MITRE ATT&CK Cheatsheet

Deliver malicious content via email attachments or links

Exploit vulnerabilities in public-facing web applications

Abuse external-facing remote services like VPN or RDP

Use legitimate credentials for initial access

Compromise through software supply chain

Execute commands via PowerShell/Bash/Python etc.

Abuse PowerShell scripts and commands

Remote execution via Windows Management Instrumentation

Schedule code execution via task scheduler or cron

Trick users into executing malicious files or links

Set auto-start via registry or startup folder

Create scheduled tasks or cron jobs for persistence

Create new accounts for persistent access

Create or modify system services for persistence

Install backdoor shell on web server

Bypass privilege control mechanisms like sudo/UAC

Exploit kernel or software vulnerabilities for escalation

Inject code into legitimate processes to gain privileges

Abuse DLL search order to load malicious DLLs

Manipulate Windows access tokens for privilege gain

Delete logs and files to remove activity traces

Obfuscate malware or communications to evade detection

Disable antivirus or firewall protections

Disguise as legitimate files or services

Abuse Living Off the Land Binaries (legitimate tools)

Dump credentials from SAM/LSASS/etc.

Execute brute force password attacks

Retrieve passwords from browsers or keychains

Crack Kerberos tickets offline for credentials

Intercept network communications for credentials

Collect OS, hardware, and patch information

Enumerate important files and directories

Scan for network services

Enumerate local and domain accounts

Collect network interface and routing information

Lateral movement via Remote Desktop Protocol

Lateral movement via SMB file shares

Lateral movement via SSH connections

Transfer attack tools to lateral movement targets

Move without credentials via Pass-the-Hash/Ticket

Collect sensitive data from local file system

Collect data from email mailboxes

Log keystrokes to capture sensitive information

Take screenshots to collect information

Compress and encrypt data before exfiltration

Exfiltrate data over existing C2 channel

Exfiltrate data over alternative protocols like DNS/ICMP

Send data to cloud storage or legitimate web services

Exfiltrate data on a schedule

Transfer data to attacker-controlled cloud accounts