Innomerc Explore the behavior.
Connect the evidence.
MITRE ATT&CK® organizes observed adversary behavior. Explore its relationships, then ask what your environment can actually see.
Platform and tactic filters apply to objects with those explicit fields; groups and software may have no direct platform field. Switch to all platforms when looking them up.
Loading explorer controls. The official tactic links remain available below.
How to use this reference
Start with an observed behavior, not a preferred technique ID. Search its name, inspect the technique and sub-techniques, and compare the available platforms and detection relationships with your evidence. Groups and software relationships are reported associations, not unique attribution.
A technique mapping is not a detection rule. A detection strategy describes an approach; an analytic and its data requirements help make it implementable. Validate collection, parsing, rule logic and response in your own environment.
Revoked and deprecated objects are excluded from this explorer. Legacy data sources may therefore be absent; current detection strategies, analytics and data components are included when present in the official release.
© The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. No endorsement implied. Terms of use. Read the introductory lesson.