MITRE ATT&CK® is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community.

MITRE ATT&CK®是一个全球通用的基于现实世界观察的对手战术和技术的知识库。ATT&CK知识库被用作私营部门、政府以及网络安全产品和服务界开发特定威胁模型和方法的基础。

With the creation of ATT&CK, MITRE is fulfilling its mission to solve problems for a safer world — by bringing communities together to develop more effective cybersecurity. ATT&CK is open and available to any person or organization for use at no charge.

随着ATT&CK的创建，MITRE正在履行其为一个更安全的世界解决问题的使命--通过将社区联合起来开发更有效的网络安全。ATT&CK是开放的，任何个人或组织都可以免费使用。

This is a custom instance of the ATT&CK Website built from source code published by ATT&CK on GitHub. It is not affiliated with ATT&CK in any official capacity. The official instance of the ATT&CK website can be found at attack.mitre.org.

这个中文版是由云纷科技编者按照原文转译的ATT&CK网站的定制中文实例。它与ATT&CK没有任何官方关系。ATT&CK网站的官方实例可以在attack.mitre.org找到。

ATT&CK Matrix for Enterprise

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
10 techniques 7 techniques 9 techniques 12 techniques 19 techniques 13 techniques 42 techniques 16 techniques 30 techniques 9 techniques 17 techniques 16 techniques 9 techniques 13 techniques
主动扫描 (3)
=
Gather Victim Host Information (4)
=
Gather Victim Identity Information (3)
=
Gather Victim Network Information (6)
=
Gather Victim Org Information (4)
=
Phishing for Information (3)
=
Search Closed Sources (2)
=
Search Open Technical Databases (5)
=
Search Open Websites/Domains (2)
=
Search Victim-Owned Websites
Acquire Infrastructure (6)
=
Compromise Accounts (2)
=
Compromise Infrastructure (6)
=
Develop Capabilities (4)
=
Establish Accounts (2)
=
Obtain Capabilities (6)
=
Stage Capabilities (5)
=
Drive-by Compromise
Exploit Public-Facing Application
远程外部服务
Hardware Additions
Phishing (3)
=
通过可移动媒体复制
供应链攻击 (3)
=
信任关系
Valid Accounts (4)
=
Command and Scripting Interpreter (8)
=
Container Administration Command
Deploy Container
Exploitation for Client Execution
Inter-Process Communication (3)
=
Native API
Scheduled Task/Job (5)
=
Shared Modules
Software Deployment Tools
系统服务 (2)
=
User Execution (3)
=
Windows Management Instrumentation
Account Manipulation (5)
=
BITS Jobs
Boot or Logon Autostart Execution (14)
=
Boot or Logon Initialization Scripts (5)
=
Browser Extensions
Compromise Client Software Binary
Create Account (3)
=
Create or Modify System Process (4)
=
Event Triggered Execution (15)
=
远程外部服务
Hijack Execution Flow (12)
=
Implant Internal Image
Modify Authentication Process (5)
=
Office Application Startup (6)
=
Pre-OS Boot (5)
=
Scheduled Task/Job (5)
=
Server Software Component (5)
=
Traffic Signaling (1)
=
Valid Accounts (4)
=
Abuse Elevation Control Mechanism (4)
=
访问令牌操纵 (5)
=
Boot or Logon Autostart Execution (14)
=
Boot or Logon Initialization Scripts (5)
=
Create or Modify System Process (4)
=
Domain Policy Modification (2)
=
Escape to Host
Event Triggered Execution (15)
=
Exploitation for Privilege Escalation
Hijack Execution Flow (12)
=
Process Injection (12)
=
Scheduled Task/Job (5)
=
Valid Accounts (4)
=
Abuse Elevation Control Mechanism (4)
=
访问令牌操纵 (5)
=
BITS Jobs
Build Image on Host
Debugger Evasion
Deobfuscate/Decode Files or Information
Deploy Container
Direct Volume Access
Domain Policy Modification (2)
=
Execution Guardrails (1)
=
Exploitation for Defense Evasion
File and Directory Permissions Modification (2)
=
Hide Artifacts (10)
=
Hijack Execution Flow (12)
=
Impair Defenses (9)
=
Indicator Removal on Host (6)
=
Indirect Command Execution
Masquerading (7)
=
Modify Authentication Process (5)
=
Modify Cloud Compute Infrastructure (4)
=
Modify Registry
Modify System Image (2)
=
Network Boundary Bridging (1)
=
Obfuscated Files or Information (6)
=
Plist File Modification
Pre-OS Boot (5)
=
Process Injection (12)
=
Reflective Code Loading
Rogue Domain Controller
Rootkit
Subvert Trust Controls (6)
=
System Binary Proxy Execution (13)
=
System Script Proxy Execution (1)
=
Template Injection
Traffic Signaling (1)
=
Trusted Developer Utilities Proxy Execution (1)
=
Unused/Unsupported Cloud Regions
Use Alternate Authentication Material (4)
=
Valid Accounts (4)
=
Virtualization/Sandbox Evasion (3)
=
Weaken Encryption (2)
=
XSL Script Processing
Adversary-in-the-Middle (3)
=
蛮力攻击 (4)
=
Credentials from Password Stores (5)
=
Exploitation for Credential Access
Forced Authentication
Forge Web Credentials (2)
=
Input Capture (4)
=
Modify Authentication Process (5)
=
Multi-Factor Authentication Interception
Multi-Factor Authentication Request Generation
网络嗅探
OS Credential Dumping (8)
=
Steal Application Access Token
Steal or Forge Kerberos Tickets (4)
=
Steal Web Session Cookie
Unsecured Credentials (7)
=
Account Discovery (4)
=
Application Window Discovery
Browser Bookmark Discovery
Cloud Infrastructure Discovery
Cloud Service Dashboard
Cloud Service Discovery
Cloud Storage Object Discovery
Container and Resource Discovery
Debugger Evasion
Domain Trust Discovery
File and Directory Discovery
Group Policy Discovery
Network Service Discovery
Network Share Discovery
Network Sniffing
Password Policy Discovery
Peripheral Device Discovery
Permission Groups Discovery (3)
=
Process Discovery
Query Registry
Remote System Discovery
Software Discovery (1)
=
System Information Discovery
System Location Discovery (1)
=
System Network Configuration Discovery (1)
=
System Network Connections Discovery
System Owner/User Discovery
System Service Discovery
System Time Discovery
Virtualization/Sandbox Evasion (3)
=
Exploitation of Remote Services
Internal Spearphishing
Lateral Tool Transfer
Remote Service Session Hijacking (2)
=
Remote Services (6)
=
通过可移动媒体复制
Software Deployment Tools
Taint Shared Content
Use Alternate Authentication Material (4)
=
Adversary-in-the-Middle (3)
=
Archive Collected Data (3)
=
Audio Capture
Automated Collection
Browser Session Hijacking
Clipboard Data
Data from Cloud Storage Object
Data from Configuration Repository (2)
=
Data from Information Repositories (3)
=
Data from Local System
Data from Network Shared Drive
Data from Removable Media
Data Staged (2)
=
Email Collection (3)
=
Input Capture (4)
=
Screen Capture
Video Capture
Application Layer Protocol (4)
=
Communication Through Removable Media
Data Encoding (2)
=
Data Obfuscation (3)
=
Dynamic Resolution (3)
=
Encrypted Channel (2)
=
Fallback Channels
转移导入工具
多级渠道
Non-Application Layer Protocol
Non-Standard Port
Protocol Tunneling
Proxy (4)
=
Remote Access Software
Traffic Signaling (1)
=
Web Service (3)
=
Automated Exfiltration (1)
=
Data Transfer Size Limits
Exfiltration Over Alternative Protocol (3)
=
Exfiltration Over C2 Channel
Exfiltration Over Other Network Medium (1)
=
Exfiltration Over Physical Medium (1)
=
Exfiltration Over Web Service (2)
=
Scheduled Transfer
Transfer Data to Cloud Account
Account Access Removal
Data Destruction
Data Encrypted for Impact
Data Manipulation (3)
=
Defacement (2)
=
Disk Wipe (2)
=
Endpoint Denial of Service (4)
=
Firmware Corruption
Inhibit System Recovery
Network Denial of Service (2)
=
Resource Hijacking
Service Stop
System Shutdown/Reboot
Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
10 techniques 7 techniques 9 techniques 12 techniques 19 techniques 13 techniques 42 techniques 16 techniques 30 techniques 9 techniques 17 techniques 16 techniques 9 techniques 13 techniques
=
主动扫描 (3)
=
Gather Victim Host Information (4)
=
Gather Victim Identity Information (3)
=
Gather Victim Network Information (6)
=
Gather Victim Org Information (4)
=
Phishing for Information (3)
=
Search Closed Sources (2)
=
Search Open Technical Databases (5)
=
Search Open Websites/Domains (2)
Search Victim-Owned Websites
=
Acquire Infrastructure (6)
=
Compromise Accounts (2)
=
Compromise Infrastructure (6)
=
Develop Capabilities (4)
=
Establish Accounts (2)
=
Obtain Capabilities (6)
=
Stage Capabilities (5)
Drive-by Compromise
Exploit Public-Facing Application
远程外部服务
Hardware Additions
=
Phishing (3)
通过可移动媒体复制
=
供应链攻击 (3)
信任关系
=
Valid Accounts (4)
=
Command and Scripting Interpreter (8)
Container Administration Command
Deploy Container
Exploitation for Client Execution
=
Inter-Process Communication (3)
Native API
=
Scheduled Task/Job (5)
Shared Modules
Software Deployment Tools
=
系统服务 (2)
=
User Execution (3)
Windows Management Instrumentation
=
Account Manipulation (5)
BITS Jobs
=
Boot or Logon Autostart Execution (14)
=
Boot or Logon Initialization Scripts (5)
Browser Extensions
Compromise Client Software Binary
=
Create Account (3)
=
创建或修改系统程序 (4)
=
Event Triggered Execution (15)
远程外部服务
=
Hijack Execution Flow (12)
Implant Internal Image
=
Modify Authentication Process (5)
=
Office Application Startup (6)
=
Pre-OS Boot (5)
=
Scheduled Task/Job (5)
=
Server Software Component (5)
=
Traffic Signaling (1)
=
Valid Accounts (4)
=
Abuse Elevation Control Mechanism (4)
=
访问令牌操纵 (5)
=
Boot or Logon Autostart Execution (14)
=
Boot or Logon Initialization Scripts (5)
=
Create or Modify System Process (4)
=
Domain Policy Modification (2)
Escape to Host
=
Event Triggered Execution (15)
Exploitation for Privilege Escalation
=
Hijack Execution Flow (12)
=
Process Injection (12)
=
Scheduled Task/Job (5)
=
Valid Accounts (4)
=
Abuse Elevation Control Mechanism (4)
=
访问令牌操纵 (5)
BITS Jobs
Build Image on Host
Debugger Evasion
Deobfuscate/Decode Files or Information
Deploy Container
Direct Volume Access
=
Domain Policy Modification (2)
=
Execution Guardrails (1)
Exploitation for Defense Evasion
=
File and Directory Permissions Modification (2)
=
Hide Artifacts (10)
=
Hijack Execution Flow (12)
=
Impair Defenses (9)
=
Indicator Removal on Host (6)
Indirect Command Execution
=
Masquerading (7)
=
Modify Authentication Process (5)
=
Modify Cloud Compute Infrastructure (4)
Modify Registry
=
Modify System Image (2)
=
Network Boundary Bridging (1)
=
Obfuscated Files or Information (6)
Plist File Modification
=
Pre-OS Boot (5)
=
Process Injection (12)
Reflective Code Loading
Rogue Domain Controller
Rootkit
=
Subvert Trust Controls (6)
=
System Binary Proxy Execution (13)
=
System Script Proxy Execution (1)
Template Injection
=
Traffic Signaling (1)
=
Trusted Developer Utilities Proxy Execution (1)
Unused/Unsupported Cloud Regions
=
Use Alternate Authentication Material (4)
=
Valid Accounts (4)
=
Virtualization/Sandbox Evasion (3)
=
Weaken Encryption (2)
XSL Script Processing
=
Adversary-in-the-Middle (3)
=
Brute Force (4)
=
Credentials from Password Stores (5)
Exploitation for Credential Access
Forced Authentication
=
Forge Web Credentials (2)
=
Input Capture (4)
=
Modify Authentication Process (5)
Multi-Factor Authentication Interception
Multi-Factor Authentication Request Generation
Network Sniffing
=
OS Credential Dumping (8)
Steal Application Access Token
=
Steal or Forge Kerberos Tickets (4)
Steal Web Session Cookie
=
Unsecured Credentials (7)
=
Account Discovery (4)
Application Window Discovery
Browser Bookmark Discovery
Cloud Infrastructure Discovery
Cloud Service Dashboard
Cloud Service Discovery
Cloud Storage Object Discovery
Container and Resource Discovery
Debugger Evasion
Domain Trust Discovery
File and Directory Discovery
Group Policy Discovery
Network Service Discovery
Network Share Discovery
Network Sniffing
Password Policy Discovery
Peripheral Device Discovery
=
Permission Groups Discovery (3)
Process Discovery
Query Registry
Remote System Discovery
=
Software Discovery (1)
System Information Discovery
=
System Location Discovery (1)
=
System Network Configuration Discovery (1)
System Network Connections Discovery
System Owner/User Discovery
System Service Discovery
System Time Discovery
=
Virtualization/Sandbox Evasion (3)
Exploitation of Remote Services
Internal Spearphishing
Lateral Tool Transfer
=
Remote Service Session Hijacking (2)
=
Remote Services (6)
通过可移动媒体复制
Software Deployment Tools
Taint Shared Content
=
Use Alternate Authentication Material (4)
=
Adversary-in-the-Middle (3)
=
Archive Collected Data (3)
Audio Capture
Automated Collection
Browser Session Hijacking
Clipboard Data
Data from Cloud Storage Object
=
Data from Configuration Repository (2)
=
Data from Information Repositories (3)
Data from Local System
Data from Network Shared Drive
Data from Removable Media
=
Data Staged (2)
=
Email Collection (3)
=
Input Capture (4)
Screen Capture
Video Capture
=
Application Layer Protocol (4)
Communication Through Removable Media
=
Data Encoding (2)
=
Data Obfuscation (3)
=
Dynamic Resolution (3)
=
Encrypted Channel (2)
Fallback Channels
Ingress Tool Transfer
Multi-Stage Channels
Non-Application Layer Protocol
Non-Standard Port
Protocol Tunneling
=
Proxy (4)
Remote Access Software
=
Traffic Signaling (1)
=
Web Service (3)
=
Automated Exfiltration (1)
Data Transfer Size Limits
=
Exfiltration Over Alternative Protocol (3)
Exfiltration Over C2 Channel
=
Exfiltration Over Other Network Medium (1)
=
Exfiltration Over Physical Medium (1)
=
Exfiltration Over Web Service (2)
Scheduled Transfer
Transfer Data to Cloud Account
Account Access Removal
Data Destruction
Data Encrypted for Impact
=
Data Manipulation (3)
=
Defacement (2)
=
Disk Wipe (2)
=
Endpoint Denial of Service (4)
Firmware Corruption
Inhibit System Recovery
=
Network Denial of Service (2)
Resource Hijacking
Service Stop
System Shutdown/Reboot