MITRE ATT&CK Technique Lookup
Search the MITRE ATT&CK Enterprise techniques by ID, name or keyword, and filter by tactic.
Runs in your browser Your input never leaves your device.
Report a problem with this tool
About this tool
Type a technique ID (T1059 or T1059.001), a name (PowerShell), or a keyword (credential dumping), and the tool lists matching techniques with their tactics, the platforms they apply to, a shortened description and a link to the full page at attack.mitre.org. Choose a tactic, such as Persistence or Lateral Movement, to browse all the techniques in it, and tick Parent techniques only to hide sub-techniques. The data is built into the page from the MITRE ATT&CK Enterprise knowledge base, version 19.2: 697 techniques and sub-techniques that are not revoked or deprecated, so nothing is fetched while you search. Descriptions are shortened to the first sentences: read the MITRE page for the full text, detection advice and mitigations. © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. This site is not affiliated with MITRE. Everything is processed in your browser and nothing is uploaded.
How to use it
- Type an ID, a name or a keyword.
- Or choose a tactic to list its techniques.
- Open the link of a technique for the full description and mitigations.
Common problems
- A technique I know is missing
- Revoked and deprecated techniques are left out, and the data is a snapshot of one ATT&CK version. Search for the new name or ID.
- Search finds too much
- Use a more specific word, search by ID, or choose a tactic and tick Parent techniques only.
- I need mobile or ICS techniques
- Only the Enterprise matrix is included. Use attack.mitre.org for Mobile and ICS.