Check Point offers the widest coverage of the MITRE ATT&CK matrix

Our AI prevention technologies uniquely utilize MITRE knowledge base taxonomy, to predict zero-day attacks and accelerate detection, investigation and response across network, endpoint, mobile and cloud.

mitre floating hero image

Below are the tactics and techniques representing the MITRE ATT&CK® Matrix for Enterprise and Mobile. The Matrix contains information for the following platforms: Windows, macOS, Linux, PRE, Azure AD, Office 365, Google Workspace, SaaS, IaaS, Network, Containers.

Reconnaissance

10 techniques

Resource Development

7 techniques

Initial Access

9 techniques

Execution

12 techniques

Persistence

19 techniques

Privilege Escalation

13 techniques

Defense Evasion

40 techniques

Credential Access

15 techniques

Discovery

29 techniques

Lateral Movement

9 techniques

Collection

17 techniques

Command and Control

16 techniques

Exfiltration

9 techniques

Impact

13 techniques

Active Scanning

Scanning IP Blocks

Vulnerability Scanning

Gather Victim Host Information

Client Configurations

Gather Victim Identity Information

Email Addresses

Gather Victim Network Information

Domain Properties

Network Trust Dependencies

Network Topology

Network Security Appliances

Gather Victim Org Information

Business Relationships

Determine Physical Locations

Identify Business Tempo

Phishing for Information

Spearphishing Service

Spearphishing Attachment

Spearphishing Link

Search Closed Sources

Threat Intel Vendors

Purchase Technical Data

Search Open Technical Databases

DNS/Passive DNS

Digital Certificates

Search Open Websites/Domains

Search Victim-Owned Websites

Acquire Infrastructure

Virtual Private Server

Compromise Accounts

Social Media Accounts

Compromise Infrastructure

Virtual Private Server

Develop Capabilities

Code Signing Certificates

Digital Certificates

Establish Accounts

Social Media Accounts

Obtain Capabilities

Code Signing Certificates

Digital Certificates

Vulnerabilities

Stage Capabilities

Stage Capabilities

Install Digital Certificate

Drive-by Target

Drive-by Compromise

Exploit Public-Facing Application

External Remote Services

Hardware Additions

Spearphishing Attachment

Spearphishing Link

Spearphishing via Service

Replication Through Removable Media

Supply Chain Compromise

Compromise Software Dependencies and Development Tools

Compromise Software Supply Chain

Compromise Hardware Supply Chain

Trusted Relationship

Default Accounts

Domain Accounts

Command and Scripting Interpreter

Windows Command Shell

Network Device CLI

Container Administration Command

Deploy Container

Exploitation for Client Execution

Inter-Process Communication

Component Object Model

Dynamic Data Exchange

Scheduled Task/Job

Container Orchestration Job

Software Deployment Tools

System Services

Service Execution

Malicious Image

Windows Management Instrumentation

Account Manipulation

Additional Cloud Credentials

Exchange Email Delegate Permissions

Add Office 365 Global Administrator Role

SSH Authorized Keys

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Authentication Package

Winlogon Helper DLL

Security Support Provider

Kernel Modules and Extensions

Re-opened Applications

Shortcut Modification

Plist Modification

Print Processors

XDG Autostart Entries

Boot or Logon Initialization Scripts

Logon Script (Windows)

Logon Script (Mac)

Network Logon Script

Browser Extensions

Compromise Client Software Binary

Create or Modify System Process

Systemd Service

Windows Service

Event Triggered Execution

Change Default File Association

Windows Management Instrumentation Event Subscription

Unix Shell Configuration Modification

LC_LOAD_DYLIB Addition

Netsh Helper DLL

Accessibility Features

Application Shimming

Image File Execution Options Injection

PowerShell Profile

Component Object Model Hijacking

External Remote Services

Hijack Execution Flow

Services File Permissions Weakness

Executable Installer File Permissions Weakness

Services Registry Permissions Weakness

Path Interception by Unquoted Path

Path Interception by PATH Environment Variable

Path Interception by Search Order Hijacking

DLL Search Order Hijacking

DLL Side-Loading

Dynamic Linker Hijacking

Dylib Hijacking

Implant Internal Image

Modify Authentication Process

Domain Controller Authentication

Password Filter DLL

Pluggable Authentication Modules

Network Device Authentication

Office Application Startup

Office Template Macros

Outlook Home Page

System Firmware

Component Firmware

Scheduled Task/Job

Container Orchestration Job

Server Software Component

SQL Stored Procedures

Transport Agent

Traffic Signaling

Default Accounts

Domain Accounts

Abuse Elevation Control Mechanism

Setuid and Setgid

Bypass User Account Control

Sudo and Sudo Caching

Elevated Execution with Prompt

Access Token Manipulation

Token Impersonation/Theft

Create Process with Token

Make and Impersonate Token

Parent PID Spoofing

SID-History Injection

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Authentication Package

Winlogon Helper DLL

Security Support Provider

Kernel Modules and Extensions

Re-opened Applications

Shortcut Modification

Plist Modification

Print Processors

XDG Autostart Entries

Boot or Logon Initialization Scripts

Logon Script (Windows)

Logon Script (Mac)

Network Logon Script

Create or Modify System Process

Systemd Service

Windows Service

Domain Policy Modification

Group Policy Modification

Domain Trust Modification

Event Triggered Execution

Change Default File Association

Windows Management Instrumentation Event Subscription

Unix Shell Configuration Modification

LC_LOAD_DYLIB Addition

Netsh Helper DLL

Accessibility Features

Application Shimming

Image File Execution Options Injection

PowerShell Profile

Component Object Model Hijacking

Exploitation for Privilege Escalation

Hijack Execution Flow

Services File Permissions Weakness

Executable Installer File Permissions Weakness

Services Registry Permissions Weakness

Path Interception by Unquoted Path

Path Interception by PATH Environment Variable

Path Interception by Search Order Hijacking

DLL Search Order Hijacking

DLL Side-Loading

Dynamic Linker Hijacking

Dylib Hijacking

Process Injection

Dynamic-link Library Injection

Portable Executable Injection

Thread Execution Hijacking

Asynchronous Procedure Call

Thread Local Storage

Ptrace System Calls

Extra Window Memory Injection

Process Doppelgänging

Process Hollowing

Scheduled Task/Job

Container Orchestration Job

Default Accounts

Domain Accounts

Abuse Elevation Control Mechanism

Setuid and Setgid

Bypass User Account Control

Sudo and Sudo Caching

Elevated Execution with Prompt

Access Token Manipulation

Token Impersonation/Theft

Create Process with Token

Make and Impersonate Token

Parent PID Spoofing

SID-History Injection

Build Image on Host

Deobfuscate/Decode Files or Information

Deploy Container

Direct Volume Access

Domain Policy Modification

Group Policy Modification

Domain Trust Modification

Execution Guardrails

Environmental Keying

Exploitation for Defense Evasion

File and Directory Permissions Modification

Windows File and Directory Permissions Modification

Linux and Mac File and Directory Permissions Modification

Hidden Files and Directories

NTFS File Attributes

Hidden File System

Run Virtual Instance

Email Hiding Rules

Resource Forking

Hijack Execution Flow

Services File Permissions Weakness

Executable Installer File Permissions Weakness

Services Registry Permissions Weakness

Path Interception by Unquoted Path

Path Interception by PATH Environment Variable

Path Interception by Search Order Hijacking

DLL Search Order Hijacking

DLL Side-Loading

Dynamic Linker Hijacking

Dylib Hijacking

Impair Defenses

Disable or Modify Tools

Disable Windows Event Logging

Impair Command History Logging

Disable or Modify System Firewall

Indicator Blocking

Disable or Modify Cloud Firewall

Disable Cloud Logs

Downgrade Attack

Indicator Removal on Host

Clear Windows Event Logs

Clear Linux or Mac System Logs

Clear Command History

Network Share Connection Removal

Indirect Command Execution

Invalid Code Signature

Right-to-Left Override

Rename System Utilities

Masquerade Task or Service

Match Legitimate Name or Location

Space after Filename

Double File Extension

Modify Authentication Process

Domain Controller Authentication

Password Filter DLL

Pluggable Authentication Modules

Network Device Authentication

Modify Cloud Compute Infrastructure

Create Snapshot

Create Cloud Instance

Delete Cloud Instance

Revert Cloud Instance

Modify Registry

Modify System Image

Patch System Image

Downgrade System Image

Network Boundary Bridging

Network Address Translation Traversal

Obfuscated Files or Information

Software Packing

Compile After Delivery

Indicator Removal from Tools

System Firmware

Component Firmware

Process Injection

Dynamic-link Library Injection

Portable Executable Injection

Thread Execution Hijacking

Asynchronous Procedure Call

Thread Local Storage

Ptrace System Calls

Extra Window Memory Injection

Process Doppelgänging

Process Hollowing

Reflective Code Loading

Rogue Domain Controller

Signed Binary Proxy Execution

Compiled HTML File

Signed Script Proxy Execution

Subvert Trust Controls

Gatekeeper Bypass

SIP and Trust Provider Hijacking

Install Root Certificate

Mark-of-the-Web Bypass

Code Signing Policy Modification

Template Injection

Traffic Signaling

Trusted Developer Utilities Proxy Execution

Unused/Unsupported Cloud Regions

Use Alternate Authentication Material

Pass the Ticket

Application Access Token

Web Session Cookie

Default Accounts

Domain Accounts

Virtualization/Sandbox Evasion

User Activity Based Checks

Time Based Evasion

Weaken Encryption

Reduce Key Space

Disable Crypto Hardware

XSL Script Processing

Adversary-in-the-Middle

LLMNR/NBT-NS Poisoning and SMB Relay

ARP Cache Poisoning

Password Guessing

Password Cracking

Password Spraying

Credential Stuffing

Credentials from Password Stores

Securityd Memory

Credentials from Web Browsers

Windows Credential Manager

Password Managers

Exploitation for Credential Access

Forced Authentication

Forge Web Credentials

GUI Input Capture

Web Portal Capture

Credential API Hooking

Modify Authentication Process

Domain Controller Authentication

Password Filter DLL

Pluggable Authentication Modules

Network Device Authentication

Network Sniffing

OS Credential Dumping

Security Account Manager

Proc Filesystem

/etc/passwd and /etc/shadow

Cached Domain Credentials

Steal Application Access Token

Steal or Forge Kerberos Tickets

AS-REP Roasting

Steal Web Session Cookie

Two-Factor Authentication Interception

Unsecured Credentials

Credentials In Files

Credentials in Registry

Cloud Instance Metadata API

Group Policy Preferences

Account Discovery

Application Window Discovery

Browser Bookmark Discovery

Cloud Infrastructure Discovery

Cloud Service Dashboard

Cloud Service Discovery

Cloud Storage Object Discovery

Container and Resource Discovery

Domain Trust Discovery

File and Directory Discovery

Group Policy Discovery

Network Service Scanning

Network Share Discovery

Network Sniffing

Password Policy Discovery

Peripheral Device Discovery

Permission Groups Discovery

Process Discovery

Remote System Discovery

Software Discovery

Security Software Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

System Network Connections Discovery

System Owner/User Discovery

System Service Discovery

System Time Discovery

Virtualization/Sandbox Evasion

User Activity Based Checks

Time Based Evasion

Exploitation of Remote Services

Internal Spearphishing

Lateral Tool Transfer

Remote Service Session Hijacking

Remote Services

Remote Desktop Protocol

SMB/Windows Admin Shares

Distributed Component Object Model

Windows Remote Management

Replication Through Removable Media

Software Deployment Tools

Taint Shared Content

Use Alternate Authentication Material

Pass the Ticket

Application Access Token

Web Session Cookie

Adversary-in-the-Middle

LLMNR/NBT-NS Poisoning and SMB Relay

ARP Cache Poisoning

Archive Collected Data

Archive via Utility

Archive via Library

Archive via Custom Method

Automated Collection

Browser Session Hijacking

Data from Cloud Storage Object

Data from Configuration Repository

SNMP (MIB Dump)

Network Device Configuration Dump

Data from Information Repositories

Code Repositories

Data from Local System

Data from Network Shared Drive

Data from Removable Media

Local Data Staging

Remote Data Staging

Email Collection

Local Email Collection

Remote Email Collection

Email Forwarding Rule

GUI Input Capture

Web Portal Capture

Credential API Hooking

Application Layer Protocol

File Transfer Protocols

Communication Through Removable Media

Standard Encoding

Non-Standard Encoding

Data Obfuscation

Protocol Impersonation

Dynamic Resolution

Domain Generation Algorithms

DNS Calculation

Encrypted Channel

Symmetric Cryptography

Asymmetric Cryptography

Fallback Channels

Ingress Tool Transfer

Multi-Stage Channels

Non-Application Layer Protocol

Non-Standard Port

Protocol Tunneling

Multi-hop Proxy

Domain Fronting

Remote Access Software

Traffic Signaling

Dead Drop Resolver

Bidirectional Communication

One-Way Communication

Automated Exfiltration

Traffic Duplication

Data Transfer Size Limits

Exfiltration Over Alternative Protocol

Exfiltration Over Symmetric Encrypted Non-C2 Protocol

Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol

Exfiltration Over C2 Channel

Exfiltration Over Other Network Medium

Exfiltration Over Bluetooth

Exfiltration Over Physical Medium

Exfiltration over USB

Exfiltration Over Web Service

Exfiltration to Code Repository

Exfiltration to Cloud Storage

Scheduled Transfer

Transfer Data to Cloud Account

Account Access Removal

Data Destruction

Data Encrypted for Impact

Data Manipulation

Stored Data Manipulation

Transmitted Data Manipulation

Runtime Data Manipulation

Internal Defacement

External Defacement

Disk Content Wipe

Disk Structure Wipe

Endpoint Denial of Service

OS Exhaustion Flood

Service Exhaustion Flood

Application Exhaustion Flood

Application or System Exploitation

Firmware Corruption

Inhibit System Recovery

Network Denial of Service

Direct Network Flood

Reflection Amplification

Resource Hijacking

System Shutdown/Reboot

Initial Access

4 techniques

Execution

3 techniques

Persistence

7 techniques

Privilege Escalation

3 techniques

Defense Evasion

14 techniques

Credential Access

5 techniques

Discovery

8 techniques

Lateral Movement

2 techniques

Collection

13 techniques

Command and Control

8 techniques

Exfiltration

2 techniques

Impact

9 techniques

Drive-By Compromise

Lockscreen Bypass

Replication Through Removable Media

Supply Chain Compromise

Compromise Software Dependencies and Development Tools

Compromise Hardware Supply Chain

Compromise Software Supply Chain

Command and Scripting Interpreter

Scheduled Task/Job

Boot or Logon Initialization Scripts

Compromise Application Executable

Compromise Client Software Binary

Event Triggered Execution

Broadcast Receivers

Foreground Persistence

Hijack Execution Flow

System Runtime API Hijacking

Scheduled Task/Job

Abuse Elevation Control Mechanism

Device Administrator Permissions

Exploitation for Privilege Escalation

Process Injection

Ptrace System Calls

Download New Code at Runtime

Execution Guardrails

Foreground Persistence

Suppress Application Icon

Impair Defenses

Prevent Application Removal

Disable or Modify Tools

Indicator Removal on Host

Uninstall Malicious Application

Disguise Root/Jailbreak Indicators

Input Injection

Obfuscated Files or Information

Software Packing

Process Injection

Ptrace System Calls

Proxy Through Victim

Subvert Trust Controls

Code Signing Policy Modification

Virtualization/Sandbox Evasion

Access Notifications

Credentials from Password Store

GUI Input Capture

Steal Application Access Token

File and Directory Discovery

Location Tracking

Remote Device Management Services

Impersonate SS7 Nodes

Network Service Scanning

Process Discovery

Software Discovery

Security Software Discovery

System Information Discovery

System Network Configuration Discovery

System Network Connections Discovery

Exploitation of Remote Services

Replication Through Removable Media

Access Notifications

Adversary-in-the-Middle

Archive Collected Data

Data from Local System

GUI Input Capture

Location Tracking

Remote Device Management Services

Impersonate SS7 Nodes

Protected User Data

Calendar Entries

Stored Application Data

Application Layer Protocol

Dynamic Resolution

Domain Generation Algorithms

Encrypted Channel

Symmetric Cryptography

Asymmetric Cryptography

Ingress Tool Transfer

Non-Standard Port

Out of Band Data

Dead Drop Resolver

Bidirectional Communication

One-Way Communication

Exfiltration Over Alternative Protocol

Exfiltration Over Unencrypted Non-C2 Protocol

Exfiltration Over C2 Channel

Account Access Removal

Data Encrypted for Impact

Data Manipulation

Transmitted Data Manipulation

Endpoint Denial of Service

Generate Traffic from Victim

Input Injection

Network Denial of Service

MDM is NOT Security

Watch the Video to learn why MDM is NOT security

MITRE Engenuity ATT&CK® Evaluations Highlight Check Point’s Leadership in Endpoint Security

Learn How Harmony Endpoint Achieved 100% Detection across All Tested Unique ATT&CK Techniques

LEARN MORE GET THE ULTIMATE GUIDE

MITER Engenuity - Harmony Endpoint

Additional Resources

Cyber Hub

What is MITRE ATT&CK Framework?

What is MITRE ATT&CK Matrix (Matrices) for Mobile?

What is MITRE Engenuity?

Blog

MITRE Engenuity ATT&CK® Evaluations Highlight Check Point Software Leadership in Endpoint Security with 100% Detection across All Tested Unique ATT&CK Techniques

The Ultimate Guide to 2020 MITRE ATT&CK® Evaluations

Enhancing Threat Hunting with MITRE ATT&CK

Guides

The Ultimate Guide to 2020 MITRE Engenuity ATT&CK Evaluations

This website uses cookies for its functionality and for analytics and marketing purposes. By continuing to use this website, you agree to the use of cookies. For more information, please read our .