CmdID

CmdID / Techniques

ATT&CK techniques

The 309 MITRE ATT&CK techniques that CmdID’s Sigma rules and documented abuse name, each with the programs for it, the rules tagged with it and the everyday command lines CmdID reads as it. To see which techniques a command line shows, paste it into CmdID.

By id

MITRE ATT&CK Enterprise

T1003 OS Credential Dumping6 programs · 14 rules T1003.001 OS Credential Dumping: LSASS Memory9 programs · 31 rules T1003.002 OS Credential Dumping: Security Account Manager2 programs · 10 rules T1003.003 OS Credential Dumping: NTDS6 programs · 12 rules T1003.004 OS Credential Dumping: LSA Secrets1 program · 3 rules T1003.005 OS Credential Dumping: Cached Domain Credentials2 programs · 4 rules T1003.006 OS Credential Dumping: DCSync1 rule T1005 Data from Local System2 programs · 9 rules T1007 System Service Discovery3 programs · 10 rules T1012 Query Registry1 program · 7 rules T1014 Rootkit1 rule T1016 System Network Configuration Discovery1 program · 7 rules T1018 Remote System Discovery13 rules T1021 Remote Services4 rules T1021.001 Remote Services: Remote Desktop Protocol2 programs · 8 rules T1021.002 Remote Services: SMB/Windows Admin Shares1 program · 10 rules T1021.003 Remote Services: Distributed Component Object Model1 program · 5 rules T1021.004 Remote Services: SSH1 program · 2 rules T1021.005 Remote Services: VNC1 rule T1021.006 Remote Services: Windows Remote Management4 rules T1027 Obfuscated Files or Information2 programs · 40 rules T1027.001 Obfuscated Files or Information: Binary Padding1 program · 1 rule T1027.003 Obfuscated Files or Information: Steganography1 program · 1 rule T1027.004 Obfuscated Files or Information: Compile After Delivery2 programs · 5 rules T1027.005 Obfuscated Files or Information: Indicator Removal from Tools3 rules T1027.009 Obfuscated Files or Information: Embedded Payloads1 rule T1027.010 Obfuscated Files or Information: Command Obfuscation2 programs · 8 rules T1027.011 Obfuscated Files or Information: Fileless Storage1 rule T1027.013 Obfuscated Files or Information: Encrypted/Encoded File1 program T1030 Data Transfer Size Limits1 program · 1 rule T1033 System Owner/User Discovery22 rules T1036 Masquerading8 programs · 35 rules T1036.002 Masquerading: Right-to-Left Override1 program · 2 rules T1036.003 Masquerading: Rename Legitimate Utilities4 programs · 21 rules T1036.004 Masquerading: Masquerade Task or Service2 rules T1036.005 Masquerading: Match Legitimate Resource Name or Location4 programs · 14 rules T1036.006 Masquerading: Space after Filename1 rule T1037 Boot or Logon Initialization ScriptsT1037.001 Boot or Logon Initialization Scripts: Logon Script (Windows)2 rules T1039 Data from Network Shared Drive1 rule T1040 Network Sniffing3 programs · 5 rules T1041 Exfiltration Over C2 Channel1 program · 2 rules T1046 Network Service Discovery11 rules T1047 Windows Management Instrumentation4 programs · 38 rules T1048 Exfiltration Over Alternative Protocol2 programs · 7 rules T1048.001 Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol1 rule T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol3 programs · 3 rules T1049 System Network Connections Discovery6 rules T1053 Scheduled Task/Job5 rules T1053.002 Scheduled Task/Job: At2 programs · 2 rules T1053.003 Scheduled Task/Job: Cron2 rules T1053.005 Scheduled Task/Job: Scheduled Task1 program · 32 rules T1055 Process Injection3 programs · 16 rules T1055.001 Process Injection: Dynamic-link Library Injection1 program · 6 rules T1055.009 Process Injection: Proc Memory1 program · 1 rule T1055.012 Process Injection: Process Hollowing3 rules T1056 Input CaptureT1056.002 Input Capture: GUI Input Capture2 rules T1057 Process Discovery1 program · 5 rules T1059 Command and Scripting Interpreter20 programs · 80 rules T1059.001 Command and Scripting Interpreter: PowerShell4 programs · 103 rules T1059.002 Command and Scripting Interpreter: AppleScript9 rules T1059.003 Command and Scripting Interpreter: Windows Command Shell3 programs · 34 rules T1059.004 Command and Scripting Interpreter: Unix Shell184 programs · 9 rules T1059.005 Command and Scripting Interpreter: Visual Basic6 programs · 18 rules T1059.006 Command and Scripting Interpreter: Python1 program · 8 rules T1059.007 Command and Scripting Interpreter: JavaScript6 programs · 21 rules T1059.012 Command and Scripting Interpreter: Hypervisor CLI9 rules T1068 Exploitation for Privilege Escalation1 program · 14 rules T1069 Permission Groups Discovery1 rule T1069.001 Permission Groups Discovery: Local Groups1 program · 7 rules T1069.002 Permission Groups Discovery: Domain Groups8 rules T1070 Indicator Removal3 programs · 8 rules T1070.003 Indicator Removal: Clear Command History1 program · 1 rule T1070.004 Indicator Removal: File Deletion6 rules T1070.005 Indicator Removal: Network Share Connection Removal1 rule T1070.006 Indicator Removal: Timestomp2 rules T1071 Application Layer Protocol1 program · 4 rules T1071.001 Application Layer Protocol: Web Protocols1 program · 9 rules T1071.004 Application Layer Protocol: DNS3 rules T1072 Software Deployment Tools1 program · 3 rules T1074 Data StagedT1074.001 Data Staged: Local Data Staging1 rule T1078 Valid Accounts1 program · 3 rules T1078.001 Valid Accounts: Default Accounts3 rules T1078.002 Valid Accounts: Domain Accounts1 rule T1078.003 Valid Accounts: Local Accounts4 rules T1082 System Information Discovery5 programs · 26 rules T1083 File and Directory Discovery8 programs · 19 rules T1087 Account Discovery11 rules T1087.001 Account Discovery: Local Account9 rules T1087.002 Account Discovery: Domain Account12 rules T1090 Proxy1 program · 11 rules T1090.001 Proxy: Internal Proxy5 rules T1090.003 Proxy: Multi-hop Proxy1 rule T1095 Non-Application Layer Protocol1 rule T1098 Account Manipulation6 rules T1102 Web Service3 rules T1102.002 Web Service: Bidirectional Communication1 rule T1105 Ingress Tool Transfer85 programs · 57 rules T1106 Native API2 programs · 5 rules T1110 Brute Force2 rules T1110.001 Brute Force: Password Guessing2 rules T1110.002 Brute Force: Password Cracking1 rule T1112 Modify Registry3 programs · 24 rules T1113 Screen Capture2 programs · 3 rules T1114 Email Collection1 rule T1115 Clipboard Data5 rules T1119 Automated Collection2 rules T1120 Peripheral Device Discovery1 program · 1 rule T1123 Audio Capture2 rules T1124 System Time Discovery2 rules T1127 Trusted Developer Utilities Proxy Execution38 programs · 17 rules T1127.001 Trusted Developer Utilities Proxy Execution: MSBuild1 program T1127.002 Trusted Developer Utilities Proxy Execution: ClickOnce4 programs T1132 Data EncodingT1132.001 Data Encoding: Standard Encoding3 rules T1133 External Remote Services7 rules T1134 Access Token Manipulation2 rules T1134.001 Access Token Manipulation: Token Impersonation/Theft4 rules T1134.002 Access Token Manipulation: Create Process with Token1 program · 5 rules T1134.003 Access Token Manipulation: Make and Impersonate Token3 rules T1134.004 Access Token Manipulation: Parent PID Spoofing1 rule T1135 Network Share Discovery1 program · 7 rules T1136 Create Account1 rule T1136.001 Create Account: Local Account7 rules T1136.002 Create Account: Domain Account1 rule T1137 Office Application StartupT1137.002 Office Application Startup: Office Test1 rule T1140 Deobfuscate/Decode Files or Information4 programs · 15 rules T1176 Software Extensions1 rule T1176.001 Software Extensions: Browser Extensions2 rules T1185 Browser Session Hijacking2 rules T1187 Forced Authentication1 program · 3 rules T1189 Drive-by Compromise1 rule T1190 Exploit Public-Facing Application29 rules T1195 Supply Chain CompromiseT1195.002 Supply Chain Compromise: Compromise Software Supply Chain9 rules T1197 BITS Jobs1 program · 6 rules T1201 Password Policy Discovery2 rules T1202 Indirect Command Execution28 programs · 37 rules T1203 Exploitation for Client Execution18 rules T1204 User Execution6 rules T1204.001 User Execution: Malicious Link2 rules T1204.002 User Execution: Malicious File2 programs · 15 rules T1204.004 User Execution: Malicious Copy and Paste3 rules T1210 Exploitation of Remote Services4 rules T1211 Exploitation for Stealth1 rule T1212 Exploitation for Credential Access1 rule T1216 System Script Proxy Execution8 programs · 11 rules T1216.001 System Script Proxy Execution: PubPrn1 program · 2 rules T1216.002 System Script Proxy Execution: SyncAppvPublishingServer1 program T1217 Browser Information Discovery2 rules T1218 System Binary Proxy Execution91 programs · 123 rules T1218.001 System Binary Proxy Execution: Compiled HTML File1 program · 5 rules T1218.002 System Binary Proxy Execution: Control Panel1 program · 1 rule T1218.003 System Binary Proxy Execution: CMSTP1 program · 1 rule T1218.004 System Binary Proxy Execution: InstallUtil1 program T1218.005 System Binary Proxy Execution: Mshta2 programs · 7 rules T1218.007 System Binary Proxy Execution: Msiexec3 programs · 7 rules T1218.008 System Binary Proxy Execution: Odbcconf1 program · 7 rules T1218.009 System Binary Proxy Execution: Regsvcs/Regasm2 programs · 3 rules T1218.010 System Binary Proxy Execution: Regsvr324 programs · 16 rules T1218.011 System Binary Proxy Execution: Rundll3215 programs · 34 rules T1218.012 System Binary Proxy Execution: Verclsid1 program T1218.013 System Binary Proxy Execution: Mavinject1 program · 2 rules T1218.014 System Binary Proxy Execution: MMC1 program · 1 rule T1218.015 System Binary Proxy Execution: Electron Applications6 programs T1219 Remote Access Tools5 rules T1219.002 Remote Access Tools: Remote Desktop Software24 rules T1220 XSL Script Processing4 programs · 4 rules T1222 File and Directory Permissions ModificationT1222.001 File and Directory Permissions Modification: Windows Permissions4 rules T1222.002 File and Directory Permissions Modification: Linux and Mac Permissions1 program · 2 rules T1482 Domain Trust Discovery11 rules T1484 Domain or Tenant Policy ModificationT1484.001 Domain or Tenant Policy Modification: Group Policy Modification2 rules T1485 Data Destruction3 programs · 6 rules T1486 Data Encrypted for Impact7 rules T1489 Service Stop2 programs · 9 rules T1490 Inhibit System Recovery3 programs · 16 rules T1491 DefacementT1491.001 Defacement: Internal Defacement1 program · 1 rule T1496 Resource Hijacking2 rules T1497 Virtualization/Sandbox EvasionT1497.001 Virtualization/Sandbox Evasion: System Checks1 program · 2 rules T1498 Network Denial of Service1 rule T1505 Server Software ComponentT1505.002 Server Software Component: Transport Agent1 rule T1505.003 Server Software Component: Web Shell1 program · 11 rules T1505.004 Server Software Component: IIS Components1 rule T1505.005 Server Software Component: Terminal Services DLL1 rule T1518 Software Discovery2 rules T1518.001 Software Discovery: Security Software Discovery2 programs · 7 rules T1526 Cloud Service Discovery1 rule T1528 Steal Application Access Token1 program · 3 rules T1529 System Shutdown/Reboot4 rules T1531 Account Access Removal2 rules T1539 Steal Web Session Cookie2 rules T1542 Pre-OS BootT1542.001 Pre-OS Boot: System Firmware1 rule T1542.003 Pre-OS Boot: Bootkit1 rule T1543 Create or Modify System Process2 rules T1543.001 Create or Modify System Process: Launch Agent2 rules T1543.002 Create or Modify System Process: Systemd Service1 rule T1543.003 Create or Modify System Process: Windows Service2 programs · 14 rules T1543.004 Create or Modify System Process: Launch Daemon2 rules T1546 Event Triggered Execution3 rules T1546.001 Event Triggered Execution: Change Default File Association1 program · 3 rules T1546.002 Event Triggered Execution: Screensaver1 program · 1 rule T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription1 program · 3 rules T1546.007 Event Triggered Execution: Netsh Helper DLL1 program · 2 rules T1546.008 Event Triggered Execution: Accessibility Features1 program · 5 rules T1546.011 Event Triggered Execution: Application Shimming2 rules T1546.015 Event Triggered Execution: Component Object Model Hijacking1 program · 2 rules T1547 Boot or Logon Autostart Execution2 programs · 2 rules T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder1 program · 7 rules T1547.002 Boot or Logon Autostart Execution: Authentication Package1 rule T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions1 rule T1547.010 Boot or Logon Autostart Execution: Port Monitors1 rule T1547.014 Boot or Logon Autostart Execution: Active Setup1 rule T1548 Abuse Elevation Control Mechanism3 programs · 7 rules T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid1 rule T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control10 programs · 24 rules T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching1 rule T1550 Use Alternate Authentication MaterialT1550.003 Use Alternate Authentication Material: Pass the Ticket2 rules T1552 Unsecured Credentials4 rules T1552.001 Unsecured Credentials: Credentials In Files1 program · 14 rules T1552.002 Unsecured Credentials: Credentials in Registry1 program · 3 rules T1552.003 Unsecured Credentials: Shell History1 rule T1552.004 Unsecured Credentials: Private Keys3 rules T1552.006 Unsecured Credentials: Group Policy Preferences1 program · 4 rules T1553 Subvert Trust Controls4 rules T1553.001 Subvert Trust Controls: Gatekeeper Bypass1 rule T1553.004 Subvert Trust Controls: Install Root Certificate1 program · 6 rules T1553.005 Subvert Trust Controls: Mark-of-the-Web Bypass1 rule T1554 Compromise Host Software Binary1 program · 2 rules T1555 Credentials from Password Stores3 rules T1555.001 Credentials from Password Stores: Keychain1 rule T1555.003 Credentials from Password Stores: Credentials from Web Browsers4 rules T1555.004 Credentials from Password Stores: Windows Credential Manager2 rules T1556 Modify Authentication ProcessT1556.002 Modify Authentication Process: Password Filter DLL2 rules T1557 Adversary-in-the-Middle2 rules T1557.001 Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay4 rules T1558 Steal or Forge Kerberos TicketsT1558.003 Steal or Forge Kerberos Tickets: Kerberoasting7 rules T1559 Inter-Process Communication1 rule T1560 Archive Collected Data1 program · 3 rules T1560.001 Archive Collected Data: Archive via Utility1 program · 15 rules T1563 Remote Service Session HijackingT1563.002 Remote Service Session Hijacking: RDP Hijacking2 rules T1564 Hide Artifacts3 programs · 5 rules T1564.001 Hide Artifacts: Hidden Files and Directories4 rules T1564.002 Hide Artifacts: Hidden Users1 program · 3 rules T1564.003 Hide Artifacts: Hidden Window2 programs · 7 rules T1564.004 Hide Artifacts: NTFS File Attributes23 programs · 14 rules T1564.006 Hide Artifacts: Run Virtual Instance1 program · 1 rule T1565 Data ManipulationT1565.001 Data Manipulation: Stored Data Manipulation2 rules T1566 Phishing1 program · 5 rules T1566.001 Phishing: Spearphishing Attachment1 program · 11 rules T1566.002 Phishing: Spearphishing Link1 rule T1567 Exfiltration Over Web Service3 programs · 4 rules T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage3 rules T1569 System Services1 rule T1569.001 System Services: Launchctl1 rule T1569.002 System Services: Service Execution9 rules T1570 Lateral Tool Transfer2 rules T1572 Protocol Tunneling1 program · 10 rules T1573 Encrypted Channel1 rule T1574 Hijack Execution Flow2 programs · 3 rules T1574.001 Hijack Execution Flow: DLL2 programs · 15 rules T1574.005 Hijack Execution Flow: Executable Installer File Permissions Weakness2 rules T1574.007 Hijack Execution Flow: Path Interception by PATH Environment Variable1 rule T1574.008 Hijack Execution Flow: Path Interception by Search Order Hijacking2 rules T1574.011 Hijack Execution Flow: Services Registry Permissions Weakness2 programs · 7 rules T1587 Develop Capabilities2 rules T1587.001 Develop Capabilities: Malware7 rules T1588 Obtain CapabilitiesT1588.002 Obtain Capabilities: Tool3 rules T1590 Gather Victim Network InformationT1590.001 Gather Victim Network Information: Domain Properties1 rule T1592 Gather Victim Host InformationT1592.004 Gather Victim Host Information: Client Configurations3 rules T1593 Search Open Websites/DomainsT1593.003 Search Open Websites/Domains: Code Repositories1 program · 2 rules T1595 Active Scanning2 rules T1595.001 Active Scanning: Scanning IP Blocks1 rule T1598 Phishing for InformationT1598.002 Phishing for Information: Spearphishing Attachment1 rule T1608 Stage Capabilities1 rule T1614 System Location DiscoveryT1614.001 System Location Discovery: System Language Discovery1 program · 2 rules T1615 Group Policy Discovery4 rules T1620 Reflective Code Loading1 rule T1622 Debugger Evasion1 rule T1649 Steal or Forge Authentication Certificates2 rules T1653 Power Settings1 program · 1 rule T1685 Disable or Modify Tools5 programs · 63 rules T1685.001 Disable or Modify Tools: Disable or Modify Windows Event Log2 programs · 10 rules T1685.004 Disable or Modify Tools: Disable or Modify Linux Audit System Log1 rule T1685.005 Disable or Modify Tools: Clear Windows Event Logs3 rules T1685.006 Disable or Modify Tools: Clear Linux or Mac System Logs3 rules T1686 Disable or Modify System Firewall3 rules T1686.003 Disable or Modify System Firewall: Windows Host Firewall1 program · 7 rules T1689 Downgrade Attack1 rule T1690 Prevent Command History Logging1 rule