manipulation (5 sub-techniques)
- T1098 Account Manipulation (7 sub-techniques)
- T1547 Boot or Logon Autostart Execution (14 sub-techniques)
- T1037 Boot or Logon Initialization Scripts (5 sub-techniques)
- T1543 Create or Modify System Process (5 sub-techniques)
- T1484 Domain or Tenant Policy Modification (2 sub-techniques)
- T1611 Escape to Host
- T1546 Event Triggered Execution (18 sub-techniques)
- T1068 Exploitation for Privilege Escalation
- T1055 Process Injection (12 sub-techniques)
- T1053 Scheduled Task/Job (5 sub-techniques)
- T1078 Valid Accounts (4 sub-techniques)
Stealth 0/31
- T1134 Access Token Manipulation (5 sub-techniques)
- T1696 Anti-Automation Evasion (2 sub-techniques)
- T1197 BITS Jobs
- T1612 Build Image on Host
- T1622 Debugger Evasion
- T1678 Delay Execution
- T1140 Deobfuscate/Decode Files or Information
- T1006 Direct Volume Access
- T1480 Execution Guardrails (2 sub-techniques)
- T1211 Exploitation for Stealth
- T1564 Hide Artifacts (14 sub-techniques)
- T1574 Hijack Execution Flow (12 sub-techniques)
- T1070 Indicator Removal (8 sub-techniques)
- T1202 Indirect Command Execution
- T1036 Masquerading (12 sub-techniques)
- T1027 Obfuscated Files or Information (18 sub-techniques)
- T1542 Pre-OS Boot (5 sub-techniques)
- T1055 Process Injection (12 sub-techniques)
- T1620 Reflective Code Loading
- T1014 Rootkit
- T1679 Selective Exclusion
- T1684 Social Engineering (2 sub-techniques)
- T1218 System Binary Proxy Execution (14 sub-techniques)
- T1216 System Script Proxy Execution (2 sub-techniques)
- T1221 Template Injection
- T1205 Traffic Signaling (2 sub-techniques)
- T1127 Trusted Developer Utilities Proxy Execution (3 sub-techniques)
- T1535 Unused/Unsupported Cloud Regions
- T1078 Valid Accounts (4 sub-techniques)
- T1497 Virtualization/Sandbox Evasion (3 sub-techniques)
- T1220 XSL Script Processing
Defense Impairment 0/18
- T1686 Disable or Modify System Firewall (3 sub-techniques)
- T1685 Disable or Modify Tools (7 sub-techniques)
- T1484 Domain or Tenant Policy Modification (2 sub-techniques)
- T1689 Downgrade Attack
- T1687 Exploitation for Defense Impairment
- T1222 File and Directory Permissions Modification (2 sub-techniques)
- T1556 Modify Authentication Process (9 sub-techniques)
- T1578 Modify Cloud Compute Infrastructure (5 sub-techniques)
- T1666 Modify Cloud Resource Hierarchy
- T1112 Modify Registry
- T1601 Modify System Image (2 sub-techniques)
- T1599 Network Boundary Bridging (1 sub-techniques)
- T1647 Plist File Modification
- T1690 Prevent Command History Logging
- T1207 Rogue Domain Controller
- T1688 Safe Mode Boot
- T1553 Subvert Trust Controls (6 sub-techniques)
- T1600 Weaken Encryption (2 sub-techniques)
Credential Access 0/18
- T1557 Adversary-in-the-Middle (4 sub-techniques)
- T1110 Brute Force (4 sub-techniques)
- T1555 Credentials from Password Stores (6 sub-techniques)
- T1212 Exploitation for Credential Access
- T1187 Forced Authentication
- T1606 Forge Web Credentials (2 sub-techniques)
- T1056 Input Capture (4 sub-techniques)
- T1556 Modify Authentication Process (9 sub-techniques)
- T1111 Multi-Factor Authentication Interception
- T1621 Multi-Factor Authentication Request Generation
- T1040 Network Sniffing
- T1003 OS Credential Dumping (8 sub-techniques)
- T1528 Steal Application Access Token
- T1697 Steal Application Specific Passwords
- T1649 Steal or Forge Authentication Certificates
- T1558 Steal or Forge Kerberos Tickets (5 sub-techniques)
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials (8 sub-techniques)
Discovery 0/34
- T1087 Account Discovery (4 sub-techniques)
- T1010 Application Window Discovery
- T1217 Browser Information Discovery
- T1580 Cloud Infrastructure Discovery
- T1538 Cloud Service Dashboard
- T1526 Cloud Service Discovery
- T1619 Cloud Storage Object Discovery
- T1613 Container and Resource Discovery
- T1622 Debugger Evasion
- T1652 Device Driver Discovery
- T1482 Domain Trust Discovery
- T1083 File and Directory Discovery
- T1615 Group Policy Discovery
- T1680 Local Storage Discovery
- T1654 Log Enumeration
- T1046 Network Service Discovery
- T1135 Network Share Discovery
- T1040 Network Sniffing
- T1201 Password Policy Discovery
- T1120 Peripheral Device Discovery
- T1069 Permission Groups Discovery (3 sub-techniques)
- T1057 Process Discovery
- T1012 Query Registry
- T1018 Remote System Discovery
- T1518 Software Discovery (2 sub-techniques)
- T1082 System Information Discovery
- T1614 System Location Discovery (1 sub-techniques)
- T1016 System Network Configuration Discovery (2 sub-techniques)
- T1049 System Network Connections Discovery
- T1033 System Owner/User Discovery
- T1007 System Service Discovery
- T1124 System Time Discovery
- T1673 Virtual Machine Discovery
- T1497 Virtualization/Sandbox Evasion (3 sub-techniques)
Lateral Movement 0/9
- T1210 Exploitation of Remote Services
- T1534 Internal Spearphishing
- T1570 Lateral Tool Transfer
- T1563 Remote Service Session Hijacking (2 sub-techniques)
- T1021 Remote Services (8 sub-techniques)
- T1091 Replication Through Removable Media
- T1072 Software Deployment Tools
- T1080 Taint Shared Content
- T1550 Use Alternate Authentication Material (4 sub-techniques)
Collection 0/17
- T1557 Adversary-in-the-Middle (4 sub-techniques)
- T1560 Archive Collected Data (3 sub-techniques)
- T1123 Audio Capture
- T1119 Automated Collection
- T1185 Browser Session Hijacking
- T1115 Clipboard Data
- T1530 Data from Cloud Storage
- T1602 Data from Configuration Repository (2 sub-techniques)
- T1213 Data from Information Repositories (6 sub-techniques)
- T1005 Data from Local System
- T1039 Data from Network Shared Drive
- T1025 Data from Removable Media
- T1074 Data Staged (2 sub-techniques)
- T1114 Email Collection (3 sub-techniques)
- T1056 Input Capture (4 sub-techniques)
- T1113 Screen Capture
- T1125 Video Capture
Command and Control 0/18
- T1071 Application Layer Protocol (5 sub-techniques)
- T1092 Communication Through Removable Media
- T1659 Content Injection
- T1132 Data Encoding (2 sub-techniques)
- T1001 Data Obfuscation (3 sub-techniques)
- T1568 Dynamic Resolution (3 sub-techniques)
- T1573 Encrypted Channel (2 sub-techniques)
- T1008 Fallback Channels
- T1665 Hide Infrastructure
- T1105 Ingress Tool Transfer
- T1104 Multi-Stage Channels
- T1095 Non-Application Layer Protocol
- T1571 Non-Standard Port
- T1572 Protocol Tunneling
- T1090 Proxy (4 sub-techniques)
- T1219 Remote Access Tools (3 sub-techniques)
- T1205 Traffic Signaling (2 sub-techniques)
- T1102 Web Service (3 sub-techniques)
Exfiltration 0/10
- T1700 AI-Enabled Exfiltration
- T1020 Automated Exfiltration (1 sub-techniques)
- T1030 Data Transfer Size Limits
- T1048 Exfiltration Over Alternative Protocol (3 sub-techniques)
- T1041 Exfiltration Over C2 Channel
- T1011 Exfiltration Over Other Network Medium (1 sub-techniques)
- T1052 Exfiltration Over Physical Medium (1 sub-techniques)
- T1567 Exfiltration Over Web Service (4 sub-techniques)
- T1029 Scheduled Transfer
- T1537 Transfer Data to Cloud Account
Impact 0/15
- T1531 Account Access Removal
- T1485 Data Destruction (1 sub-techniques)
- T1486 Data Encrypted for Impact
- T1565 Data Manipulation (3 sub-techniques)
- T1491 Defacement (2 sub-techniques)
- T1561 Disk Wipe (2 sub-techniques)
- T1667 Email Bombing
- T1499 Endpoint Denial of Service (4 sub-techniques)
- T1657 Financial Theft
- T1495 Firmware Corruption
- T1490 Inhibit System Recovery
- T1498 Network Denial of Service (2 sub-techniques)
- T1496 Resource Hijacking (4 sub-techniques)
- T1489 Service Stop
- T1529 System Shutdown/Reboot
Dataset: MITRE ATT&CK Enterprise v20.1, 227 techniques and 479 sub-techniques (revoked and deprecated entries excluded), retrieved 2026-11-14 from the official attack-stix-data repository. ATT&CK® is a registered trademark of The MITRE Corporation.