Public registry · MITRE ATT&CK-mapped

Browse rules by MITRE ATT&CK

Browse governance rules by MITRE ATT&CK tactic & technique. Pick a technique to find the public rulesets whose .rules defend against it — filterable per technology.

Coverage matrix

Tactics & techniques

Reconnaissance TA0043
0 tech 0 rules
No mapped rules yet
Resource Development TA0042
2 tech 3 rules
T1195 Supply Chain Compromise 2 T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools 1
Initial Access TA0001
1 tech 1 rules
T1195 Supply Chain Compromise 1
Execution TA0002
4 tech 8 rules
T1059.001 Command and Scripting Interpreter: PowerShell 5 T1047 Windows Management Instrumentation 1 T1059.004 Command and Scripting Interpreter: Unix Shell 1 T1553.001 Subvert Trust Controls: Gatekeeper Bypass 1
Persistence TA0003
9 tech 9 rules
T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder 2 T1053.005 Scheduled Task/Job: Scheduled Task 1 T1098 Account Manipulation 1 T1136.001 Create Account: Local Account 1 T1542 Pre-OS Boot 1 T1543.001 Create or Modify System Process: Launch Agent 1 T1543.004 Create or Modify System Process: Launch Daemon 1 T1546.004 Event Triggered Execution: Unix Shell Configuration Modification 1 T1601 Modify System Image 1
Privilege Escalation TA0004
3 tech 4 rules
T1548 Abuse Elevation Control Mechanism 2 T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control 1 T1548.004 Abuse Elevation Control Mechanism: Elevated Execution with Prompt 1
Defense Evasion TA0005
20 tech 26 rules
T1562.001 Impair Defenses: Disable or Modify Tools 8 T1562 Impair Defenses 2 T1027 Obfuscated Files or Information 1 T1055 Process Injection 1 T1070.001 Indicator Removal: Clear Windows Event Logs 1 T1070.008 Indicator Removal: Clear Mailbox Data 1 T1127 Trusted Developer Utilities Proxy Execution 1 T1197 BITS Jobs 1 T1218 System Binary Proxy Execution 1 T1218.010 System Binary Proxy Execution: Regsvr32 1 T1222.001 File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 T1222.002 File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification 1 T1552.001 Unsecured Credentials: Credentials In Files 1 T1553 Subvert Trust Controls 1 T1553.001 Subvert Trust Controls: Gatekeeper Bypass 1 T1553.005 Subvert Trust Controls: Mark-of-the-Web Bypass 1 T1562.004 Impair Defenses: Disable or Modify System Firewall 1 T1562.006 Impair Defenses: Indicator Blocking 1 T1562.010 Impair Defenses: Downgrade Attack 1 T1574 Hijack Execution Flow 1
Credential Access TA0006
10 tech 9 rules
T1552.001 Unsecured Credentials: Credentials In Files 2 T1555 Credentials from Password Stores 2 T1555.001 Credentials from Password Stores: Keychain 2 T1003 OS Credential Dumping 1 T1003.001 OS Credential Dumping: LSASS Memory 1 T1003.002 OS Credential Dumping: Security Account Manager 1 T1003.003 OS Credential Dumping: NTDS 1 T1539 Steal Web Session Cookie 1 T1552.002 Unsecured Credentials: Credentials in Registry 1 T1557 Adversary-in-the-Middle 1
Discovery TA0007
1 tech 1 rules
T1012 Query Registry 1
Lateral Movement TA0008
2 tech 2 rules
T1021.004 Remote Services: SSH 1 T1091 Replication Through Removable Media 1
Collection TA0009
5 tech 11 rules
T1005 Data from Local System 5 T1114 Email Collection 2 T1530 Data from Cloud Storage 2 T1114.003 Email Collection: Email Forwarding Rule 1 T1213 Data from Information Repositories 1
Command and Control TA0011
2 tech 2 rules
T1105 Ingress Tool Transfer 1 T1571 Non-Standard Port 1
Exfiltration TA0010
4 tech 6 rules
T1041 Exfiltration Over C2 Channel 2 T1567 Exfiltration Over Web Service 2 T1059.004 Command and Scripting Interpreter: Unix Shell 1 T1565.001 Data Manipulation: Stored Data Manipulation 1
Impact TA0040
5 tech 15 rules
T1485 Data Destruction 10 T1490 Inhibit System Recovery 2 T1489 Service Stop 1 T1561.002 Disk Wipe: Disk Structure Wipe 1 T1565.001 Data Manipulation: Stored Data Manipulation 1