MITRE ATT&CK techniques observed in real malware
MITRE ATT&CK coverage across 114781 publicly analyzed samples on MalwareAnalyzer by Cyble: 34 distinct techniques observed in real malware.
Techniques by prevalence
- T1566.002 Spearphishing Link - 41359 samples
- T1105 Ingress Tool Transfer - 12637 samples
- T1112 Modify Registry - 8318 samples
- T1543.003 Windows Service - 3629 samples
- T1071.001 Web Protocols - 2313 samples
- T1547.001 Registry Run Keys / Startup Folder - 1844 samples
- T1057 Process Discovery - 1529 samples
- T1056.001 Keylogging - 1473 samples
- T1055 Process Injection - 583 samples
- T1059.001 PowerShell - 413 samples
- T1555 Credentials from Password Stores - 322 samples
- T1003 OS Credential Dumping - 317 samples
- T1518.001 Security Software Discovery - 252 samples
- T1059.004 Unix Shell - 222 samples
- T1486 Data Encrypted for Impact - 185 samples
- T1571 Non-Standard Port - 155 samples
- T1003.001 LSASS Memory - 60 samples
- T1497 Virtualization/Sandbox Evasion - 57 samples
- T1562.001 - 52 samples
- T1053.005 Scheduled Task - 30 samples
- T1218.005 Mshta - 22 samples
- T1071.004 DNS - 21 samples
- T1555.003 Credentials from Web Browsers - 18 samples
- T1016 System Network Configuration Discovery - 16 samples
- T1033 System Owner/User Discovery - 16 samples
- T1082 System Information Discovery - 16 samples
- T1562.004 - 10 samples
- T1027 Obfuscated Files or Information - 5 samples
- T1218.011 Rundll32 - 4 samples
- T1070 Indicator Removal - 2 samples
- T1489 Service Stop - 2 samples
- T1047 Windows Management Instrumentation - 1 sample
- T1053.003 Cron - 1 sample
- T1496 Resource Hijacking - 1 sample