MITRE ATT&CK
Coverage. Verifiable. Public.
Most vendors publish a number. We publish the detector. Every covered technique on this page links to the open-source rule that catches it.
139
Production detectors
112 Sigma · 27 behavioural
69
MITRE techniques covered
of 223 in our SMB-priority matrix
30.9%
Coverage of priority matrix
Refreshed on every deploy from the source files
14
ATT&CK tactics tracked
Reconnaissance through Impact
Every detector here ships in the open-source ShieldMind agent. The coverage number is computed at deploy time from the actual detector source — there is no marketing layer between this page and the code that runs on customer laptops.
The full matrix.
Reconnaissance
TA00431/12 (8.3%)
T1589+3 sub
Gather Victim Identity Information
T1590+6 sub
Gather Victim Network Information
T1591+4 sub
Gather Victim Org Information
T1592+4 sub
Gather Victim Host Information
T1593+3 sub
Search Open Websites/Domains
T1594
Search Victim-Owned Websites
T1596+5 sub
Search Open Technical Databases
T1597+2 sub
Search Closed Sources
T1598+4 sub
Phishing for Information
T1681
Search Threat Vendor Data
T1682
Query Public AI Services
Resource Development
TA00421/9 (11.1%)
T1583+8 sub
Acquire Infrastructure
T1584+8 sub
Compromise Infrastructure
T1585+3 sub
Establish Accounts
T1586+3 sub
Compromise Accounts
T1587+4 sub
Develop Capabilities
T1608+6 sub
Stage Capabilities
T1650
Acquire Access
T1683+2 sub
Generate Content
Initial Access
TA00014/11 (36.4%)
T1091
Replication Through Removable Media
T1189
Drive-by Compromise
T1195+3 sub
Supply Chain Compromise
T1199
Trusted Relationship
T1200
Hardware Additions
T1659
Content Injection
T1669
Wi-Fi Networks
Execution
TA000214/55 (25.5%)
T1006
Direct Volume Access
T1059+13 sub
Command and Scripting Interpreter
exec.parent_child_anomaly · pythonexec.process_tree_depth · pythonsigma.sm-exec-005-python-revshell · sigmalolbin.download_exec · pythonsigma.sm-exec-003-cmd-caret-obfuscation · sigmasigma.sm-004-osascript-remote · sigmasigma.sm-exec-004-bash-reverse-shell · sigmasigma.sm-lin-010-curl-pipe-sh · sigmasigma.sm-003-curl-pipe-sh · sigmasigma.sm-exec-010-pwsh-encoded · sigmasigma.sm-exec-001-pwsh-iex-download · sigmasigma.sm-exec-002-pwsh-iwr-external · sigmasigma.sm-exec-018-winrm-session · sigmasigma.sm-001-pwsh-enc · sigma
T1070+8 sub
Indicator Removal
T1072
Software Deployment Tools
T1129
Shared Modules
T1202
Indirect Command Execution
T1203
Exploitation for Client Execution
T1207
Rogue Domain Controller
T1211
Exploitation for Stealth
T1216+2 sub
System Script Proxy Execution
T1218+14 sub
System Binary Proxy Execution
T1220
XSL Script Processing
T1221
Template Injection
T1222+2 sub
File and Directory Permissions Modification
T1480+2 sub
Execution Guardrails
T1535
Unused/Unsupported Cloud Regions
T1553+6 sub
Subvert Trust Controls
T1559+3 sub
Inter-Process Communication
T1569+3 sub
System Services
T1574+12 sub
Hijack Execution Flow
T1578+5 sub
Modify Cloud Compute Infrastructure
T1599+1 sub
Network Boundary Bridging
T1600+2 sub
Weaken Encryption
T1601+2 sub
Modify System Image
T1609
Container Administration Command
T1610
Deploy Container
T1612
Build Image on Host
T1620
Reflective Code Loading
T1647
Plist File Modification
T1648
Serverless Execution
T1651
Cloud Administration Command
T1666
Modify Cloud Resource Hierarchy
T1674
Input Injection
T1675
ESXi Administration Command
T1677
Poisoned Pipeline Execution
T1678
Delay Execution
T1679
Selective Exclusion
T1684+2 sub
Social Engineering
T1685+6 sub
Disable or Modify Tools
T1686+3 sub
Disable or Modify System Firewall
T1687
Exploitation for Defense Impairment
T1688
Safe Mode Boot
T1689
Downgrade Attack
T1690
Prevent Command History Logging
Persistence
TA000311/22 (50%)
T1037+5 sub
Boot or Logon Initialization Scripts
T1098+7 sub
Account Manipulation
T1137+6 sub
Office Application Startup
T1205+2 sub
Traffic Signaling
T1505+6 sub
Server Software Component
T1525
Implant Internal Image
T1542+5 sub
Pre-OS Boot
T1546+18 sub
Event Triggered Execution
T1554
Compromise Host Software Binary
T1556+9 sub
Modify Authentication Process
T1653
Power Settings
T1668
Exclusive Control
T1671
Cloud Application Integration
Privilege Escalation
TA000411/13 (84.6%)
T1037+5 sub
Boot or Logon Initialization Scripts
T1098+7 sub
Account Manipulation
T1484+2 sub
Domain or Tenant Policy Modification
T1546+18 sub
Event Triggered Execution
T1548+6 sub
Abuse Elevation Control Mechanism
Defense Evasion
TA00051/1 (100%)
Credential Access
TA00068/17 (47.1%)
T1040
Network Sniffing
T1111
Multi-Factor Authentication Interception
T1187
Forced Authentication
T1212
Exploitation for Credential Access
T1539
Steal Web Session Cookie
T1556+9 sub
Modify Authentication Process
T1557+4 sub
Adversary-in-the-Middle
T1558+5 sub
Steal or Forge Kerberos Tickets
T1606+2 sub
Forge Web Credentials
T1649
Steal or Forge Authentication Certificates
Discovery
TA00078/34 (23.5%)
T1007
System Service Discovery
T1010
Application Window Discovery
T1012
Query Registry
T1016+2 sub
System Network Configuration Discovery
T1033
System Owner/User Discovery
T1040
Network Sniffing
T1046
Network Service Discovery
T1049
System Network Connections Discovery
T1082
System Information Discovery
T1120
Peripheral Device Discovery
T1124
System Time Discovery
T1201
Password Policy Discovery
T1217
Browser Information Discovery
T1482
Domain Trust Discovery
T1497+3 sub
Virtualization/Sandbox Evasion
T1518+2 sub
Software Discovery
T1526
Cloud Service Discovery
T1538
Cloud Service Dashboard
T1580
Cloud Infrastructure Discovery
T1613
Container and Resource Discovery
T1614+1 sub
System Location Discovery
T1615
Group Policy Discovery
T1619
Cloud Storage Object Discovery
T1622
Debugger Evasion
T1652
Device Driver Discovery
T1654
Log Enumeration
T1673
Virtual Machine Discovery
T1680
Local Storage Discovery
Lateral Movement
TA00082/9 (22.2%)
T1021+8 sub
Remote Services
lateral.first_seen · pythonlat.smb_admin_share_write · pythonsigma.sm-exec-019-schtasks-remote · sigmasigma.sm-exec-017-wmic-remote · sigmasigma.sm-lat-010-psexec · sigmasigma.sm-lat-002-smb-admin-share · sigmasigma.sm-exec-018-winrm-session · sigmasigma.sm-lat-001-rdp-explicit · sigmasigma.sm-lat-011-rdp-burst · sigmasigma.sm-exec-007-wmic-pcc · sigmasigma.sm-lat-003-wmi-remote-exec · sigma
T1072
Software Deployment Tools
T1080
Taint Shared Content
T1091
Replication Through Removable Media
T1210
Exploitation of Remote Services
T1534
Internal Spearphishing
T1550+4 sub
Use Alternate Authentication Material
T1563+2 sub
Remote Service Session Hijacking
Collection
TA00094/17 (23.5%)
T1025
Data from Removable Media
T1039
Data from Network Shared Drive
T1074+2 sub
Data Staged
T1114+3 sub
Email Collection
T1115
Clipboard Data
T1119
Automated Collection
T1123
Audio Capture
T1125
Video Capture
T1185
Browser Session Hijacking
T1213+6 sub
Data from Information Repositories
T1530
Data from Cloud Storage
T1557+4 sub
Adversary-in-the-Middle
T1602+2 sub
Data from Configuration Repository
Command and Control
TA00117/18 (38.9%)
T1001+3 sub
Data Obfuscation
T1008
Fallback Channels
T1092
Communication Through Removable Media
T1095
Non-Application Layer Protocol
T1104
Multi-Stage Channels
T1132+2 sub
Data Encoding
T1205+2 sub
Traffic Signaling
T1219+3 sub
Remote Access Tools
T1571
Non-Standard Port
T1659
Content Injection
T1665
Hide Infrastructure
Exfiltration
TA00103/9 (33.3%)
T1011+1 sub
Exfiltration Over Other Network Medium
T1020+1 sub
Automated Exfiltration
T1029
Scheduled Transfer
T1030
Data Transfer Size Limits
T1041
Exfiltration over C2 Channel
T1048+3 sub
Exfiltration over Alternative Protocol
T1052+1 sub
Exfiltration Over Physical Medium
T1537
Transfer Data to Cloud Account
T1567+4 sub
Exfiltration over Web Service
Impact
TA00405/15 (33.3%)
T1490
Inhibit System Recovery
T1495
Firmware Corruption
T1496+4 sub
Resource Hijacking
T1498+2 sub
Network Denial of Service
T1499+4 sub
Endpoint Denial of Service
T1529
System Shutdown/Reboot
T1531
Account Access Removal
T1561+2 sub
Disk Wipe
T1565+3 sub
Data Manipulation
T1657
Financial Theft
T1667
Email Bombing
How this number is computed.
No marketing layer. The number on this page is generated at deploy time by walking the detector source files in the open-source agent and matching themitre_techniques field on each one against the published MITRE ATT&CK Enterprise matrix. There is no human editing the number before it ships.
Audit-able. Click any covered technique above and the link takes you to the YAML or Python source on GitHub. Read the rule. Test it against your own telemetry. We invite the audit.
Priority over breadth. Our matrix tracks the SMB-priority subset of MITRE ATT&CK — the techniques the CrowdStrikes and SentinelOnes detect, the ones CISOs ask about in evaluations — not every entry in the full corpus. Most enterprise EDRs claim 10,000+ signatures; most of those are duplicates or for nation-state TTPs that don't target an SMB. We optimised for the techniques that actually matter.
False-positive baselines. Every Sigma rule we ship includes a falsepositives block and an FP-rate baseline. Pull requests that regress the baseline by more than 2% don't merge.
When this updates. Every deploy. The "last updated" timestamp lives in the page footer; the backend serves a 5-minute-cached payload to keep this page fast.