Working with ATT&CK | MITRE ATT&CK®

<!DOCTYPE html> <html lang='en'> <head> <script async src="https://www.googletagmanager.com/gtag/js?id=UA-62667723-1"></script> <script> window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'UA-62667723-1'); </script> <meta name="google-site-verification" content="2oJKLqNN62z6AOCb0A0IXGtbQuj-lev5YPAHFF_cbHQ"/> <meta charset='utf-8'> <meta name='viewport' content='width=device-width, initial-scale=1,shrink-to-fit=no'> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <link rel='shortcut icon' href="/versions/v13/theme/favicon.ico" type='image/x-icon'> <title>Working with ATT&CK | MITRE ATT&CK®</title>  <link rel='stylesheet' href="/versions/v13/theme/style/bootstrap.min.css" /> <link rel='stylesheet' href="/versions/v13/theme/style/bootstrap-glyphicon.min.css" /> <link rel='stylesheet' href="/versions/v13/theme/style/bootstrap-tourist.css" /> <link rel='stylesheet' href="/versions/v13/theme/style/bootstrap-select.min.css" /> <link rel="stylesheet" type="text/css" href="/versions/v13/theme/style.min.css?e8044105"> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css"> </head> <body> <div class="container-fluid attack-website-wrapper d-flex flex-column h-100"> <div class="row sticky-top flex-grow-0 flex-shrink-1">  <header class="col px-0"> <nav class='navbar navbar-expand-lg navbar-dark position-static'> <a class='navbar-brand' href="/versions/v13/"><img src="/versions/v13/theme/images/mitre_attack_logo.png" class="attack-logo"></a> <button class='navbar-toggler' type='button' data-toggle='collapse' data-target='#navbarCollapse' aria-controls='navbarCollapse' aria-expanded='false' aria-label='Toggle navigation'> <span class='navbar-toggler-icon'></span> </button> <div class='collapse navbar-collapse' id='navbarCollapse'> <ul class='nav nav-tabs ml-auto'> <li class="nav-item dropdown"> <a class="nav-link dropdown-toggle" href="/versions/v13/matrices/" id="navbarDropdown" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> <b>Matrices</b> </a> <div class="dropdown-menu " aria-labelledby="navbarDropdown"> <a class="dropdown-item" href="/versions/v13/matrices/enterprise/">Enterprise</a> <a class="dropdown-item" href="/versions/v13/matrices/mobile/">Mobile</a> <a class="dropdown-item" href="/versions/v13/matrices/ics/">ICS</a> </div> </li> <li class="nav-item dropdown"> <a class="nav-link dropdown-toggle" href="/versions/v13/tactics/" id="navbarDropdown" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> <b>Tactics</b> </a> <div class="dropdown-menu " aria-labelledby="navbarDropdown"> <a class="dropdown-item" href="/versions/v13/tactics/enterprise/">Enterprise</a> <a class="dropdown-item" href="/versions/v13/tactics/mobile/">Mobile</a> <a class="dropdown-item" href="/versions/v13/tactics/ics/">ICS</a> </div> </li> <li class="nav-item dropdown"> <a class="nav-link dropdown-toggle" href="/versions/v13/techniques/" id="navbarDropdown" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> <b>Techniques</b> </a> <div class="dropdown-menu " aria-labelledby="navbarDropdown"> <a class="dropdown-item" href="/versions/v13/techniques/enterprise/">Enterprise</a> <a class="dropdown-item" href="/versions/v13/techniques/mobile/">Mobile</a> <a class="dropdown-item" href="/versions/v13/techniques/ics/">ICS</a> </div> </li> <li class="nav-item"> <a href="/versions/v13/datasources" class="nav-link" ><b>Data Sources</b></a> </li> <li class="nav-item dropdown"> <a class="nav-link dropdown-toggle" href="/versions/v13/mitigations/" id="navbarDropdown" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> <b>Mitigations</b> </a> <div class="dropdown-menu " aria-labelledby="navbarDropdown"> <a class="dropdown-item" href="/versions/v13/mitigations/enterprise/">Enterprise</a> <a class="dropdown-item" href="/versions/v13/mitigations/mobile/">Mobile</a> <a class="dropdown-item" href="/versions/v13/mitigations/ics/">ICS</a> </div> </li> <li class="nav-item"> <a href="/versions/v13/groups" class="nav-link" ><b>Groups</b></a> </li> <li class="nav-item"> <a href="/versions/v13/software/" class="nav-link" ><b>Software</b></a> </li> <li class="nav-item"> <a href="/versions/v13/campaigns" class="nav-link" ><b>Campaigns</b></a> </li> <li class="nav-item dropdown"> <a class="nav-link dropdown-toggle" href="/versions/v13/resources/" id="navbarDropdown" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> <b>Resources</b> </a> <div class="dropdown-menu " aria-labelledby="navbarDropdown"> <a class="dropdown-item" href="/versions/v13/resources/">General Information</a> <a class="dropdown-item" href="/versions/v13/resources/getting-started/">Getting Started</a> <a class="dropdown-item" href="/versions/v13/resources/training/">Training</a> <a class="dropdown-item" href="/versions/v13/resources/attackcon/">ATT&CKcon</a> <a class="dropdown-item" href="/versions/v13/resources/working-with-attack/">Working with ATT&CK</a> <a class="dropdown-item" href="/versions/v13/resources/faq/">FAQ</a> <a class="dropdown-item" href="/resources/updates/">Updates</a> <a class="dropdown-item" href="/resources/versions/">Versions of ATT&CK</a> <a class="dropdown-item" href="/versions/v13/resources/related-projects/">Related Projects</a> <a class="dropdown-item" href="/versions/v13/resources/brand/">Brand Guide</a> </div> </li> <li class="nav-item"> <a href="https://medium.com/mitre-attack/" target="_blank" class="nav-link"> <b>Blog</b>  <img src="/versions/v13/theme/images/external-site.svg" alt="External site" class="external-icon" /> </a> </li> <li class="nav-item"> <a href="/versions/v13/resources/contribute/" class="nav-link" ><b>Contribute</b></a> </li> <li class="nav-item"> <button id="search-button" class="btn search-button">Search <div id="search-icon" class="icon-button search-icon"></div></button> </li> </ul> </div> </nav> </header> </div> <div class="row flex-grow-0 flex-shrink-1">  <div class="col px-0">  <div class="container-fluid version-banner"><div class="icon-inline baseline mr-1"><img src="/versions/v13/theme/images/icon-warning-24px.svg"></div>Currently viewing <a href="https://github.com/mitre/cti/releases/tag/ATT%26CK-v13.1" target="_blank">ATT&CK v13.1</a> which was live between April 25, 2023 and October 30, 2023. <a href="/resources/versions/">Learn more about the versioning system</a> or <a href="/">see the live site</a>.</div> </div> </div> <div class="row flex-grow-1 flex-shrink-0">   <div class="sidebar nav sticky-top flex-column pr-0 pt-4 pb-3 pl-3" id="v-tab" role="tablist" aria-orientation="vertical"> <div class="resizer"></div> <div id="v-tab" role="tablist" aria-orientation="vertical" class="h-100"> <div class="sidenav-wrapper"> <div class="heading" data-toggle="collapse" data-target="#sidebar-collapse" id="v-home-tab" aria-selected="false">RESOURCES <i class="fa fa-fw fa-chevron-down"></i> <i class="fa fa-fw fa-chevron-up"></i> </div> <br class="br-mobile"> <div class="collapse show" id="sidebar-collapse"> <div class="sidenav-list"> <div class="sidenav"> <div class="sidenav-head " id="general-info-general-info"> <a href="/versions/v13/resources/"> General Information </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="getting-started-getting-started"> <a href="/versions/v13/resources/getting-started/"> Getting Started </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="training"> <a href="/versions/v13/resources/training/"> Training </a> <div class="expand-button collapsed" id="training-header" data-toggle="collapse" data-target="#training-body" aria-expanded="false" aria-controls="#training-body"></div> </div> <div class="sidenav-body collapse" id="training-body" aria-labelledby="training-header"> <div class="sidenav"> <div class="sidenav-head " id="training-cti"> <a href="/versions/v13/resources/training/cti/"> CTI Training </a> </div> </div> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="attackcon"> <a href="/versions/v13/resources/attackcon/"> ATT&CKcon </a> <div class="expand-button collapsed" id="attackcon-header" data-toggle="collapse" data-target="#attackcon-body" aria-expanded="false" aria-controls="#attackcon-body"></div> </div> <div class="sidenav-body collapse" id="attackcon-body" aria-labelledby="attackcon-header"> <div class="sidenav"> <div class="sidenav-head " id="attackcon-"> <a href="/versions/v13/resources/attackcon/march-2022/"> ATT&CKcon 3.0 </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="attackcon-"> <a href="/versions/v13/resources/attackcon/october-2020/"> ATT&CKcon Power Hour </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="attackcon-"> <a href="/versions/v13/resources/attackcon/october-2019/"> ATT&CKcon 2.0 </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="attackcon-"> <a href="/versions/v13/resources/attackcon/october-2018/"> ATT&CKcon 2018 </a> </div> </div> </div> </div> <div class="sidenav"> <div class="sidenav-head active " id="working-with-attack-working-with-attack"> <a href="/versions/v13/resources/working-with-attack/"> Working with ATT&CK </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="faq"> <a href="/versions/v13/resources/faq/"> FAQ </a> <div class="expand-button collapsed" id="faq-header" data-toggle="collapse" data-target="#faq-body" aria-expanded="false" aria-controls="#faq-body"></div> </div> <div class="sidenav-body collapse" id="faq-body" aria-labelledby="faq-header"> <div class="sidenav"> <div class="sidenav-head " id="faq-"> <a href="/versions/v13/resources/faq/general/"> General </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="faq-"> <a href="/versions/v13/resources/faq/content/"> Content </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="faq-"> <a href="/versions/v13/resources/faq/resources/"> Resources </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="faq-"> <a href="/versions/v13/resources/faq/staying-informed/"> Staying Informed </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="faq-"> <a href="/versions/v13/resources/faq/attack-and-other-models/"> ATT&CK and Other Models </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="faq-"> <a href="/versions/v13/resources/faq/legal/"> Legal </a> </div> </div> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="updates"> <a href="/resources/updates/"> Updates </a> <div class="expand-button collapsed" id="updates-header" data-toggle="collapse" data-target="#updates-body" aria-expanded="false" aria-controls="#updates-body"></div> </div> <div class="sidenav-body collapse" id="updates-body" aria-labelledby="updates-header"> <div class="sidenav"> <div class="sidenav-head " id="updates-"> <a href="/resources/updates/updates-april-2023/"> April 2023 </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="updates-"> <a href="/resources/updates/updates-october-2022/"> October 2022 </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="updates-"> <a href="/resources/updates/updates-april-2022/"> April 2022 </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="updates-"> <a href="/resources/updates/updates-october-2021/"> October 2021 </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="updates-"> <a href="/resources/updates/updates-april-2021/"> April 2021 </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="updates-"> <a href="/resources/updates/updates-october-2020/"> October 2020 </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="updates-"> <a href="/resources/updates/updates-july-2020/"> July 2020 </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="updates-"> <a href="/resources/updates/updates-march-2020/"> March 2020 </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="updates-"> <a href="/resources/updates/updates-october-2019/"> October 2019 </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="updates-"> <a href="/resources/updates/updates-july-2019/"> July 2019 </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="updates-"> <a href="/resources/updates/updates-april-2019/"> April 2019 </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="updates-"> <a href="/resources/updates/updates-october-2018/"> October 2018 </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="updates-"> <a href="/resources/updates/updates-april-2018/"> April 2018 </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="updates-"> <a href="/resources/updates/updates-january-2018/"> January 2018 </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="updates-"> <a href="/resources/updates/updates-july-2017/"> July 2017 </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="updates-"> <a href="/resources/updates/updates-april-2017/"> April 2017 </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="updates-"> <a href="/resources/updates/updates-january-2017/"> January 2017 </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="updates-"> <a href="/resources/updates/updates-july-2016/"> July 2016 </a> </div> </div> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="versions-versions"> <a href="/resources/versions/"> Versions of ATT&CK </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="related-projects-related-projects"> <a href="/versions/v13/resources/related-projects/"> Related Projects </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="brand-brand"> <a href="/versions/v13/resources/brand/"> Brand Guide </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="privacy-privacy"> <a href="/versions/v13/resources/privacy/"> Privacy Policy </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="terms-of-use-terms-of-use"> <a href="/versions/v13/resources/terms-of-use/"> Terms of Use </a> </div> </div> <div class="sidenav"> <div class="sidenav-head " id="changelog-changelog"> <a href="/versions/v13/resources/changelog.html"> Changelog </a> </div> </div> </div> </div> </div> </div> </div> <div class="tab-content col-xl-9 col-lg-9 col-md-8 pt-4" id="v-tabContent"> <div class="tab-pane fade show active" id="v-attckmatrix" role="tabpanel" aria-labelledby="v-attckmatrix-tab">  <div class="px-3"> <ol class="breadcrumb"> <li class="breadcrumb-item"><a href="/versions/v13/">Home</a></li> <li class="breadcrumb-item"><a href="/versions/v13/resources">Resources</a></li> <li class="breadcrumb-item">Working With ATT&CK</li> </ol> </div> <div class="container pb-3 uniform-block decorative-panels"> <div class="working-with-attack"> <h2>Accessing ATT&CK Data</h2>  <div class="decorative-panel container"> <div class="decorative-panel-header row align-items-center"> <div class="col py-4"> <h3>ATT&CK in STIX</h3> <p> Structured Threat Information Expression (STIX™) is a language and serialization format used to exchange cyber threat intelligence (CTI). The ATT&CK dataset is available in STIX 2.0 and STIX 2.1. Other presentations of this dataset, including the ATT&CK Navigator and this website, are built from the STIX data. </p> <button class="btn btn-default" id="stix-button" data-toggle="collapse" data-target="#stix-body" aria-expanded="false" aria-controls="stix-body">Learn more</button> </div> <div class="col text-right"> <img class="w-100" src="/versions/v13/theme/images/mitre-cti.png"> </div> </div> <div class="decorative-panel-body collapse pt-4" id="stix-body" aria-labelledby="stix-button"> <div class="row align-items-center"> <div class="col"> <p> STIX is a machine-readable format providing access to the ATT&CK knowledge base. It is the most granular representation of the ATT&CK data, and all other representations are derived from the STIX dataset. </p> <p>Consider using ATT&CK in STIX if you:</p> <ul> <li>Have automated workflows that need to ingest ATT&CK data.</li> <li>Are a proficient Python user seeking to save time with automation or want to perform advanced queries.</li> <li>Want your workflows to keep up-to-date with the evolving knowledge base.</li> <li>Want to extend the ATT&CK dataset with custom content, and use this custom content with ATT&CK tools.</li> </ul> <p> The ATT&CK STIX representation is most easily manipulated in Python using the <a href="https://github.com/oasis-open/cti-python-stix2#installation">stix2</a> library. However, because STIX is represented in JSON, other programming languages can easily interact with the raw content. </p> <p> The ATT&CK STIX data can be retrieved from GitHub directly, or accessed via the official ATT&CK TAXII™ server. Trusted Automated Exchange of Intelligence Information (TAXII) is an application protocol for exchanging CTI over HTTPS. The ATT&CK TAXII server provides API access to the ATT&CK STIX knowledge base. Learn more about accessing the TAXII server <a href="https://github.com/mitre/cti/blob/master/USAGE.md#access-from-the-attck-taxii-server">here</a>. </p> </div> <div class="col text-center"> <div class="card mb-4 w-75 mx-auto"> <h4 class="card-header"> ATT&CK in STIX 2.1 </h4> <div class="card-body"> <h4 class="mb-4"><a href="https://github.com/mitre-attack/attack-stix-data">Visit the repository</a></h4> <h4 class="mb-0"><a href="https://github.com/mitre-attack/attack-stix-data/blob/master/USAGE.md">Read the docs</a></h4> </div> </div> <div class="card mb-4 w-75 mx-auto"> <h4 class="card-header"> ATT&CK in STIX 2.0 </h4> <div class="card-body"> <h4 class="mb-4"><a href="https://github.com/mitre/cti">Visit the repository</a></h4> <h4 class="mb-0"><a href="https://github.com/mitre/cti/blob/master/USAGE.md">Read the docs</a></h4> </div> </div> <h4 class="mb-4"><a href="https://oasis-open.github.io/cti-documentation/stix/intro">Learn about STIX</a></h4> <h4><a href="https://oasis-open.github.io/cti-documentation/taxii/intro.html">Learn about TAXII</a></h4> </div> </div> </div> </div>  <div class="decorative-panel container"> <div class="decorative-panel-header row align-items-center"> <div class="col py-4"> <h3>ATT&CK in Excel</h3> <p> Excel spreadsheets representing the ATT&CK dataset. These spreadsheets are built from the STIX dataset and provide a more human-accessible view into the knowledge base while also supporting rudimentary querying/filtering capabilities. </p> <button class="btn btn-default" id="excel-button" data-toggle="collapse" data-target="#excel-body" aria-expanded="false" aria-controls="excel-body">Learn more</button> </div> <div class="col order-first"> <img class="w-100" src="/versions/v13/theme/images/attack-in-excel.png"> </div> </div> <div class="decorative-panel-body collapse row align-items-center pt-4" id="excel-body" aria-labelledby="excel-button"> <div class="col"> <p>Consider using ATT&CK in Excel if you:</p> <ul> <li>Want to quickly sort, filter and query the dataset in a familiar UI.</li> <li>Want to explore the contents of the dataset without having to navigate around the ATT&CK website.</li> <li>Are not comfortable enough in Python or other programming languages to work with the STIX representation.</li> </ul> <p> The Excel representation of the ATT&CK dataset includes both master spreadsheets, containing all object types, and individual spreadsheets for each object type. The individual type spreadsheets break out relationships (e.g procedure examples connecting groups to techniques) into separate sheets by relationship type, while the master spreadsheet includes all relationship types in a single sheet. Otherwise the representation is identical. </p> <p> A citations sheet can be used to look up the in-text citations which appear in some fields. For domains that include multiple matrices, such as Mobile ATT&CK, each matrix gets its own named sheet. Unlike the STIX dataset, objects that have been <i>revoked</i> or <i>deprecated</i> are not included in the spreadsheets. </p> <p> The source code for the STIX to Excel converter can be found in our <a href="https://github.com/mitre-attack/mitreattack-python">mitreattack-python pip module</a>. </p> </div> <div class="col file-list"> <ul> <li> <a href="/versions/v13/docs/enterprise-attack-v13.1/enterprise-attack-v13.1.xlsx">enterprise-attack-v13.1.xlsx</a> <ul> <li> <a href="/versions/v13/docs/enterprise-attack-v13.1/enterprise-attack-v13.1-matrices.xlsx">enterprise-attack-v13.1-matrices.xlsx</a> </li> <li> <a href="/versions/v13/docs/enterprise-attack-v13.1/enterprise-attack-v13.1-mitigations.xlsx">enterprise-attack-v13.1-mitigations.xlsx</a> </li> <li> <a href="/versions/v13/docs/enterprise-attack-v13.1/enterprise-attack-v13.1-relationships.xlsx">enterprise-attack-v13.1-relationships.xlsx</a> </li> <li> <a href="/versions/v13/docs/enterprise-attack-v13.1/enterprise-attack-v13.1-software.xlsx">enterprise-attack-v13.1-software.xlsx</a> </li> <li> <a href="/versions/v13/docs/enterprise-attack-v13.1/enterprise-attack-v13.1-groups.xlsx">enterprise-attack-v13.1-groups.xlsx</a> </li> <li> <a href="/versions/v13/docs/enterprise-attack-v13.1/enterprise-attack-v13.1-tactics.xlsx">enterprise-attack-v13.1-tactics.xlsx</a> </li> <li> <a href="/versions/v13/docs/enterprise-attack-v13.1/enterprise-attack-v13.1-techniques.xlsx">enterprise-attack-v13.1-techniques.xlsx</a> </li> <li> <a href="/versions/v13/docs/enterprise-attack-v13.1/enterprise-attack-v13.1-datasources.xlsx">enterprise-attack-v13.1-datasources.xlsx</a> </li> <li> <a href="/versions/v13/docs/enterprise-attack-v13.1/enterprise-attack-v13.1-campaigns.xlsx">enterprise-attack-v13.1-campaigns.xlsx</a> </li> </ul> </li> <li> <a href="/versions/v13/docs/mobile-attack-v13.1/mobile-attack-v13.1.xlsx">mobile-attack-v13.1.xlsx</a> <ul> <li> <a href="/versions/v13/docs/mobile-attack-v13.1/mobile-attack-v13.1-matrices.xlsx">mobile-attack-v13.1-matrices.xlsx</a> </li> <li> <a href="/versions/v13/docs/mobile-attack-v13.1/mobile-attack-v13.1-mitigations.xlsx">mobile-attack-v13.1-mitigations.xlsx</a> </li> <li> <a href="/versions/v13/docs/mobile-attack-v13.1/mobile-attack-v13.1-relationships.xlsx">mobile-attack-v13.1-relationships.xlsx</a> </li> <li> <a href="/versions/v13/docs/mobile-attack-v13.1/mobile-attack-v13.1-software.xlsx">mobile-attack-v13.1-software.xlsx</a> </li> <li> <a href="/versions/v13/docs/mobile-attack-v13.1/mobile-attack-v13.1-groups.xlsx">mobile-attack-v13.1-groups.xlsx</a> </li> <li> <a href="/versions/v13/docs/mobile-attack-v13.1/mobile-attack-v13.1-tactics.xlsx">mobile-attack-v13.1-tactics.xlsx</a> </li> <li> <a href="/versions/v13/docs/mobile-attack-v13.1/mobile-attack-v13.1-techniques.xlsx">mobile-attack-v13.1-techniques.xlsx</a> </li> <li> <a href="/versions/v13/docs/mobile-attack-v13.1/mobile-attack-v13.1-campaigns.xlsx">mobile-attack-v13.1-campaigns.xlsx</a> </li> </ul> </li> <li> <a href="/versions/v13/docs/ics-attack-v13.1/ics-attack-v13.1.xlsx">ics-attack-v13.1.xlsx</a> <ul> <li> <a href="/versions/v13/docs/ics-attack-v13.1/ics-attack-v13.1-matrices.xlsx">ics-attack-v13.1-matrices.xlsx</a> </li> <li> <a href="/versions/v13/docs/ics-attack-v13.1/ics-attack-v13.1-mitigations.xlsx">ics-attack-v13.1-mitigations.xlsx</a> </li> <li> <a href="/versions/v13/docs/ics-attack-v13.1/ics-attack-v13.1-relationships.xlsx">ics-attack-v13.1-relationships.xlsx</a> </li> <li> <a href="/versions/v13/docs/ics-attack-v13.1/ics-attack-v13.1-software.xlsx">ics-attack-v13.1-software.xlsx</a> </li> <li> <a href="/versions/v13/docs/ics-attack-v13.1/ics-attack-v13.1-groups.xlsx">ics-attack-v13.1-groups.xlsx</a> </li> <li> <a href="/versions/v13/docs/ics-attack-v13.1/ics-attack-v13.1-tactics.xlsx">ics-attack-v13.1-tactics.xlsx</a> </li> <li> <a href="/versions/v13/docs/ics-attack-v13.1/ics-attack-v13.1-techniques.xlsx">ics-attack-v13.1-techniques.xlsx</a> </li> <li> <a href="/versions/v13/docs/ics-attack-v13.1/ics-attack-v13.1-datasources.xlsx">ics-attack-v13.1-datasources.xlsx</a> </li> <li> <a href="/versions/v13/docs/ics-attack-v13.1/ics-attack-v13.1-campaigns.xlsx">ics-attack-v13.1-campaigns.xlsx</a> </li> </ul> </li> </ul> </div> </div> </div> <h2>Tools for working with ATT&CK</h2>  <div class="decorative-panel container"> <div class="decorative-panel-header row align-items-center"> <div class="col py-4"> <h3>ATT&CK Navigator</h3> <p> The ATT&CK Navigator is a web-based tool for annotating and exploring ATT&CK matrices. It can be used to visualize defensive coverage, red/blue team planning, the frequency of detected techniques, and more. </p> <h4><a href="https://mitre-attack.github.io/attack-navigator/">Open the application</a></h4> <h4><a href="https://github.com/mitre-attack/attack-navigator/">Visit the repository</a></h4> </div> <div class="col text-right"> <img class="w-100" src="/versions/v13/theme/images/nav-example.png"> </div> </div> </div>  <div class="decorative-panel container"> <div class="decorative-panel-header row align-items-center"> <div class="col py-4"> <h3>ATT&CK Workbench</h3> <p> The ATT&CK Workbench is an application allowing users to explore, create, annotate, and share extensions of the ATT&CK knowledge base. </p> <h4><a href="https://github.com/center-for-threat-informed-defense/attack-workbench-frontend">Visit the repository</a></h4> </div> <div class="col order-first"> <img class="w-100" src="/versions/v13/theme/images/workbench-groups-list.png"> </div> </div> </div>  <div class="decorative-panel container"> <div class="decorative-panel-header row align-items-center"> <div class="col py-4"> <h3>ATT&CK Python Utilities</h3> <p> ATT&CK provides a variety of Python tools for accessing, querying, and processing the ATT&CK dataset. These scripts can be useful utilities or serve as examples for how to work with ATT&CK programmatically. </p> <h4><a href="https://github.com/mitre-attack/mitreattack-python">Install our pip module</a></h4> <h4><a href="https://github.com/mitre-attack/attack-scripts/">Explore our standalone scripts</a></h4> </div> <div class="col text-right"> <img class="w-100" src="/versions/v13/theme/images/attack-scripts.png"> </div> </div> </div> </div> </div> </div> </div>   <div class="overlay search" id="search-overlay" style="display: none;"> <div class="overlay-inner">  <div class="search-header"> <div class="search-input"> <input type="text" id="search-input" placeholder="search"> </div> <div class="search-icons"> <div class="search-parsing-icon spinner-border" style="display: none" id="search-parsing-icon"></div> <div class="close-search-icon" id="close-search-icon">×</div> </div> </div>  <div id="search-body" class="search-body"> <div class="results" id="search-results">  </div> <div id="load-more-results" class="load-more-results"> <button class="btn btn-default" id="load-more-results-button">load more results</button> </div> </div> </div> </div> </div> <div class="row flex-grow-0 flex-shrink-1">  <footer class="col footer p-3"> <div class="container-fluid"> <div class="row"> <div class="col-4 col-sm-4 col-md-3"> <div class="footer-center-responsive my-auto"> <a href="https://www.mitre.org" target="_blank" rel="noopener" aria-label="MITRE"> <img src="/versions/v13/theme/images/mitrelogowhiteontrans.gif" class="mitre-logo-wtrans"> </a> </div> </div> <div class="col-2 col-sm-2 footer-responsive-break"></div> <div class="col-6 col-sm-6 text-center"> <p> 漏 2015-2023, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. </p> <div class="row"> <div class="col text-right"> <small> <a href="/versions/v13/resources/privacy" class="footer-link">Privacy Policy</a> </small> </div> <div class="col text-center"> <small> <a href="/versions/v13/resources/terms-of-use" class="footer-link">Terms of Use</a> </small> </div> <div class="col text-left "> <small> <a href="/versions/v13/resources/changelog.html" class="footer-link" data-toggle="tooltip" data-placement="top" data-html="true" title="ATT&CK content v13.1Website v4.0.5">ATT&CK v13.1</a> </small> </div> </div> </div> <div class="w-100 p-2 footer-responsive-break"></div> <div class="col"> <div class="footer-float-right-responsive-brand"> <div class="mb-1"> <a href="https://twitter.com/MITREattack" class="btn btn-primary w-100">  <img src="/versions/v13/theme/images/twitter.png" class="mr-1 twitter-icon"> <b>@MITREattack</b> </a> </div> <div class=""> <a href="/versions/v13/contact" class="btn btn-primary w-100"> Contact </a> </div> </div> </div> </div> </div> </div> </footer> </div> </div>  </div>  <script src="/versions/v13/theme/scripts/jquery-3.5.1.min.js"></script> <script src="/versions/v13/theme/scripts/popper.min.js"></script> <script src="/versions/v13/theme/scripts/bootstrap-select.min.js"></script> <script src="/versions/v13/theme/scripts/bootstrap.bundle.min.js"></script> <script src="/versions/v13/theme/scripts/site.js?6815"></script> <script src="/versions/v13/theme/scripts/settings.js?1641"></script> <script src="/versions/v13/theme/scripts/search_bundle.js"></script> <script src="/versions/v13/theme/scripts/resizer.js"></script>  <script src="/versions/v13/theme/scripts/navigation.js"></script> </body> </html>

CINXE.COM

Working with ATT&CK | MITRE ATT&CK®