ATT&CK Technique Index

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE

Every adversary technique we track in the wild — with detection guidance.

Defender-facing coverage for each MITRE ATT&CK technique observed in public reporting: what it is, how to detect it, and the incidents behind the count.

Data Encrypted for Impact

T1486 · Impact · 351 incidents (3y)

Valid Accounts

T1078 · Initial Access · 327 incidents (3y)

Impair Defenses

T1562 · Defense Evasion · 257 incidents (3y)

Supply Chain Compromise

T1195 · Initial Access · 103 incidents (3y)

Exploitation for Privilege Escalation

T1068 · Privilege Escalation · 94 incidents (3y)

AI / LLM-Assisted Activity

— · Resource Development · 44 incidents (3y)

Masquerading

T1036 · Defense Evasion · 36 incidents (3y)

Obfuscated Files or Information

T1027 · Defense Evasion · 33 incidents (3y)

Exploit Public-Facing Application

T1190 · Initial Access · 26 incidents (3y)

Data from Cloud Storage

T1530 · Collection · 25 incidents (3y)

Hijack Execution Flow

T1574 · Defense Evasion · 24 incidents (3y)

Process Injection

T1055 · Defense Evasion · 24 incidents (3y)

Native API

T1106 · Execution · 23 incidents (3y)

Phishing

T1566 · Initial Access · 17 incidents (3y)

User Execution

T1204 · Execution · 14 incidents (3y)

Pre-OS Boot

T1542 · Defense Evasion · 13 incidents (3y)

Subvert Trust Controls

T1553 · Defense Evasion · 10 incidents (3y)

Rootkit

T1014 · Defense Evasion · 7 incidents (3y)

OS Credential Dumping

T1003 · Credential Access · 7 incidents (3y)

Indicator Removal

T1070 · Defense Evasion · 6 incidents (3y)

Reflective Code Loading

T1620 · Defense Evasion · 5 incidents (3y)

This is the public cut. The desk sees the rest.

ColdRecon turns this signal into a daily brief and a live detection-coverage console. Request clearance.

Request Clearance →