Threat ecosystem
Actors
Malware
Campaigns
CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 120
45 techniques
2 groups use it
Windows
in ATT&CK since 2019-01-29
updated 2025-04-16 · v1.3
Activity by month (incidents)
2026-062026-09
Sectors targeted
health · 2hospitality · 2education · 1finance · 1government · 1logistics · 1manufacturing · 1retail · 1transportation · 1
Countries targeted
CA · 4US · 4CN · 2IN · 1JO · 1PH · 1PL · 1
Origin
AO · 1AT · 1BF · 1BI · 1BJ · 1BW · 1
Kinds of incident
Malware & Botnets · 7Phishing & Social Engineering · 4AI-Enabled Attack · 2Data Breach · 1
Techniques seen in incidents
Phishing · 7T1588.001 - Malware · 5T1566 - Phishing · 4Impersonate · 2Lateral Movement · 2Privilege Escalation · 2Reconnaissance · 2T1546.005 - Trap · 2Impersonation · 1Ransomware · 1Social Engineering · 1T1059.006 - Python · 1T1059.007 - JavaScript · 1T1684.001 - Impersonation · 1
ATT&CK techniques by tactic (45)
initial access
T1566.001 Spearphishing Attachment
execution
T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1203 Exploitation for Client Execution T1204.002 Malicious File
persistence
T1053.005 Scheduled Task T1112 Modify Registry T1547.001 Registry Run Keys / Startup Folder
privilege escalation
T1053.005 Scheduled Task T1055 Process Injection T1055.012 Process Hollowing T1547.001 Registry Run Keys / Startup Folder
credential access
T1056.001 Keylogging T1552.001 Credentials In Files T1552.002 Credentials in Registry T1555 Credentials from Password Stores T1555.003 Credentials from Web Browsers
discovery
T1016 System Network Configuration Discovery T1016.002 Wi-Fi Discovery T1033 System Owner/User Discovery T1057 Process Discovery T1082 System Information Discovery T1087.001 Local Account T1124 System Time Discovery T1497 Virtualization/Sandbox Evasion
collection
T1056.001 Keylogging T1113 Screen Capture T1115 Clipboard Data T1125 Video Capture T1185 Browser Session Hijacking T1560 Archive Collected Data
command and control
T1071.001 Web Protocols T1071.003 Mail Protocols T1105 Ingress Tool Transfer
exfiltration
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
stealth
T1027 Obfuscated Files or Information T1055 Process Injection T1055.012 Process Hollowing T1140 Deobfuscate/Decode Files or Information T1218.009 Regsvcs/Regasm T1497 Virtualization/Sandbox Evasion T1564.001 Hidden Files and Directories T1564.003 Hidden Window
defense impairment
T1112 Modify Registry T1685 Disable or Modify Tools
Groups that use it
SilverTerrierTA2541