MITRE ATT&CK techniques observed in real malware
MITRE ATT&CK coverage across 100953 publicly analyzed samples on MalwareAnalyzer by Cyble: 34 distinct techniques observed in real malware.
Techniques by prevalence
- T1566.002 Spearphishing Link - 40995 samples
- T1105 Ingress Tool Transfer - 9562 samples
- T1112 Modify Registry - 7673 samples
- T1543.003 Windows Service - 2865 samples
- T1071.001 Web Protocols - 2083 samples
- T1547.001 Registry Run Keys / Startup Folder - 1522 samples
- T1057 Process Discovery - 1325 samples
- T1056.001 Keylogging - 1277 samples
- T1055 Process Injection - 502 samples
- T1059.001 PowerShell - 348 samples
- T1555 Credentials from Password Stores - 270 samples
- T1003 OS Credential Dumping - 269 samples
- T1059.004 Unix Shell - 222 samples
- T1486 Data Encrypted for Impact - 157 samples
- T1518.001 Security Software Discovery - 154 samples
- T1571 Non-Standard Port - 140 samples
- T1497 Virtualization/Sandbox Evasion - 50 samples
- T1562.001 - 47 samples
- T1003.001 LSASS Memory - 46 samples
- T1053.005 Scheduled Task - 21 samples
- T1071.004 DNS - 21 samples
- T1218.005 Mshta - 17 samples
- T1016 System Network Configuration Discovery - 11 samples
- T1033 System Owner/User Discovery - 11 samples
- T1082 System Information Discovery - 11 samples
- T1555.003 Credentials from Web Browsers - 9 samples
- T1562.004 - 8 samples
- T1027 Obfuscated Files or Information - 4 samples
- T1218.011 Rundll32 - 2 samples
- T1047 Windows Management Instrumentation - 1 sample
- T1053.003 Cron - 1 sample
- T1070 Indicator Removal - 1 sample
- T1489 Service Stop - 1 sample
- T1496 Resource Hijacking - 1 sample