All frameworks
mitre-attack-enterpriseversion v18.1

MITRE ATT&CK Enterprise

Official source

691 controls.

ReferenceFamilyTitle
T1027.012n/aLNK Icon Smuggling
T1027.013n/aEncrypted/Encoded File
T1027.014n/aPolymorphic Code
T1027.015n/aCompression
T1027.016n/aJunk Code Insertion
T1027.017n/aSVG Smuggling
T1029n/aScheduled Transfer
T1030n/aData Transfer Size Limits
T1033n/aSystem Owner/User Discovery
T1036n/aMasquerading
T1036.001n/aInvalid Code Signature
T1036.002n/aRight-to-Left Override
T1036.003n/aRename Legitimate Utilities
T1036.004n/aMasquerade Task or Service
T1036.005n/aMatch Legitimate Resource Name or Location
T1036.006n/aSpace after Filename
T1036.007n/aDouble File Extension
T1036.008n/aMasquerade File Type
T1036.009n/aBreak Process Trees
T1036.010n/aMasquerade Account Name
T1036.011n/aOverwrite Process Arguments
T1036.012n/aBrowser Fingerprint
T1037n/aBoot or Logon Initialization Scripts
T1037.001n/aLogon Script (Windows)
T1037.002n/aLogin Hook
T1037.003n/aNetwork Logon Script
T1037.004n/aRC Scripts
T1037.005n/aStartup Items
T1039n/aData from Network Shared Drive
T1040n/aNetwork Sniffing
T1041n/aExfiltration Over C2 Channel
T1046n/aNetwork Service Discovery
T1047n/aWindows Management Instrumentation
T1048n/aExfiltration Over Alternative Protocol
T1048.001n/aExfiltration Over Symmetric Encrypted Non-C2 Protocol
T1048.002n/aExfiltration Over Asymmetric Encrypted Non-C2 Protocol
T1048.003n/aExfiltration Over Unencrypted Non-C2 Protocol
T1049n/aSystem Network Connections Discovery
T1052n/aExfiltration Over Physical Medium
T1052.001n/aExfiltration over USB
T1053n/aScheduled Task/Job
T1053.002n/aAt
T1053.003n/aCron
T1053.005n/aScheduled Task
T1053.006n/aSystemd Timers
T1053.007n/aContainer Orchestration Job
T1055n/aProcess Injection
T1055.001n/aDynamic-link Library Injection
T1055.002n/aPortable Executable Injection
T1055.003n/aThread Execution Hijacking

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.