MITRE ATT&CK v19.2 · Enterprise

techniques linked to CVEs

are columns in kill-chain order. Each cell is a ; brighter cells have more linked CVEs. The red underline shows the share of those CVEs in . 178 of 697 techniques have at least one link.

Open in ATT&CK Navigator

A layer for MITRE’s ATT&CK Navigator: techniques scored by the highest Patchfirst priority among their CVEs, neutral to red, with the CVE ids in each comment. “Open in Navigator” loads https://patchfirst.co/navigator/techniques.json. Or download it and in Navigator choose Open Existing Layer → Upload from local.

CVEs linked 1–34–1516–5960–231232–904 share in CISA KEV

Show techniques with no CVEs

Reconnaissance

TA00439

Gather Victim Host Information 5 T1592 Active Scanning 1 T1595 Gather Victim Identity Information 1 T1589 Gather Victim Network Information 1 T1590 Phishing for Information 1 T1598 · 1 sub

Resource Development

TA004226

Stage Capabilities 19 T1608 · 1 sub Obtain Capabilities 5 T1588 · 3 sub Compromise Infrastructure 2 T1584 · 1 sub

Initial Access

TA00011,367

Exploit Public-Facing Application 888 T1190 Valid Accounts 254 T1078 · 3 sub Drive-by Compromise 206 T1189 External Remote Services 55 T1133 Phishing 48 T1566 · 2 sub Supply Chain Compromise 11 T1195 · 1 sub Replication Through Removable Media 5 T1091 Hardware Additions 3 T1200 Trusted Relationship 1 T1199

Privilege Escalation

TA0004639

Exploitation for Privilege Escalation 411 T1068 Valid Accounts 254 T1078 · 3 sub Abuse Elevation Control Mechanism 33 T1548 · 3 sub Process Injection 23 T1055 · 1 sub Account Manipulation 21 T1098 · 1 sub Create or Modify System Process 11 T1543 Access Token Manipulation 6 T1134 Escape to Host 6 T1611 Scheduled Task/Job 4 T1053 · 1 sub Boot or Logon Initialization Scripts 3 T1037 Boot or Logon Autostart Execution 2 T1547 · 1 sub Domain or Tenant Policy Modification 1 T1484 · 1 sub

Stealth

–439

Valid Accounts 254 T1078 · 3 sub Hijack Execution Flow 72 T1574 · 2 sub Exploitation for Stealth 41 T1211 Process Injection 23 T1055 · 1 sub Masquerading 21 T1036 · 1 sub Indirect Command Execution 10 T1202 Pre-OS Boot 9 T1542 · 3 sub Indicator Removal 8 T1070 · 1 sub Access Token Manipulation 6 T1134 Virtualization/Sandbox Evasion 6 T1497 Obfuscated Files or Information 5 T1027 Debugger Evasion 2 T1622 Deobfuscate/Decode Files or Information 2 T1140 Rootkit 2 T1014 System Binary Proxy Execution 2 T1218

Defense Impairment

–32

Subvert Trust Controls 21 T1553 · 3 sub Modify Registry 4 T1112 Modify Authentication Process 2 T1556 Domain or Tenant Policy Modification 1 T1484 · 1 sub File and Directory Permissions Modification 1 T1222 Modify System Image 1 T1601 Network Boundary Bridging 1 T1599 Weaken Encryption 1 T1600

Credential Access

TA0006141

Adversary-in-the-Middle 43 T1557 Unsecured Credentials 35 T1552 · 3 sub OS Credential Dumping 23 T1003 · 3 sub Brute Force 14 T1110 Network Sniffing 11 T1040 Credentials from Password Stores 10 T1555 Exploitation for Credential Access 5 T1212 Input Capture 5 T1056 · 1 sub Steal Application Access Token 4 T1528 Steal or Forge Kerberos Tickets 4 T1558 Modify Authentication Process 2 T1556 Steal Web Session Cookie 1 T1539

Discovery

TA000762

File and Directory Discovery 12 T1083 Account Discovery 11 T1087 · 2 sub Network Sniffing 11 T1040 System Information Discovery 9 T1082 Network Service Discovery 8 T1046 Virtualization/Sandbox Evasion 6 T1497 Debugger Evasion 2 T1622 Domain Trust Discovery 2 T1482 Remote System Discovery 2 T1018 System Owner/User Discovery 2 T1033 Browser Information Discovery 1 T1217 Permission Groups Discovery 1 T1069 System Network Configuration Discovery 1 T1016 System Network Connections Discovery 1 T1049 System Service Discovery 1 T1007

Lateral Movement

TA000852

Exploitation of Remote Services 21 T1210 Remote Services 9 T1021 · 2 sub Remote Service Session Hijacking 7 T1563 Use Alternate Authentication Material 7 T1550 · 2 sub Replication Through Removable Media 5 T1091 Lateral Tool Transfer 1 T1570 Software Deployment Tools 1 T1072 Taint Shared Content 1 T1080

Collection

TA0009331

Data from Local System 255 T1005 Adversary-in-the-Middle 43 T1557 Browser Session Hijacking 24 T1185 Input Capture 5 T1056 · 1 sub Data from Information Repositories 4 T1213 Email Collection 4 T1114 · 1 sub Archive Collected Data 2 T1560 · 1 sub Data from Cloud Storage 2 T1530 Automated Collection 1 T1119 Data from Configuration Repository 1 T1602

Command and Control

TA001171

Ingress Tool Transfer 47 T1105 Proxy 14 T1090 · 1 sub Application Layer Protocol 12 T1071 · 2 sub Encrypted Channel 3 T1573 · 1 sub Data Obfuscation 2 T1001 Non-Standard Port 1 T1571 Remote Access Tools 1 T1219

Exfiltration

TA001024

Exfiltration Over C2 Channel 12 T1041 Exfiltration Over Alternative Protocol 5 T1048 · 1 sub Exfiltration Over Other Network Medium 4 T1011 Exfiltration Over Web Service 3 T1567

Impact

TA0040294

Endpoint Denial of Service 182 T1499 · 2 sub Data Manipulation 62 T1565 · 2 sub Data Destruction 31 T1485 Resource Hijacking 21 T1496 Data Encrypted for Impact 15 T1486 Network Denial of Service 10 T1498 · 1 sub Service Stop 6 T1489 System Shutdown/Reboot 3 T1529 Account Access Removal 2 T1531 Firmware Corruption 2 T1495 Inhibit System Recovery 2 T1490 Defacement 1 T1491 · 1 sub

Most linked techniques

Including sub-techniques. Table view of the matrix.

Technique	Tactics	CVEs	In KEV	KEV share
T1190Exploit Public-Facing Application	Initial access	888	799	90%
T1059Command and Scripting Interpreter	Execution	820	736	90%
T1068Exploitation for Privilege Escalation	Priv. escalation	411	357	87%
T1005Data from Local System	Collection	255	182	71%
T1078Valid Accounts	Initial access, Persistence, Priv. escalation, Stealth	243	194	80%
T1189Drive-by Compromise	Initial access	206	180	87%
T1204.002Malicious File	Execution	174	144	83%
T1499.004Application or System Exploitation	Impact	146	84	58%
T1203Exploitation for Client Execution	Execution	123	110	89%
T1574Hijack Execution Flow	Execution, Stealth	66	17	26%
T1204.001Malicious Link	Execution	61	38	62%
T1059.007JavaScript	Execution	60	31	52%
T1133External Remote Services	Initial access, Persistence	55	31	56%
T1105Ingress Tool Transfer	Command & control	47	45	96%
T1557Adversary-in-the-Middle	Credential access, Collection	43	11	26%
T1211Exploitation for Stealth	Stealth	41	36	88%
T1505.003Web Shell	Persistence	41	35	85%
T1136Create Account	Persistence	33	13	39%
T1499Endpoint Denial of Service	Impact	33	23	70%
T1485Data Destruction	Impact	31	9	29%
T1565Data Manipulation	Impact	30	7	23%
T1548Abuse Elevation Control Mechanism	Priv. escalation	29	27	93%
T1565.001Stored Data Manipulation	Impact	28	14	50%
T1566Phishing	Initial access	27	8	30%
T1185Browser Session Hijacking	Collection	24	4	17%
T1552Unsecured Credentials	Credential access	24	15	63%
T1055Process Injection	Priv. escalation, Stealth	21	21	100%
T1210Exploitation of Remote Services	Lateral movement	21	21	100%
T1496Resource Hijacking	Impact	21	19	90%
T1036Masquerading	Stealth	20	7	35%
T1098Account Manipulation	Persistence, Priv. escalation	19	11	58%
T1003OS Credential Dumping	Credential access	18	18	100%
T1059.004Unix Shell	Execution	17	17	100%
T1486Data Encrypted for Impact	Impact	15	15	100%
T1110Brute Force	Credential access	14	2	14%
T1090Proxy	Command & control	13	13	100%
T1041Exfiltration Over C2 Channel	Exfiltration	12	12	100%
T1083File and Directory Discovery	Discovery	12	10	83%
T1566.002Spearphishing Link	Initial access	12	7	58%
T1040Network Sniffing	Credential access, Discovery	11	4	36%
T1543Create or Modify System Process	Persistence, Priv. escalation	11	11	100%
T1553.005Mark-of-the-Web Bypass	Defense impairment	11	11	100%
T1608.001Upload Malware	Resource dev.	11	11	100%
T1071.001Web Protocols	Command & control	10	10	100%
T1195.002Compromise Software Supply Chain	Initial access	10	10	100%
T1202Indirect Command Execution	Stealth	10	7	70%
T1552.001Credentials In Files	Credential access	10	6	60%
T1555Credentials from Password Stores	Credential access	10	10	100%
T1078.001Default Accounts	Initial access, Persistence, Priv. escalation, Stealth	9	0	0%
T1082System Information Discovery	Discovery	9	9	100%
T1498Network Denial of Service	Impact	9	9	100%
T1566.001Spearphishing Attachment	Initial access	9	8	89%
T1046Network Service Discovery	Discovery	8	8	100%
T1608Stage Capabilities	Resource dev.	8	0	0%
T1106Native API	Execution	7	7	100%
T1563Remote Service Session Hijacking	Lateral movement	7	0	0%
T1087Account Discovery	Discovery	6	6	100%
T1134Access Token Manipulation	Priv. escalation, Stealth	6	5	83%
T1489Service Stop	Impact	6	1	17%
T1497Virtualization/Sandbox Evasion	Stealth, Discovery	6	4	67%