MITRE ATT&CK

Work with MITRE ATT&CK, the standard catalogue of how adversaries actually behave: browse and search the Enterprise, Mobile and ICS matrices by tactic, platform or free text, read any technique, group, campaign, piece of malware or mitigation in full, and follow the links between them: which groups use a technique, what mitigates it, what a group deploys and what it has been seen doing. Check what a release changed, read the raw STIX behind any entry, and export a filtered technique list as CSV. Read straight from MITRE's own TAXII server, with no account or API key required.

Actions

Action	What it does
Export techniques as CSV	Write a filtered technique list out as CSV: the same filters as the browse action, rendered as a spreadsheet a workflow can attach to an email, upload to a drive, or hand to a coverage review.
Get a campaign	Read one campaign: what happened, when it ran, and every name it is reported under.
Get a group	Read one adversary group: who MITRE says they are, every name they are tracked under, and the reporting behind it.
Get a mitigation	Read one mitigation and, with related objects included, every technique it defends against, which is how a control you already run turns into a list of the adversary behaviour it covers.
Get a tactic	Read one tactic and every technique filed under it: the whole column of the matrix in one step.
Get a technique	Read one technique in full: what the behaviour is, which tactics it serves, which platforms it applies to, its parent and sub-techniques, and MITRE's sources.
Get domain details	Read which ATT&CK release a domain is currently on, when it was published, and how much it holds: the number of techniques, tactics, groups, software entries, campaigns, mitigations, data sources and detection strategies.
Get raw STIX object	Read one entry exactly as MITRE publishes it (the whole STIX 2.1 object, untouched) beside the date the collection took it in and every version it holds.
Get software	Read one piece of malware or tooling: what it is, which platforms it runs on, and every name it is tracked under.
List ATT&CK domains	List the three ATT&CK knowledge bases MITRE publishes (Enterprise, Mobile and ICS) with what each covers and whether the server is serving it.
List campaigns	List the intrusion campaigns ATT&CK tracks in a domain (named sets of activity such as Operation Ghost or SolarWinds Compromise) with when each was first and last reported active.
List data components	List the telemetry ATT&CK expects detections to be built on: the events a detection consumes (Process Creation, Network Connection Creation, Logon Session Metadata) each with the concrete logs it can be read from, down to the channel ('WinEventLog:Security' / 'EventCode=4688').
List groups	List the adversary groups ATT&CK tracks in a domain, each with every name it is known by: the vendor aliases such as Cozy Bear or Midnight Blizzard that a report is far more likely to use than G0016.
List mitigations	List the mitigations ATT&CK recommends in a domain: the defensive measures (multi-factor authentication, application control, network segmentation) that its techniques are mapped to.
List recent changes	List what a domain gained or revised after a date and time: the new techniques, newly tracked groups and revised entries of the last release.
List related objects	Walk the relationships around any ATT&CK entry, in both directions, grouped by how they are linked.
List software	List the malware and tools ATT&CK tracks in a domain.
List tactics	List a domain's tactics (the adversary goals that make up the columns of the ATT&CK matrix, from Reconnaissance through to Impact) in the matrix's own left-to-right order, with how many techniques sit under each.
List techniques	Browse a domain's techniques through every filter ATT&CK supports: tactic, platform, whether to include sub-techniques, and free text over IDs, names and descriptions.
Search ATT&CK	Search a whole domain for a word, name, alias or ATT&CK ID and get the best matches first, across techniques, groups, software, campaigns, mitigations, data sources and detection strategies at once.

Export techniques as CSV

Write a filtered technique list out as CSV: the same filters as the browse action, rendered as a spreadsheet a workflow can attach to an email, upload to a drive, or hand to a coverage review. One row per technique with its ATT&CK ID, name, tactics, platforms, parent and description. No API key required.

Inputs

ATT&CK domaindomaintext: Which of the three ATT&CK knowledge bases to read. Enterprise covers IT, cloud, SaaS and network devices; Mobile covers Android and iOS; ICS covers industrial control systems. They are separate matrices with their own techniques and IDs, so a technique in one is not in the others.One of: enterprise (Enterprise (IT, cloud, SaaS, network)), mobile (Mobile (Android and iOS)), ics (ICS (industrial control systems)). Default: enterprise.
Tactictactictext: Only techniques filed under this tactic (the adversary goal, such as Credential Access). The list is read from the chosen domain's own matrix, in its left-to-right order, with the number of techniques beside each one. Leave it unset for every tactic.
Platformsplatformslist: Only entries that apply to at least one of these platforms, such as Windows or Containers. The list is read from the chosen domain, so it offers what that matrix actually names. Leave every option unchecked to include them all.
Technique leveltechnique_typetext: Whether to include both levels of the technique tree, only the top-level techniques (T1059), or only the sub-techniques that refine them (T1059.001).One of: all (All techniques), parent (Top-level techniques only), sub (Sub-techniques only). Default: all.
Text containsquerytext: Only entries whose ATT&CK ID, name, alias or description contain this text. Not case sensitive. Leave it empty for all of them.
Include retired entriesinclude_inactivetrue/false: ATT&CK never deletes: a technique that has been superseded stays in the matrix marked revoked, and one that no longer describes anything real stays marked deprecated. Both are left out unless this is turned on, which is what you want when auditing coverage of older content.Default: false.
Order bysorttext: How to order the results. ATT&CK ID order is the numeric one a reader expects, so T1002 comes before T1059 and each sub-technique sits directly under its parent.One of: attack_id_asc (ATT&CK ID (lowest first)), attack_id_desc (ATT&CK ID (highest first)), name_asc (Name (A to Z)), name_desc (Name (Z to A)), modified_desc (Last updated (newest first)), created_desc (Added to ATT&CK (newest first)). Default: attack_id_asc.
Maximum rowslimitnumber: How many techniques to write. The answer says how many matched in all, so a capped export is never mistaken for a complete one.From 1 to 2000. Default: 500.

Outputs

attack_versiontext: The ATT&CK release the answer was read from, for example '19.2'. Two identical questions asked either side of a release can differ, so every answer says which one it read.
columnslist: The column names, in the order written.
countnumber: How many entries this answer carries.
csvtext: The CSV text, with a header row.
domaintext: The ATT&CK domain that was read: enterprise, mobile or ics.
domain_titletext: That domain's full name, for example 'Enterprise ATT&CK'.
filenametext: A suggested file name for the export.
sorttext: The order the entries were returned in.
total_countnumber: How many entries matched in all, before any cap was applied.
truncatedtrue/false: True when more entries matched than were returned.

Example output

{
  "attack_version": "19.2",
  "columns": [
    "attack_id",
    "name",
    "tactics",
    "platforms",
    "is_subtechnique",
    "parent_technique_id",
    "version",
    "created",
    "modified",
    "url",
    "description"
  ],
  "count": 1,
  "csv": "attack_id,name,tactics,platforms,is_subtechnique,parent_technique_id,version,created,modified,url,description\nT1059.001,PowerShell,Execution,Windows,true,T1059,1.6,2020-03-09T14:35:22.156Z,2026-05-12T15:12:00.625Z,https://attack.mitre.org/techniques/T1059/001,Adversaries may abuse PowerShell commands and scripts for execution.\n",
  "domain": "enterprise",
  "domain_title": "Enterprise ATT&CK",
  "filename": "mitre-attack-enterprise-techniques.csv",
  "sort": "attack_id_asc",
  "total_count": 64,
  "truncated": true
}

Get a campaign

Read one campaign: what happened, when it ran, and every name it is reported under. With related objects included it also returns the group it is attributed to and the techniques and software it used. No API key required.

Inputs

ATT&CK domaindomaintext: Which of the three ATT&CK knowledge bases to read. Enterprise covers IT, cloud, SaaS and network devices; Mobile covers Android and iOS; ICS covers industrial control systems. They are separate matrices with their own techniques and IDs, so a technique in one is not in the others.One of: enterprise (Enterprise (IT, cloud, SaaS, network)), mobile (Mobile (Android and iOS)), ics (ICS (industrial control systems)). Default: enterprise.
CampaigncampaigntextRequired: The campaign to read, chosen from the domain's own list. A value carried over from an earlier step may instead be an ATT&CK ID (C0015), a STIX id, or the campaign's exact name.
Include related ATT&CK objectsinclude_relatedtrue/false: Also return what ATT&CK links to this entry: the techniques a group or piece of software uses, the mitigations and detection strategies covering a technique, the campaigns attributed to a group. This is usually the point of looking something up, so it is on by default. Turning it off makes the step a fast metadata read; the links live in the domain's relationship set, which the first step to need it downloads in full (about half a minute for Enterprise) and every later step in the same run reuses.Default: true.
Maximum related objectsrelated_limitnumber: How many related objects to return. A widely used technique can be linked to hundreds; the answer always carries the true total beside the ones it returns.From 1 to 1000. Default: 50.

Outputs

aliaseslist: The other names the entry is tracked under (for a group, the vendor names such as 'Cozy Bear'). Empty for kinds without them.
attack_idtext: The ATT&CK identifier, for example 'T1059.001' for a sub-technique or 'G0016' for a group.
attack_versiontext: The ATT&CK release the answer was read from, for example '19.2'. Two identical questions asked either side of a release can differ, so every answer says which one it read.
contributorslist: The people and organizations MITRE credits for the entry.
createdtext: When MITRE first published the entry, as an ISO 8601 instant.
deprecatedtrue/false: True when MITRE has retired the entry without replacing it.
descriptiontext: MITRE's description, with its inline '(Citation: ...)' markers removed; the citations themselves are under 'references'.
domaintext: The ATT&CK domain that was read: enterprise, mobile or ics.
domain_titletext: That domain's full name, for example 'Enterprise ATT&CK'.
domainslist: The ATT&CK domains the entry appears in.
first_seentext: When the campaign's activity is first reported to have begun.
kindtext: What sort of ATT&CK object this is: technique, tactic, group, software, campaign, mitigation, data_source, data_component, detection_strategy or asset.
last_seentext: When it was last reported active.
modifiedtext: When MITRE last revised it, as an ISO 8601 instant.
nametext: MITRE's name for the entry.
platformslist: The platforms it applies to, such as Windows or Containers. Empty for kinds that are not platform-specific.
referenceslist: The sources MITRE cites, each with its title and link.
relatedobject: What ATT&CK links to this entry, or null when 'Include related ATT&CK objects' was turned off.
related_countsobject: How many related objects of each kind were returned, so a step can branch without walking the groups.
related_includedtrue/false: Whether the relationship walk ran, so an empty 'related' can be told from one that was never looked up.
revokedtrue/false: True when the entry has been superseded by another one.
stix_idtext: The STIX identifier, which is what relationships and the raw object read are keyed by.
stix_typetext: The STIX type underneath, for example 'attack-pattern' for a technique or 'intrusion-set' for a group.
urltext: This entry's page on attack.mitre.org.
versiontext: The entry's own version, which MITRE bumps when it revises it.

Example output

{
  "aliases": [
    "Operation Ghost"
  ],
  "attack_id": "C0005",
  "attack_version": "19.2",
  "contributors": [],
  "created": "2023-03-23T17:51:58.539Z",
  "deprecated": false,
  "description": "Operation Ghost was an APT29 campaign that ran from 2013 through 2019.",
  "domain": "enterprise",
  "domain_title": "Enterprise ATT&CK",
  "domains": [
    "enterprise-attack"
  ],
  "first_seen": "2013-09-01T04:00:00.000Z",
  "kind": "campaign",
  "last_seen": "2019-10-01T04:00:00.000Z",
  "modified": "2026-07-31T18:47:24.650Z",
  "name": "Operation Ghost",
  "platforms": [],
  "references": [],
  "related": {
    "count": 2,
    "groups": [
      {
        "count": 1,
        "kind": "mitigation",
        "objects": [
          {
            "attack_id": "M1042",
            "deprecated": false,
            "direction": "incoming",
            "kind": "mitigation",
            "name": "Disable or Remove Feature or Program",
            "relationship_type": "mitigates",
            "revoked": false,
            "stix_id": "course-of-action--e8242a33-26be-4d5a-93be-1c1de9d3c1a2",
            "url": "https://attack.mitre.org/mitigations/M1042"
          }
        ],
        "relationship_type": "mitigates",
        "total_count": 5
      },
      {
        "count": 1,
        "kind": "group",
        "objects": [
          {
            "attack_id": "G0016",
            "deprecated": false,
            "direction": "incoming",
            "kind": "group",
            "name": "APT29",
            "procedure_example": "APT29 has used PowerShell to execute commands and payloads on compromised hosts.",
            "relationship_type": "uses",
            "revoked": false,
            "stix_id": "intrusion-set--899ce53f-13a0-479b-a0e4-67d46e241542",
            "url": "https://attack.mitre.org/groups/G0016"
          }
        ],
        "relationship_type": "uses",
        "total_count": 25
      }
    ],
    "total_count": 214,
    "truncated": true
  },
  "related_counts": {
    "group": 1,
    "mitigation": 1
  },
  "related_included": true,
  "revoked": false,
  "stix_id": "campaign--7854c1a0-f06c-4876-98a4-4bbd34751b05",
  "stix_type": "campaign",
  "url": "https://attack.mitre.org/campaigns/C0005",
  "version": "1.2"
}

Get a group

Read one adversary group: who MITRE says they are, every name they are tracked under, and the reporting behind it. With related objects included it also returns the techniques they use (each with MITRE's procedure example describing how they used it), the malware and tools they deploy, and the campaigns attributed to them. This is the action behind 'what does APT29 actually do'. No API key required.

Inputs

ATT&CK domaindomaintext: Which of the three ATT&CK knowledge bases to read. Enterprise covers IT, cloud, SaaS and network devices; Mobile covers Android and iOS; ICS covers industrial control systems. They are separate matrices with their own techniques and IDs, so a technique in one is not in the others.One of: enterprise (Enterprise (IT, cloud, SaaS, network)), mobile (Mobile (Android and iOS)), ics (ICS (industrial control systems)). Default: enterprise.
GroupgrouptextRequired: The adversary group to read, chosen from the domain's own list. A value carried over from an earlier step may instead be an ATT&CK ID (G0016), a STIX id, or any name the group is tracked under, such as APT29 or Cozy Bear.
Include related ATT&CK objectsinclude_relatedtrue/false: Also return what ATT&CK links to this entry: the techniques a group or piece of software uses, the mitigations and detection strategies covering a technique, the campaigns attributed to a group. This is usually the point of looking something up, so it is on by default. Turning it off makes the step a fast metadata read; the links live in the domain's relationship set, which the first step to need it downloads in full (about half a minute for Enterprise) and every later step in the same run reuses.Default: true.
Maximum related objectsrelated_limitnumber: How many related objects to return. A widely used technique can be linked to hundreds; the answer always carries the true total beside the ones it returns.From 1 to 1000. Default: 50.

Outputs

aliaseslist: The other names the entry is tracked under (for a group, the vendor names such as 'Cozy Bear'). Empty for kinds without them.
attack_idtext: The ATT&CK identifier, for example 'T1059.001' for a sub-technique or 'G0016' for a group.
attack_versiontext: The ATT&CK release the answer was read from, for example '19.2'. Two identical questions asked either side of a release can differ, so every answer says which one it read.
contributorslist: The people and organizations MITRE credits for the entry.
createdtext: When MITRE first published the entry, as an ISO 8601 instant.
deprecatedtrue/false: True when MITRE has retired the entry without replacing it.
descriptiontext: MITRE's description, with its inline '(Citation: ...)' markers removed; the citations themselves are under 'references'.
domaintext: The ATT&CK domain that was read: enterprise, mobile or ics.
domain_titletext: That domain's full name, for example 'Enterprise ATT&CK'.
domainslist: The ATT&CK domains the entry appears in.
kindtext: What sort of ATT&CK object this is: technique, tactic, group, software, campaign, mitigation, data_source, data_component, detection_strategy or asset.
modifiedtext: When MITRE last revised it, as an ISO 8601 instant.
nametext: MITRE's name for the entry.
platformslist: The platforms it applies to, such as Windows or Containers. Empty for kinds that are not platform-specific.
referenceslist: The sources MITRE cites, each with its title and link.
relatedobject: What ATT&CK links to this entry, or null when 'Include related ATT&CK objects' was turned off.
related_countsobject: How many related objects of each kind were returned, so a step can branch without walking the groups.
related_includedtrue/false: Whether the relationship walk ran, so an empty 'related' can be told from one that was never looked up.
revokedtrue/false: True when the entry has been superseded by another one.
stix_idtext: The STIX identifier, which is what relationships and the raw object read are keyed by.
stix_typetext: The STIX type underneath, for example 'attack-pattern' for a technique or 'intrusion-set' for a group.
urltext: This entry's page on attack.mitre.org.
versiontext: The entry's own version, which MITRE bumps when it revises it.

Example output

{
  "aliases": [
    "APT29",
    "Cozy Bear",
    "Midnight Blizzard",
    "NOBELIUM"
  ],
  "attack_id": "G0016",
  "attack_version": "19.2",
  "contributors": [],
  "created": "2017-05-31T21:31:52.748Z",
  "deprecated": false,
  "description": "APT29 is a threat group attributed to Russia's Foreign Intelligence Service.",
  "domain": "enterprise",
  "domain_title": "Enterprise ATT&CK",
  "domains": [
    "enterprise-attack"
  ],
  "kind": "group",
  "modified": "2026-07-31T18:47:44.949Z",
  "name": "APT29",
  "platforms": [],
  "references": [],
  "related": {
    "count": 2,
    "groups": [
      {
        "count": 1,
        "kind": "mitigation",
        "objects": [
          {
            "attack_id": "M1042",
            "deprecated": false,
            "direction": "incoming",
            "kind": "mitigation",
            "name": "Disable or Remove Feature or Program",
            "relationship_type": "mitigates",
            "revoked": false,
            "stix_id": "course-of-action--e8242a33-26be-4d5a-93be-1c1de9d3c1a2",
            "url": "https://attack.mitre.org/mitigations/M1042"
          }
        ],
        "relationship_type": "mitigates",
        "total_count": 5
      },
      {
        "count": 1,
        "kind": "group",
        "objects": [
          {
            "attack_id": "G0016",
            "deprecated": false,
            "direction": "incoming",
            "kind": "group",
            "name": "APT29",
            "procedure_example": "APT29 has used PowerShell to execute commands and payloads on compromised hosts.",
            "relationship_type": "uses",
            "revoked": false,
            "stix_id": "intrusion-set--899ce53f-13a0-479b-a0e4-67d46e241542",
            "url": "https://attack.mitre.org/groups/G0016"
          }
        ],
        "relationship_type": "uses",
        "total_count": 25
      }
    ],
    "total_count": 214,
    "truncated": true
  },
  "related_counts": {
    "group": 1,
    "mitigation": 1
  },
  "related_included": true,
  "revoked": false,
  "stix_id": "intrusion-set--899ce53f-13a0-479b-a0e4-67d46e241542",
  "stix_type": "intrusion-set",
  "url": "https://attack.mitre.org/groups/G0016",
  "version": "6.2"
}

Get a mitigation

Read one mitigation and, with related objects included, every technique it defends against, which is how a control you already run turns into a list of the adversary behaviour it covers. No API key required.

Inputs

ATT&CK domaindomaintext: Which of the three ATT&CK knowledge bases to read. Enterprise covers IT, cloud, SaaS and network devices; Mobile covers Android and iOS; ICS covers industrial control systems. They are separate matrices with their own techniques and IDs, so a technique in one is not in the others.One of: enterprise (Enterprise (IT, cloud, SaaS, network)), mobile (Mobile (Android and iOS)), ics (ICS (industrial control systems)). Default: enterprise.
MitigationmitigationtextRequired: The mitigation to read, chosen from the domain's own list. A value carried over from an earlier step may instead be an ATT&CK ID (M1049), a STIX id, or the mitigation's exact name.
Include related ATT&CK objectsinclude_relatedtrue/false: Also return what ATT&CK links to this entry: the techniques a group or piece of software uses, the mitigations and detection strategies covering a technique, the campaigns attributed to a group. This is usually the point of looking something up, so it is on by default. Turning it off makes the step a fast metadata read; the links live in the domain's relationship set, which the first step to need it downloads in full (about half a minute for Enterprise) and every later step in the same run reuses.Default: true.
Maximum related objectsrelated_limitnumber: How many related objects to return. A widely used technique can be linked to hundreds; the answer always carries the true total beside the ones it returns.From 1 to 1000. Default: 50.

Outputs

aliaseslist: The other names the entry is tracked under (for a group, the vendor names such as 'Cozy Bear'). Empty for kinds without them.
attack_idtext: The ATT&CK identifier, for example 'T1059.001' for a sub-technique or 'G0016' for a group.
attack_versiontext: The ATT&CK release the answer was read from, for example '19.2'. Two identical questions asked either side of a release can differ, so every answer says which one it read.
contributorslist: The people and organizations MITRE credits for the entry.
createdtext: When MITRE first published the entry, as an ISO 8601 instant.
deprecatedtrue/false: True when MITRE has retired the entry without replacing it.
descriptiontext: MITRE's description, with its inline '(Citation: ...)' markers removed; the citations themselves are under 'references'.
domaintext: The ATT&CK domain that was read: enterprise, mobile or ics.
domain_titletext: That domain's full name, for example 'Enterprise ATT&CK'.
domainslist: The ATT&CK domains the entry appears in.
kindtext: What sort of ATT&CK object this is: technique, tactic, group, software, campaign, mitigation, data_source, data_component, detection_strategy or asset.
modifiedtext: When MITRE last revised it, as an ISO 8601 instant.
nametext: MITRE's name for the entry.
platformslist: The platforms it applies to, such as Windows or Containers. Empty for kinds that are not platform-specific.
referenceslist: The sources MITRE cites, each with its title and link.
relatedobject: What ATT&CK links to this entry, or null when 'Include related ATT&CK objects' was turned off.
related_countsobject: How many related objects of each kind were returned, so a step can branch without walking the groups.
related_includedtrue/false: Whether the relationship walk ran, so an empty 'related' can be told from one that was never looked up.
revokedtrue/false: True when the entry has been superseded by another one.
stix_idtext: The STIX identifier, which is what relationships and the raw object read are keyed by.
stix_typetext: The STIX type underneath, for example 'attack-pattern' for a technique or 'intrusion-set' for a group.
urltext: This entry's page on attack.mitre.org.
versiontext: The entry's own version, which MITRE bumps when it revises it.

Example output

{
  "aliases": [],
  "attack_id": "M1049",
  "attack_version": "19.2",
  "contributors": [],
  "created": "2019-06-11T17:14:35.170Z",
  "deprecated": false,
  "description": "Use signatures or heuristics to detect malicious software.",
  "domain": "enterprise",
  "domain_title": "Enterprise ATT&CK",
  "domains": [
    "enterprise-attack"
  ],
  "kind": "mitigation",
  "modified": "2025-04-18T17:59:57.124Z",
  "name": "Antivirus/Antimalware",
  "platforms": [],
  "references": [],
  "related": {
    "count": 2,
    "groups": [
      {
        "count": 1,
        "kind": "mitigation",
        "objects": [
          {
            "attack_id": "M1042",
            "deprecated": false,
            "direction": "incoming",
            "kind": "mitigation",
            "name": "Disable or Remove Feature or Program",
            "relationship_type": "mitigates",
            "revoked": false,
            "stix_id": "course-of-action--e8242a33-26be-4d5a-93be-1c1de9d3c1a2",
            "url": "https://attack.mitre.org/mitigations/M1042"
          }
        ],
        "relationship_type": "mitigates",
        "total_count": 5
      },
      {
        "count": 1,
        "kind": "group",
        "objects": [
          {
            "attack_id": "G0016",
            "deprecated": false,
            "direction": "incoming",
            "kind": "group",
            "name": "APT29",
            "procedure_example": "APT29 has used PowerShell to execute commands and payloads on compromised hosts.",
            "relationship_type": "uses",
            "revoked": false,
            "stix_id": "intrusion-set--899ce53f-13a0-479b-a0e4-67d46e241542",
            "url": "https://attack.mitre.org/groups/G0016"
          }
        ],
        "relationship_type": "uses",
        "total_count": 25
      }
    ],
    "total_count": 214,
    "truncated": true
  },
  "related_counts": {
    "group": 1,
    "mitigation": 1
  },
  "related_included": true,
  "revoked": false,
  "stix_id": "course-of-action--dc43c2fe-355e-4a79-9570-3267b0992784",
  "stix_type": "course-of-action",
  "url": "https://attack.mitre.org/mitigations/M1049",
  "version": "1.1"
}

Get a tactic

Read one tactic and every technique filed under it: the whole column of the matrix in one step. Use it to answer 'what can an adversary do to achieve persistence here', or to feed a coverage review one goal at a time. No API key required.

Inputs

ATT&CK domaindomaintext: Which of the three ATT&CK knowledge bases to read. Enterprise covers IT, cloud, SaaS and network devices; Mobile covers Android and iOS; ICS covers industrial control systems. They are separate matrices with their own techniques and IDs, so a technique in one is not in the others.One of: enterprise (Enterprise (IT, cloud, SaaS, network)), mobile (Mobile (Android and iOS)), ics (ICS (industrial control systems)). Default: enterprise.
TactictactictextRequired: The tactic to read, chosen from the domain's own matrix. A value carried over from an earlier step may instead be an ATT&CK ID (TA0006), the slug techniques cite it by ('credential-access'), or its exact name.

Outputs

aliaseslist: The other names the entry is tracked under (for a group, the vendor names such as 'Cozy Bear'). Empty for kinds without them.
attack_idtext: The ATT&CK identifier, for example 'T1059.001' for a sub-technique or 'G0016' for a group.
attack_versiontext: The ATT&CK release the answer was read from, for example '19.2'. Two identical questions asked either side of a release can differ, so every answer says which one it read.
contributorslist: The people and organizations MITRE credits for the entry.
createdtext: When MITRE first published the entry, as an ISO 8601 instant.
deprecatedtrue/false: True when MITRE has retired the entry without replacing it.
descriptiontext: MITRE's description, with its inline '(Citation: ...)' markers removed; the citations themselves are under 'references'.
domaintext: The ATT&CK domain that was read: enterprise, mobile or ics.
domain_titletext: That domain's full name, for example 'Enterprise ATT&CK'.
domainslist: The ATT&CK domains the entry appears in.
kindtext: What sort of ATT&CK object this is: technique, tactic, group, software, campaign, mitigation, data_source, data_component, detection_strategy or asset.
modifiedtext: When MITRE last revised it, as an ISO 8601 instant.
nametext: MITRE's name for the entry.
platformslist: The platforms it applies to, such as Windows or Containers. Empty for kinds that are not platform-specific.
referenceslist: The sources MITRE cites, each with its title and link.
revokedtrue/false: True when the entry has been superseded by another one.
shortnametext: The slug techniques cite the tactic by, such as 'credential-access'.
stix_idtext: The STIX identifier, which is what relationships and the raw object read are keyed by.
stix_typetext: The STIX type underneath, for example 'attack-pattern' for a technique or 'intrusion-set' for a group.
technique_countnumber: How many live techniques are filed under it.
techniqueslist: The matching techniques.
urltext: This entry's page on attack.mitre.org.
versiontext: The entry's own version, which MITRE bumps when it revises it.

Example output

{
  "aliases": [],
  "attack_id": "TA0002",
  "attack_version": "19.2",
  "contributors": [],
  "created": "2018-10-17T00:14:20.652Z",
  "deprecated": false,
  "description": "The adversary is trying to run malicious code.",
  "domain": "enterprise",
  "domain_title": "Enterprise ATT&CK",
  "domains": [
    "enterprise-attack"
  ],
  "kind": "tactic",
  "modified": "2025-04-25T14:45:35.841Z",
  "name": "Execution",
  "platforms": [],
  "references": [],
  "revoked": false,
  "shortname": "execution",
  "stix_id": "x-mitre-tactic--4ca45d45-df4d-4613-8980-bac22d278fa5",
  "stix_type": "x-mitre-tactic",
  "technique_count": 64,
  "techniques": [
    {
      "aliases": [],
      "attack_id": "T1059.001",
      "contributors": [
        "Praetorian"
      ],
      "created": "2020-03-09T14:35:22.156Z",
      "deprecated": false,
      "description": "Adversaries may abuse PowerShell commands and scripts for execution.",
      "domains": [
        "enterprise-attack"
      ],
      "impact_types": [],
      "is_subtechnique": true,
      "kind": "technique",
      "modified": "2026-05-12T15:12:00.625Z",
      "name": "PowerShell",
      "parent_technique_id": "T1059",
      "platforms": [
        "Windows"
      ],
      "references": [
        {
          "description": "Microsoft. (2017). PowerShell Documentation.",
          "external_id": null,
          "source_name": "Microsoft PowerShell",
          "url": "https://learn.microsoft.com/powershell/"
        }
      ],
      "remote_support": true,
      "revoked": false,
      "stix_id": "attack-pattern--970a3432-3237-47ad-bcca-7d8cbb217736",
      "stix_type": "attack-pattern",
      "tactic_shortnames": [
        "execution"
      ],
      "tactics": [
        "Execution"
      ],
      "url": "https://attack.mitre.org/techniques/T1059/001",
      "version": "1.6"
    }
  ],
  "url": "https://attack.mitre.org/tactics/TA0002",
  "version": "1.0"
}

Get a technique

Read one technique in full: what the behaviour is, which tactics it serves, which platforms it applies to, its parent and sub-techniques, and MITRE's sources. With related objects included it also returns the mitigations and detection strategies that cover it and the groups, software and campaigns observed using it, each with MITRE's procedure example. Give it an ATT&CK ID like T1059 or T1059.001. No API key required.

Inputs

ATT&CK domaindomaintext: Which of the three ATT&CK knowledge bases to read. Enterprise covers IT, cloud, SaaS and network devices; Mobile covers Android and iOS; ICS covers industrial control systems. They are separate matrices with their own techniques and IDs, so a technique in one is not in the others.One of: enterprise (Enterprise (IT, cloud, SaaS, network)), mobile (Mobile (Android and iOS)), ics (ICS (industrial control systems)). Default: enterprise.
TechniquetechniquetextRequired: The technique to read, chosen from the domain's own list. A value carried over from an earlier step may instead be an ATT&CK ID (T1059 or T1059.001), a STIX id, or the technique's exact name.
Include related ATT&CK objectsinclude_relatedtrue/false: Also return what ATT&CK links to this entry: the techniques a group or piece of software uses, the mitigations and detection strategies covering a technique, the campaigns attributed to a group. This is usually the point of looking something up, so it is on by default. Turning it off makes the step a fast metadata read; the links live in the domain's relationship set, which the first step to need it downloads in full (about half a minute for Enterprise) and every later step in the same run reuses.Default: true.
Maximum related objectsrelated_limitnumber: How many related objects to return. A widely used technique can be linked to hundreds; the answer always carries the true total beside the ones it returns.From 1 to 1000. Default: 50.

Outputs

aliaseslist: The other names the entry is tracked under (for a group, the vendor names such as 'Cozy Bear'). Empty for kinds without them.
attack_idtext: The ATT&CK identifier, for example 'T1059.001' for a sub-technique or 'G0016' for a group.
attack_versiontext: The ATT&CK release the answer was read from, for example '19.2'. Two identical questions asked either side of a release can differ, so every answer says which one it read.
contributorslist: The people and organizations MITRE credits for the entry.
createdtext: When MITRE first published the entry, as an ISO 8601 instant.
deprecatedtrue/false: True when MITRE has retired the entry without replacing it.
descriptiontext: MITRE's description, with its inline '(Citation: ...)' markers removed; the citations themselves are under 'references'.
domaintext: The ATT&CK domain that was read: enterprise, mobile or ics.
domain_titletext: That domain's full name, for example 'Enterprise ATT&CK'.
domainslist: The ATT&CK domains the entry appears in.
impact_typeslist: For an Impact technique, whether it costs availability or integrity. Empty for every other technique.
is_subtechniquetrue/false: True when this refines a parent technique (T1059.001).
kindtext: What sort of ATT&CK object this is: technique, tactic, group, software, campaign, mitigation, data_source, data_component, detection_strategy or asset.
modifiedtext: When MITRE last revised it, as an ISO 8601 instant.
nametext: MITRE's name for the entry.
parent_techniqueobject: The technique this one refines, or null when it is top-level.
parent_technique_idtext: The ATT&CK ID of the parent technique, or null for a top-level one.
platformslist: The platforms it applies to, such as Windows or Containers. Empty for kinds that are not platform-specific.
referenceslist: The sources MITRE cites, each with its title and link.
relatedobject: What ATT&CK links to this entry, or null when 'Include related ATT&CK objects' was turned off.
related_countsobject: How many related objects of each kind were returned, so a step can branch without walking the groups.
related_includedtrue/false: Whether the relationship walk ran, so an empty 'related' can be told from one that was never looked up.
remote_supporttrue/false: Whether the technique can be run against a remote host, or null where MITRE does not state it.
revokedtrue/false: True when the entry has been superseded by another one.
stix_idtext: The STIX identifier, which is what relationships and the raw object read are keyed by.
stix_typetext: The STIX type underneath, for example 'attack-pattern' for a technique or 'intrusion-set' for a group.
subtechnique_countnumber
subtechniqueslist: The sub-techniques that refine this one.
tactic_shortnameslist: The same tactics as the slugs ATT&CK uses internally, such as 'credential-access'.
tacticslist: The adversary goals this technique serves, by name, such as 'Credential Access'.
urltext: This entry's page on attack.mitre.org.
versiontext: The entry's own version, which MITRE bumps when it revises it.

Example output

{
  "aliases": [],
  "attack_id": "T1059.001",
  "attack_version": "19.2",
  "contributors": [
    "Praetorian"
  ],
  "created": "2020-03-09T14:35:22.156Z",
  "deprecated": false,
  "description": "Adversaries may abuse PowerShell commands and scripts for execution.",
  "domain": "enterprise",
  "domain_title": "Enterprise ATT&CK",
  "domains": [
    "enterprise-attack"
  ],
  "impact_types": [],
  "is_subtechnique": true,
  "kind": "technique",
  "modified": "2026-05-12T15:12:00.625Z",
  "name": "PowerShell",
  "parent_technique": {
    "attack_id": "T1059",
    "name": "Command and Scripting Interpreter",
    "url": "https://attack.mitre.org/techniques/T1059"
  },
  "parent_technique_id": "T1059",
  "platforms": [
    "Windows"
  ],
  "references": [
    {
      "description": "Microsoft. (2017). PowerShell Documentation.",
      "external_id": null,
      "source_name": "Microsoft PowerShell",
      "url": "https://learn.microsoft.com/powershell/"
    }
  ],
  "related": {
    "count": 2,
    "groups": [
      {
        "count": 1,
        "kind": "mitigation",
        "objects": [
          {
            "attack_id": "M1042",
            "deprecated": false,
            "direction": "incoming",
            "kind": "mitigation",
            "name": "Disable or Remove Feature or Program",
            "relationship_type": "mitigates",
            "revoked": false,
            "stix_id": "course-of-action--e8242a33-26be-4d5a-93be-1c1de9d3c1a2",
            "url": "https://attack.mitre.org/mitigations/M1042"
          }
        ],
        "relationship_type": "mitigates",
        "total_count": 5
      },
      {
        "count": 1,
        "kind": "group",
        "objects": [
          {
            "attack_id": "G0016",
            "deprecated": false,
            "direction": "incoming",
            "kind": "group",
            "name": "APT29",
            "procedure_example": "APT29 has used PowerShell to execute commands and payloads on compromised hosts.",
            "relationship_type": "uses",
            "revoked": false,
            "stix_id": "intrusion-set--899ce53f-13a0-479b-a0e4-67d46e241542",
            "url": "https://attack.mitre.org/groups/G0016"
          }
        ],
        "relationship_type": "uses",
        "total_count": 25
      }
    ],
    "total_count": 214,
    "truncated": true
  },
  "related_counts": {
    "group": 1,
    "mitigation": 1
  },
  "related_included": true,
  "remote_support": true,
  "revoked": false,
  "stix_id": "attack-pattern--970a3432-3237-47ad-bcca-7d8cbb217736",
  "stix_type": "attack-pattern",
  "subtechnique_count": 0,
  "subtechniques": [],
  "tactic_shortnames": [
    "execution"
  ],
  "tactics": [
    "Execution"
  ],
  "url": "https://attack.mitre.org/techniques/T1059/001",
  "version": "1.6"
}

Get domain details

Read which ATT&CK release a domain is currently on, when it was published, and how much it holds: the number of techniques, tactics, groups, software entries, campaigns, mitigations, data sources and detection strategies. Run it to check for a new release before doing anything else; ATT&CK ships a few times a year and an answer read either side of one can differ. No API key required.

Inputs

ATT&CK domaindomaintext: Which of the three ATT&CK knowledge bases to read. Enterprise covers IT, cloud, SaaS and network devices; Mobile covers Android and iOS; ICS covers industrial control systems. They are separate matrices with their own techniques and IDs, so a technique in one is not in the others.One of: enterprise (Enterprise (IT, cloud, SaaS, network)), mobile (Mobile (Android and iOS)), ics (ICS (industrial control systems)). Default: enterprise.

Outputs

asset_countnumber: Assets, which only ICS ATT&CK defines.
attack_spec_versiontext: The ATT&CK STIX specification version in use.
attack_versiontext: The ATT&CK release the answer was read from, for example '19.2'. Two identical questions asked either side of a release can differ, so every answer says which one it read.
campaign_countnumber
collection_idtext
data_component_countnumber
data_source_countnumber
descriptiontext
detection_strategy_countnumber
domaintext: The ATT&CK domain that was read: enterprise, mobile or ics.
group_countnumber
mitigation_countnumber
object_countnumber: Everything the domain holds, of every type.
read_onlytrue/false: Always true: MITRE publishes, nobody writes.
relationship_countnumber: How many links the domain holds between its objects.
releasedtext: When this release was published.
software_countnumber
stix_domaintext
tactic_countnumber
technique_countnumber
titletext: That domain's full name, for example 'Enterprise ATT&CK'.
urltext

Example output

{
  "asset_count": 0,
  "attack_spec_version": "3.3.0",
  "attack_version": "19.2",
  "campaign_count": 56,
  "collection_id": "x-mitre-collection--1f5f1533-f617-4ca8-9ab4-6a02367fa019",
  "data_component_count": 109,
  "data_source_count": 38,
  "description": "ATT&CK for Enterprise provides a knowledge base of real-world adversary behavior targeting traditional enterprise networks.",
  "detection_strategy_count": 699,
  "domain": "enterprise",
  "group_count": 191,
  "mitigation_count": 268,
  "object_count": 24917,
  "read_only": true,
  "relationship_count": 21096,
  "released": "2026-08-05T14:26:46.746Z",
  "software_count": 828,
  "stix_domain": "enterprise-attack",
  "tactic_count": 15,
  "technique_count": 858,
  "title": "Enterprise ATT&CK",
  "url": "https://attack.mitre.org/matrices/enterprise/"
}

Get raw STIX object

Read one entry exactly as MITRE publishes it (the whole STIX 2.1 object, untouched) beside the date the collection took it in and every version it holds. The other actions return a tidied record; use this one when feeding a STIX-aware tool, or to see a field this integration does not surface. No API key required.

Inputs

ATT&CK domaindomaintext: Which of the three ATT&CK knowledge bases to read. Enterprise covers IT, cloud, SaaS and network devices; Mobile covers Android and iOS; ICS covers industrial control systems. They are separate matrices with their own techniques and IDs, so a technique in one is not in the others.One of: enterprise (Enterprise (IT, cloud, SaaS, network)), mobile (Mobile (Android and iOS)), ics (ICS (industrial control systems)). Default: enterprise.
ATT&CK entrystix_idtextRequired: The entry to read, chosen from the domain's own list. A value carried over from an earlier step may instead be a STIX id ('attack-pattern--0042a9f5-...') or a bare ATT&CK ID.

Outputs

attack_idtext
attack_versiontext: The ATT&CK release the answer was read from, for example '19.2'. Two identical questions asked either side of a release can differ, so every answer says which one it read.
collection_versiontext: The version of the object the collection holds.
date_addedtext: When the collection took this object in, which differs from the object's own creation date once it has been revised.
domaintext: The ATT&CK domain that was read: enterprise, mobile or ics.
domain_titletext: That domain's full name, for example 'Enterprise ATT&CK'.
kindtext
nametext
objectobject: The STIX 2.1 object exactly as MITRE serves it.
spec_versiontext: The STIX specification version, always '2.1'.
stix_idtext
stix_typetext
version_countnumber
versionslist: Every version of the object the server holds.

Example output

{
  "attack_id": "T1059.001",
  "attack_version": "19.2",
  "collection_version": "2026-05-12T15:12:00.625Z",
  "date_added": "2020-03-09T14:35:22.156Z",
  "domain": "enterprise",
  "domain_title": "Enterprise ATT&CK",
  "kind": "technique",
  "name": "PowerShell",
  "object": {
    "id": "attack-pattern--970a3432-3237-47ad-bcca-7d8cbb217736",
    "name": "PowerShell",
    "spec_version": "2.1",
    "type": "attack-pattern",
    "x_mitre_is_subtechnique": true
  },
  "spec_version": "2.1",
  "stix_id": "attack-pattern--970a3432-3237-47ad-bcca-7d8cbb217736",
  "stix_type": "attack-pattern",
  "version_count": 1,
  "versions": [
    "2026-05-12T15:12:00.625Z"
  ]
}

Get software

Read one piece of malware or tooling: what it is, which platforms it runs on, and every name it is tracked under. With related objects included it also returns the techniques it implements and the groups and campaigns observed deploying it: the answer to 'if we found Cobalt Strike, who uses it and what will they do next'. No API key required.

Inputs

ATT&CK domaindomaintext: Which of the three ATT&CK knowledge bases to read. Enterprise covers IT, cloud, SaaS and network devices; Mobile covers Android and iOS; ICS covers industrial control systems. They are separate matrices with their own techniques and IDs, so a technique in one is not in the others.One of: enterprise (Enterprise (IT, cloud, SaaS, network)), mobile (Mobile (Android and iOS)), ics (ICS (industrial control systems)). Default: enterprise.
SoftwaresoftwaretextRequired: The malware or tool to read, chosen from the domain's own list. A value carried over from an earlier step may instead be an ATT&CK ID (S0154), a STIX id, or the software's exact name or alias.
Include related ATT&CK objectsinclude_relatedtrue/false: Also return what ATT&CK links to this entry: the techniques a group or piece of software uses, the mitigations and detection strategies covering a technique, the campaigns attributed to a group. This is usually the point of looking something up, so it is on by default. Turning it off makes the step a fast metadata read; the links live in the domain's relationship set, which the first step to need it downloads in full (about half a minute for Enterprise) and every later step in the same run reuses.Default: true.
Maximum related objectsrelated_limitnumber: How many related objects to return. A widely used technique can be linked to hundreds; the answer always carries the true total beside the ones it returns.From 1 to 1000. Default: 50.

Outputs

aliaseslist: The other names the entry is tracked under (for a group, the vendor names such as 'Cozy Bear'). Empty for kinds without them.
attack_idtext: The ATT&CK identifier, for example 'T1059.001' for a sub-technique or 'G0016' for a group.
attack_versiontext: The ATT&CK release the answer was read from, for example '19.2'. Two identical questions asked either side of a release can differ, so every answer says which one it read.
contributorslist: The people and organizations MITRE credits for the entry.
createdtext: When MITRE first published the entry, as an ISO 8601 instant.
deprecatedtrue/false: True when MITRE has retired the entry without replacing it.
descriptiontext: MITRE's description, with its inline '(Citation: ...)' markers removed; the citations themselves are under 'references'.
domaintext: The ATT&CK domain that was read: enterprise, mobile or ics.
domain_titletext: That domain's full name, for example 'Enterprise ATT&CK'.
domainslist: The ATT&CK domains the entry appears in.
is_familytrue/false: For malware, whether the entry describes a family rather than a single sample. Absent for tools.
kindtext: What sort of ATT&CK object this is: technique, tactic, group, software, campaign, mitigation, data_source, data_component, detection_strategy or asset.
modifiedtext: When MITRE last revised it, as an ISO 8601 instant.
nametext: MITRE's name for the entry.
platformslist: The platforms it applies to, such as Windows or Containers. Empty for kinds that are not platform-specific.
referenceslist: The sources MITRE cites, each with its title and link.
relatedobject: What ATT&CK links to this entry, or null when 'Include related ATT&CK objects' was turned off.
related_countsobject: How many related objects of each kind were returned, so a step can branch without walking the groups.
related_includedtrue/false: Whether the relationship walk ran, so an empty 'related' can be told from one that was never looked up.
revokedtrue/false: True when the entry has been superseded by another one.
software_typetext: 'malware' for adversary-built code, 'tool' for legitimate software adversaries repurpose, such as PsExec.
stix_idtext: The STIX identifier, which is what relationships and the raw object read are keyed by.
stix_typetext: The STIX type underneath, for example 'attack-pattern' for a technique or 'intrusion-set' for a group.
urltext: This entry's page on attack.mitre.org.
versiontext: The entry's own version, which MITRE bumps when it revises it.

Example output

{
  "aliases": [
    "Cobalt Strike"
  ],
  "attack_id": "S0154",
  "attack_version": "19.2",
  "contributors": [],
  "created": "2017-05-31T21:33:26.565Z",
  "deprecated": false,
  "description": "Cobalt Strike is a commercial, full-featured penetration testing tool.",
  "domain": "enterprise",
  "domain_title": "Enterprise ATT&CK",
  "domains": [
    "enterprise-attack"
  ],
  "is_family": true,
  "kind": "software",
  "modified": "2026-04-15T19:22:11.104Z",
  "name": "Cobalt Strike",
  "platforms": [
    "Windows",
    "Linux",
    "macOS"
  ],
  "references": [],
  "related": {
    "count": 2,
    "groups": [
      {
        "count": 1,
        "kind": "mitigation",
        "objects": [
          {
            "attack_id": "M1042",
            "deprecated": false,
            "direction": "incoming",
            "kind": "mitigation",
            "name": "Disable or Remove Feature or Program",
            "relationship_type": "mitigates",
            "revoked": false,
            "stix_id": "course-of-action--e8242a33-26be-4d5a-93be-1c1de9d3c1a2",
            "url": "https://attack.mitre.org/mitigations/M1042"
          }
        ],
        "relationship_type": "mitigates",
        "total_count": 5
      },
      {
        "count": 1,
        "kind": "group",
        "objects": [
          {
            "attack_id": "G0016",
            "deprecated": false,
            "direction": "incoming",
            "kind": "group",
            "name": "APT29",
            "procedure_example": "APT29 has used PowerShell to execute commands and payloads on compromised hosts.",
            "relationship_type": "uses",
            "revoked": false,
            "stix_id": "intrusion-set--899ce53f-13a0-479b-a0e4-67d46e241542",
            "url": "https://attack.mitre.org/groups/G0016"
          }
        ],
        "relationship_type": "uses",
        "total_count": 25
      }
    ],
    "total_count": 214,
    "truncated": true
  },
  "related_counts": {
    "group": 1,
    "mitigation": 1
  },
  "related_included": true,
  "revoked": false,
  "software_type": "malware",
  "stix_id": "malware--a7881f21-e978-4fe4-af56-92c9416a2616",
  "stix_type": "malware",
  "url": "https://attack.mitre.org/software/S0154",
  "version": "1.14"
}

List ATT&CK domains

List the three ATT&CK knowledge bases MITRE publishes (Enterprise, Mobile and ICS) with what each covers and whether the server is serving it. Every other action takes one of these as its domain, so this is the place to start when you are not sure which matrix a question belongs to. No API key required.

Inputs

None.

Outputs

api_root_titletext
attack_site_urltext
countnumber: How many entries this answer carries.
domainslist: The three ATT&CK domains.
server_descriptiontext
server_titletext: What MITRE's TAXII server calls itself.
taxii_versionslist: The TAXII versions the server speaks.
total_countnumber: How many entries matched in all, before any cap was applied.

Example output

{
  "api_root_title": "MITRE ATT&CK TAXII 2.1",
  "attack_site_url": "https://attack.mitre.org",
  "count": 3,
  "domains": [
    {
      "available": true,
      "collection_id": "x-mitre-collection--1f5f1533-f617-4ca8-9ab4-6a02367fa019",
      "description": "ATT&CK for Enterprise provides a knowledge base of real-world adversary behavior targeting traditional enterprise networks.",
      "domain": "enterprise",
      "stix_domain": "enterprise-attack",
      "title": "Enterprise ATT&CK",
      "url": "https://attack.mitre.org/matrices/enterprise/"
    }
  ],
  "server_description": "This API Root contains TAXII 2.1 REST API endpoints that serve MITRE ATT&CK STIX 2.1 data",
  "server_title": "MITRE ATT&CK TAXII 2.1",
  "taxii_versions": [
    "application/taxii+json;version=2.1"
  ],
  "total_count": 3
}

List campaigns

List the intrusion campaigns ATT&CK tracks in a domain (named sets of activity such as Operation Ghost or SolarWinds Compromise) with when each was first and last reported active. A campaign is the bridge between a group and a specific intrusion. No API key required.

Inputs

ATT&CK domaindomaintext: Which of the three ATT&CK knowledge bases to read. Enterprise covers IT, cloud, SaaS and network devices; Mobile covers Android and iOS; ICS covers industrial control systems. They are separate matrices with their own techniques and IDs, so a technique in one is not in the others.One of: enterprise (Enterprise (IT, cloud, SaaS, network)), mobile (Mobile (Android and iOS)), ics (ICS (industrial control systems)). Default: enterprise.
Text containsquerytext: Only entries whose ATT&CK ID, name, alias or description contain this text. Not case sensitive. Leave it empty for all of them.
Include retired entriesinclude_inactivetrue/false: ATT&CK never deletes: a technique that has been superseded stays in the matrix marked revoked, and one that no longer describes anything real stays marked deprecated. Both are left out unless this is turned on, which is what you want when auditing coverage of older content.Default: false.
Order bysorttext: How to order the results. ATT&CK ID order is the numeric one a reader expects, so T1002 comes before T1059 and each sub-technique sits directly under its parent.One of: attack_id_asc (ATT&CK ID (lowest first)), attack_id_desc (ATT&CK ID (highest first)), name_asc (Name (A to Z)), name_desc (Name (Z to A)), modified_desc (Last updated (newest first)), created_desc (Added to ATT&CK (newest first)). Default: attack_id_asc.
Maximum resultslimitnumber: How many entries to return. The answer also carries the total number that matched, so a capped list never reads as a complete one.From 1 to 500. Default: 25.
Skipoffsetnumber: How many matching entries to skip before returning any, for reading a long list a page at a time. Leave it at 0 for the first page.From 0 to 20000. Default: 0.

Outputs

attack_versiontext: The ATT&CK release the answer was read from, for example '19.2'. Two identical questions asked either side of a release can differ, so every answer says which one it read.
campaignslist: The matching campaigns.
countnumber: How many entries this answer carries.
domaintext: The ATT&CK domain that was read: enterprise, mobile or ics.
domain_titletext: That domain's full name, for example 'Enterprise ATT&CK'.
offsetnumber: How many matching entries were skipped before this page.
sorttext: The order the entries were returned in.
total_countnumber: How many entries matched in all, before any cap was applied.
truncatedtrue/false: True when more entries matched than were returned.

Example output

{
  "attack_version": "19.2",
  "campaigns": [
    {
      "aliases": [
        "Operation Ghost"
      ],
      "attack_id": "C0005",
      "contributors": [],
      "created": "2023-03-23T17:51:58.539Z",
      "deprecated": false,
      "description": "Operation Ghost was an APT29 campaign that ran from 2013 through 2019.",
      "domains": [
        "enterprise-attack"
      ],
      "first_seen": "2013-09-01T04:00:00.000Z",
      "kind": "campaign",
      "last_seen": "2019-10-01T04:00:00.000Z",
      "modified": "2026-07-31T18:47:24.650Z",
      "name": "Operation Ghost",
      "platforms": [],
      "references": [],
      "revoked": false,
      "stix_id": "campaign--7854c1a0-f06c-4876-98a4-4bbd34751b05",
      "stix_type": "campaign",
      "url": "https://attack.mitre.org/campaigns/C0005",
      "version": "1.2"
    }
  ],
  "count": 1,
  "domain": "enterprise",
  "domain_title": "Enterprise ATT&CK",
  "offset": 0,
  "sort": "attack_id_asc",
  "total_count": 56,
  "truncated": true
}

List data components

List the telemetry ATT&CK expects detections to be built on: the events a detection consumes (Process Creation, Network Connection Creation, Logon Session Metadata) each with the concrete logs it can be read from, down to the channel ('WinEventLog:Security' / 'EventCode=4688'). Filter to one log source to answer 'what can I detect with the telemetry I already collect'. No API key required.

Inputs

ATT&CK domaindomaintext: Which of the three ATT&CK knowledge bases to read. Enterprise covers IT, cloud, SaaS and network devices; Mobile covers Android and iOS; ICS covers industrial control systems. They are separate matrices with their own techniques and IDs, so a technique in one is not in the others.One of: enterprise (Enterprise (IT, cloud, SaaS, network)), mobile (Mobile (Android and iOS)), ics (ICS (industrial control systems)). Default: enterprise.
Text containsquerytext: Only entries whose ATT&CK ID, name, alias or description contain this text. Not case sensitive. Leave it empty for all of them.
Log sourcelog_sourcetext: Only components readable from this log, chosen from the ones the domain actually names, with the number of components beside each. Also matched against the channel, so 'EventCode=4688' narrows further. Leave it unset for every component.
Include retired entriesinclude_inactivetrue/false: ATT&CK never deletes: a technique that has been superseded stays in the matrix marked revoked, and one that no longer describes anything real stays marked deprecated. Both are left out unless this is turned on, which is what you want when auditing coverage of older content.Default: false.
Maximum resultslimitnumber: How many entries to return. The answer also carries the total number that matched, so a capped list never reads as a complete one.From 1 to 500. Default: 25.
Skipoffsetnumber: How many matching entries to skip before returning any, for reading a long list a page at a time. Leave it at 0 for the first page.From 0 to 20000. Default: 0.

Outputs

attack_versiontext: The ATT&CK release the answer was read from, for example '19.2'. Two identical questions asked either side of a release can differ, so every answer says which one it read.
countnumber: How many entries this answer carries.
data_componentslist: The matching data components, each with its log sources.
domaintext: The ATT&CK domain that was read: enterprise, mobile or ics.
domain_titletext: That domain's full name, for example 'Enterprise ATT&CK'.
log_sourcetext: The log source filter that was applied.
log_source_name_countnumber: How many distinct log sources the domain names across all its components.
offsetnumber: How many matching entries were skipped before this page.
total_countnumber: How many entries matched in all, before any cap was applied.
truncatedtrue/false: True when more entries matched than were returned.

Example output

{
  "attack_version": "19.2",
  "count": 1,
  "data_components": [
    {
      "aliases": [],
      "attack_id": "DC0032",
      "contributors": [],
      "created": "2021-10-20T15:05:19.271Z",
      "deprecated": false,
      "description": "The initial construction of an executable managed by the operating system.",
      "domains": [
        "enterprise-attack"
      ],
      "kind": "data_component",
      "log_source_count": 2,
      "log_sources": [
        {
          "channel": "EventCode=4688",
          "name": "WinEventLog:Security"
        },
        {
          "channel": "execve",
          "name": "auditd:SYSCALL"
        }
      ],
      "modified": "2025-11-12T22:03:39.105Z",
      "name": "Process Creation",
      "platforms": [],
      "references": [],
      "revoked": false,
      "stix_id": "x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077",
      "stix_type": "x-mitre-data-component",
      "url": "https://attack.mitre.org/datacomponents/DC0032",
      "version": "2.0"
    }
  ],
  "domain": "enterprise",
  "domain_title": "Enterprise ATT&CK",
  "log_source": null,
  "log_source_name_count": 342,
  "offset": 0,
  "total_count": 106,
  "truncated": true
}

List groups

List the adversary groups ATT&CK tracks in a domain, each with every name it is known by: the vendor aliases such as Cozy Bear or Midnight Blizzard that a report is far more likely to use than G0016. Filter by free text over IDs, names, aliases and descriptions. No API key required.

Inputs

ATT&CK domaindomaintext: Which of the three ATT&CK knowledge bases to read. Enterprise covers IT, cloud, SaaS and network devices; Mobile covers Android and iOS; ICS covers industrial control systems. They are separate matrices with their own techniques and IDs, so a technique in one is not in the others.One of: enterprise (Enterprise (IT, cloud, SaaS, network)), mobile (Mobile (Android and iOS)), ics (ICS (industrial control systems)). Default: enterprise.
Text containsquerytext: Only entries whose ATT&CK ID, name, alias or description contain this text. Not case sensitive. Leave it empty for all of them.
Include retired entriesinclude_inactivetrue/false: ATT&CK never deletes: a technique that has been superseded stays in the matrix marked revoked, and one that no longer describes anything real stays marked deprecated. Both are left out unless this is turned on, which is what you want when auditing coverage of older content.Default: false.
Order bysorttext: How to order the results. ATT&CK ID order is the numeric one a reader expects, so T1002 comes before T1059 and each sub-technique sits directly under its parent.One of: attack_id_asc (ATT&CK ID (lowest first)), attack_id_desc (ATT&CK ID (highest first)), name_asc (Name (A to Z)), name_desc (Name (Z to A)), modified_desc (Last updated (newest first)), created_desc (Added to ATT&CK (newest first)). Default: attack_id_asc.
Maximum resultslimitnumber: How many entries to return. The answer also carries the total number that matched, so a capped list never reads as a complete one.From 1 to 500. Default: 25.
Skipoffsetnumber: How many matching entries to skip before returning any, for reading a long list a page at a time. Leave it at 0 for the first page.From 0 to 20000. Default: 0.

Outputs

attack_versiontext: The ATT&CK release the answer was read from, for example '19.2'. Two identical questions asked either side of a release can differ, so every answer says which one it read.
countnumber: How many entries this answer carries.
domaintext: The ATT&CK domain that was read: enterprise, mobile or ics.
domain_titletext: That domain's full name, for example 'Enterprise ATT&CK'.
groupslist: The matching adversary groups.
offsetnumber: How many matching entries were skipped before this page.
sorttext: The order the entries were returned in.
total_countnumber: How many entries matched in all, before any cap was applied.
truncatedtrue/false: True when more entries matched than were returned.

Example output

{
  "attack_version": "19.2",
  "count": 1,
  "domain": "enterprise",
  "domain_title": "Enterprise ATT&CK",
  "groups": [
    {
      "aliases": [
        "APT29",
        "Cozy Bear",
        "Midnight Blizzard",
        "NOBELIUM"
      ],
      "attack_id": "G0016",
      "contributors": [],
      "created": "2017-05-31T21:31:52.748Z",
      "deprecated": false,
      "description": "APT29 is a threat group attributed to Russia's Foreign Intelligence Service.",
      "domains": [
        "enterprise-attack"
      ],
      "kind": "group",
      "modified": "2026-07-31T18:47:44.949Z",
      "name": "APT29",
      "platforms": [],
      "references": [],
      "revoked": false,
      "stix_id": "intrusion-set--899ce53f-13a0-479b-a0e4-67d46e241542",
      "stix_type": "intrusion-set",
      "url": "https://attack.mitre.org/groups/G0016",
      "version": "6.2"
    }
  ],
  "offset": 0,
  "sort": "attack_id_asc",
  "total_count": 191,
  "truncated": true
}

List mitigations

List the mitigations ATT&CK recommends in a domain: the defensive measures (multi-factor authentication, application control, network segmentation) that its techniques are mapped to. Filter by free text over IDs, names and descriptions. No API key required.

Inputs

ATT&CK domaindomaintext: Which of the three ATT&CK knowledge bases to read. Enterprise covers IT, cloud, SaaS and network devices; Mobile covers Android and iOS; ICS covers industrial control systems. They are separate matrices with their own techniques and IDs, so a technique in one is not in the others.One of: enterprise (Enterprise (IT, cloud, SaaS, network)), mobile (Mobile (Android and iOS)), ics (ICS (industrial control systems)). Default: enterprise.
Text containsquerytext: Only entries whose ATT&CK ID, name, alias or description contain this text. Not case sensitive. Leave it empty for all of them.
Include retired entriesinclude_inactivetrue/false: ATT&CK never deletes: a technique that has been superseded stays in the matrix marked revoked, and one that no longer describes anything real stays marked deprecated. Both are left out unless this is turned on, which is what you want when auditing coverage of older content.Default: false.
Order bysorttext: How to order the results. ATT&CK ID order is the numeric one a reader expects, so T1002 comes before T1059 and each sub-technique sits directly under its parent.One of: attack_id_asc (ATT&CK ID (lowest first)), attack_id_desc (ATT&CK ID (highest first)), name_asc (Name (A to Z)), name_desc (Name (Z to A)), modified_desc (Last updated (newest first)), created_desc (Added to ATT&CK (newest first)). Default: attack_id_asc.
Maximum resultslimitnumber: How many entries to return. The answer also carries the total number that matched, so a capped list never reads as a complete one.From 1 to 500. Default: 25.
Skipoffsetnumber: How many matching entries to skip before returning any, for reading a long list a page at a time. Leave it at 0 for the first page.From 0 to 20000. Default: 0.

Outputs

attack_versiontext: The ATT&CK release the answer was read from, for example '19.2'. Two identical questions asked either side of a release can differ, so every answer says which one it read.
countnumber: How many entries this answer carries.
domaintext: The ATT&CK domain that was read: enterprise, mobile or ics.
domain_titletext: That domain's full name, for example 'Enterprise ATT&CK'.
mitigationslist: The matching mitigations.
offsetnumber: How many matching entries were skipped before this page.
sorttext: The order the entries were returned in.
total_countnumber: How many entries matched in all, before any cap was applied.
truncatedtrue/false: True when more entries matched than were returned.

Example output

{
  "attack_version": "19.2",
  "count": 1,
  "domain": "enterprise",
  "domain_title": "Enterprise ATT&CK",
  "mitigations": [
    {
      "aliases": [],
      "attack_id": "M1049",
      "contributors": [],
      "created": "2019-06-11T17:14:35.170Z",
      "deprecated": false,
      "description": "Use signatures or heuristics to detect malicious software.",
      "domains": [
        "enterprise-attack"
      ],
      "kind": "mitigation",
      "modified": "2025-04-18T17:59:57.124Z",
      "name": "Antivirus/Antimalware",
      "platforms": [],
      "references": [],
      "revoked": false,
      "stix_id": "course-of-action--dc43c2fe-355e-4a79-9570-3267b0992784",
      "stix_type": "course-of-action",
      "url": "https://attack.mitre.org/mitigations/M1049",
      "version": "1.1"
    }
  ],
  "offset": 0,
  "sort": "attack_id_asc",
  "total_count": 268,
  "truncated": true
}

List recent changes

List what a domain gained or revised after a date and time: the new techniques, newly tracked groups and revised entries of the last release. This is the one question MITRE's server answers itself rather than leaving to be filtered, so it is the cheap way to run 'tell me what changed' on a schedule and only act when something did. No API key required.

Inputs

ATT&CK domaindomaintext: Which of the three ATT&CK knowledge bases to read. Enterprise covers IT, cloud, SaaS and network devices; Mobile covers Android and iOS; ICS covers industrial control systems. They are separate matrices with their own techniques and IDs, so a technique in one is not in the others.One of: enterprise (Enterprise (IT, cloud, SaaS, network)), mobile (Mobile (Android and iOS)), ics (ICS (industrial control systems)). Default: enterprise.
Changed sincesincedate and timeRequired: Only entries the domain took in after this moment. This is when the collection took the entry in, not when MITRE first wrote it, so a technique revised in the latest release counts as a change even though it was created years ago.
Object typesobject_typeslist: Which kinds of ATT&CK object to include. Leave every option unchecked to cover all of them.One or more of: technique (Techniques), tactic (Tactics), group (Groups), software (Software (malware and tools)), campaign (Campaigns), mitigation (Mitigations), data_component (Data components), data_source (Data sources (retired in ATT&CK v19)), detection_strategy (Detection strategies), asset (Assets (ICS only)).
Maximum resultslimitnumber: How many changes to return, most recently revised first. The answer also carries how many there were in all, and a count per kind.From 1 to 500. Default: 50.

Outputs

attack_versiontext: The ATT&CK release the answer was read from, for example '19.2'. Two identical questions asked either side of a release can differ, so every answer says which one it read.
changeslist: The entries added or revised since then.
countnumber: How many entries this answer carries.
counts_by_kindobject: How many entries of each kind changed.
domaintext: The ATT&CK domain that was read: enterprise, mobile or ics.
domain_titletext: That domain's full name, for example 'Enterprise ATT&CK'.
object_typeslist: The kinds of object that were checked.
offsetnumber: How many matching entries were skipped before this page.
sincetext: The instant that was asked about.
total_countnumber: How many entries matched in all, before any cap was applied.
truncatedtrue/false: True when more entries matched than were returned.

Example output

{
  "attack_version": "19.2",
  "changes": [
    {
      "aliases": [],
      "attack_id": "T1059.001",
      "contributors": [
        "Praetorian"
      ],
      "created": "2020-03-09T14:35:22.156Z",
      "deprecated": false,
      "description": "Adversaries may abuse PowerShell commands and scripts for execution.",
      "domains": [
        "enterprise-attack"
      ],
      "impact_types": [],
      "is_subtechnique": true,
      "kind": "technique",
      "modified": "2026-05-12T15:12:00.625Z",
      "name": "PowerShell",
      "parent_technique_id": "T1059",
      "platforms": [
        "Windows"
      ],
      "references": [
        {
          "description": "Microsoft. (2017). PowerShell Documentation.",
          "external_id": null,
          "source_name": "Microsoft PowerShell",
          "url": "https://learn.microsoft.com/powershell/"
        }
      ],
      "remote_support": true,
      "revoked": false,
      "stix_id": "attack-pattern--970a3432-3237-47ad-bcca-7d8cbb217736",
      "stix_type": "attack-pattern",
      "tactic_shortnames": [
        "execution"
      ],
      "tactics": [
        "Execution"
      ],
      "url": "https://attack.mitre.org/techniques/T1059/001",
      "version": "1.6"
    }
  ],
  "count": 1,
  "counts_by_kind": {
    "group": 9,
    "software": 8,
    "technique": 42
  },
  "domain": "enterprise",
  "domain_title": "Enterprise ATT&CK",
  "object_types": [
    "technique",
    "group",
    "software"
  ],
  "offset": 0,
  "since": "2026-01-01T00:00:00.000Z",
  "total_count": 59,
  "truncated": true
}

Walk the relationships around any ATT&CK entry, in both directions, grouped by how they are linked. This is the action behind 'which groups use this technique', 'what does this malware do', 'what mitigates this' and 'which campaigns has this group run': the joins that make ATT&CK a graph rather than a list. Narrow it to particular link types or object kinds, and keep or drop MITRE's procedure examples. No API key required.

Inputs

ATT&CK domaindomaintext: Which of the three ATT&CK knowledge bases to read. Enterprise covers IT, cloud, SaaS and network devices; Mobile covers Android and iOS; ICS covers industrial control systems. They are separate matrices with their own techniques and IDs, so a technique in one is not in the others.One of: enterprise (Enterprise (IT, cloud, SaaS, network)), mobile (Mobile (Android and iOS)), ics (ICS (industrial control systems)). Default: enterprise.
ATT&CK entryattack_idtextRequired: The entry whose relationships to walk: a technique, group, software, campaign, mitigation or data source. A value carried over from an earlier step may instead be a bare ATT&CK ID or a STIX id.
Link typesrelationship_typeslist: Only these kinds of link. Leave every option unchecked to follow all of them.One or more of: uses (Uses (group or software → technique)), mitigates (Mitigates (mitigation → technique)), detects (Detects (detection strategy → technique)), subtechnique-of (Sub-technique of), attributed-to (Attributed to (campaign → group)), revoked-by (Revoked by (replaced by)).
Object typesobject_typeslist: Which kinds of ATT&CK object to include. Leave every option unchecked to cover all of them.One or more of: technique (Techniques), tactic (Tactics), group (Groups), software (Software (malware and tools)), campaign (Campaigns), mitigation (Mitigations), data_component (Data components), data_source (Data sources (retired in ATT&CK v19)), detection_strategy (Detection strategies), asset (Assets (ICS only)).
Include procedure examplesinclude_procedure_examplestrue/false: Keep MITRE's sentence describing how a group or piece of software actually used a technique. Turn it off for a shorter answer that is just the links.Default: true.
Maximum resultslimitnumber: How many related objects to return. A widely used technique can be linked to hundreds; the answer always carries the true total beside them.From 1 to 1000. Default: 50.

Outputs

attack_versiontext: The ATT&CK release the answer was read from, for example '19.2'. Two identical questions asked either side of a release can differ, so every answer says which one it read.
countnumber: How many entries this answer carries.
counts_by_kindobject: How many related objects of each kind were returned, so a step can branch without walking the groups.
domaintext: The ATT&CK domain that was read: enterprise, mobile or ics.
domain_titletext: That domain's full name, for example 'Enterprise ATT&CK'.
groupslist: The related objects, grouped by how they are linked and what they are, so 'mitigations' and 'groups' read as different answers rather than one undifferentiated list.
objectobject: The entry whose relationships were walked.
total_countnumber: How many entries matched in all, before any cap was applied.
truncatedtrue/false: True when more entries matched than were returned.

Example output

{
  "attack_version": "19.2",
  "count": 2,
  "counts_by_kind": {
    "group": 1,
    "mitigation": 1
  },
  "domain": "enterprise",
  "domain_title": "Enterprise ATT&CK",
  "groups": [
    {
      "count": 1,
      "kind": "mitigation",
      "objects": [
        {
          "attack_id": "M1042",
          "deprecated": false,
          "direction": "incoming",
          "kind": "mitigation",
          "name": "Disable or Remove Feature or Program",
          "relationship_type": "mitigates",
          "revoked": false,
          "stix_id": "course-of-action--e8242a33-26be-4d5a-93be-1c1de9d3c1a2",
          "url": "https://attack.mitre.org/mitigations/M1042"
        }
      ],
      "relationship_type": "mitigates",
      "total_count": 5
    },
    {
      "count": 1,
      "kind": "group",
      "objects": [
        {
          "attack_id": "G0016",
          "deprecated": false,
          "direction": "incoming",
          "kind": "group",
          "name": "APT29",
          "procedure_example": "APT29 has used PowerShell to execute commands and payloads on compromised hosts.",
          "relationship_type": "uses",
          "revoked": false,
          "stix_id": "intrusion-set--899ce53f-13a0-479b-a0e4-67d46e241542",
          "url": "https://attack.mitre.org/groups/G0016"
        }
      ],
      "relationship_type": "uses",
      "total_count": 25
    }
  ],
  "object": {
    "attack_id": "T1059.001",
    "kind": "technique",
    "name": "PowerShell",
    "stix_id": "attack-pattern--970a3432-3237-47ad-bcca-7d8cbb217736",
    "url": "https://attack.mitre.org/techniques/T1059/001"
  },
  "total_count": 214,
  "truncated": true
}

List software

List the malware and tools ATT&CK tracks in a domain. Malware is adversary-built code; tools are legitimate software adversaries repurpose, such as PsExec. Filter to one or the other, narrow by platform, and search by name, alias or description. No API key required.

Inputs

ATT&CK domaindomaintext: Which of the three ATT&CK knowledge bases to read. Enterprise covers IT, cloud, SaaS and network devices; Mobile covers Android and iOS; ICS covers industrial control systems. They are separate matrices with their own techniques and IDs, so a technique in one is not in the others.One of: enterprise (Enterprise (IT, cloud, SaaS, network)), mobile (Mobile (Android and iOS)), ics (ICS (industrial control systems)). Default: enterprise.
Software typesoftware_typetext: Whether to include both, only adversary-built malware, or only the legitimate tools adversaries repurpose.One of: all (Malware and tools), malware (Malware only), tool (Tools only). Default: all.
Platformsplatformslist: Only entries that apply to at least one of these platforms, such as Windows or Containers. The list is read from the chosen domain, so it offers what that matrix actually names. Leave every option unchecked to include them all.
Text containsquerytext: Only entries whose ATT&CK ID, name, alias or description contain this text. Not case sensitive. Leave it empty for all of them.
Include retired entriesinclude_inactivetrue/false: ATT&CK never deletes: a technique that has been superseded stays in the matrix marked revoked, and one that no longer describes anything real stays marked deprecated. Both are left out unless this is turned on, which is what you want when auditing coverage of older content.Default: false.
Order bysorttext: How to order the results. ATT&CK ID order is the numeric one a reader expects, so T1002 comes before T1059 and each sub-technique sits directly under its parent.One of: attack_id_asc (ATT&CK ID (lowest first)), attack_id_desc (ATT&CK ID (highest first)), name_asc (Name (A to Z)), name_desc (Name (Z to A)), modified_desc (Last updated (newest first)), created_desc (Added to ATT&CK (newest first)). Default: attack_id_asc.
Maximum resultslimitnumber: How many entries to return. The answer also carries the total number that matched, so a capped list never reads as a complete one.From 1 to 500. Default: 25.
Skipoffsetnumber: How many matching entries to skip before returning any, for reading a long list a page at a time. Leave it at 0 for the first page.From 0 to 20000. Default: 0.

Outputs

attack_versiontext: The ATT&CK release the answer was read from, for example '19.2'. Two identical questions asked either side of a release can differ, so every answer says which one it read.
countnumber: How many entries this answer carries.
domaintext: The ATT&CK domain that was read: enterprise, mobile or ics.
domain_titletext: That domain's full name, for example 'Enterprise ATT&CK'.
offsetnumber: How many matching entries were skipped before this page.
softwarelist: The matching malware and tools.
software_typetext: The software type filter that was applied.
sorttext: The order the entries were returned in.
total_countnumber: How many entries matched in all, before any cap was applied.
truncatedtrue/false: True when more entries matched than were returned.

Example output

{
  "attack_version": "19.2",
  "count": 1,
  "domain": "enterprise",
  "domain_title": "Enterprise ATT&CK",
  "offset": 0,
  "software": [
    {
      "aliases": [
        "Cobalt Strike"
      ],
      "attack_id": "S0154",
      "contributors": [],
      "created": "2017-05-31T21:33:26.565Z",
      "deprecated": false,
      "description": "Cobalt Strike is a commercial, full-featured penetration testing tool.",
      "domains": [
        "enterprise-attack"
      ],
      "is_family": true,
      "kind": "software",
      "modified": "2026-04-15T19:22:11.104Z",
      "name": "Cobalt Strike",
      "platforms": [
        "Windows",
        "Linux",
        "macOS"
      ],
      "references": [],
      "revoked": false,
      "software_type": "malware",
      "stix_id": "malware--a7881f21-e978-4fe4-af56-92c9416a2616",
      "stix_type": "malware",
      "url": "https://attack.mitre.org/software/S0154",
      "version": "1.14"
    }
  ],
  "software_type": "all",
  "sort": "attack_id_asc",
  "total_count": 828,
  "truncated": true
}

List tactics

List a domain's tactics (the adversary goals that make up the columns of the ATT&CK matrix, from Reconnaissance through to Impact) in the matrix's own left-to-right order, with how many techniques sit under each. This is the top level of ATT&CK, and the natural first step when walking the matrix. No API key required.

Inputs

ATT&CK domaindomaintext: Which of the three ATT&CK knowledge bases to read. Enterprise covers IT, cloud, SaaS and network devices; Mobile covers Android and iOS; ICS covers industrial control systems. They are separate matrices with their own techniques and IDs, so a technique in one is not in the others.One of: enterprise (Enterprise (IT, cloud, SaaS, network)), mobile (Mobile (Android and iOS)), ics (ICS (industrial control systems)). Default: enterprise.

Outputs

attack_versiontext: The ATT&CK release the answer was read from, for example '19.2'. Two identical questions asked either side of a release can differ, so every answer says which one it read.
countnumber: How many entries this answer carries.
domaintext: The ATT&CK domain that was read: enterprise, mobile or ics.
domain_titletext: That domain's full name, for example 'Enterprise ATT&CK'.
offsetnumber: How many matching entries were skipped before this page.
tacticslist: The domain's tactics, in matrix order.
total_countnumber: How many entries matched in all, before any cap was applied.
truncatedtrue/false: True when more entries matched than were returned.

Example output

{
  "attack_version": "19.2",
  "count": 15,
  "domain": "enterprise",
  "domain_title": "Enterprise ATT&CK",
  "offset": 0,
  "tactics": [
    {
      "aliases": [],
      "attack_id": "TA0002",
      "contributors": [],
      "created": "2018-10-17T00:14:20.652Z",
      "deprecated": false,
      "description": "The adversary is trying to run malicious code.",
      "domains": [
        "enterprise-attack"
      ],
      "kind": "tactic",
      "modified": "2025-04-25T14:45:35.841Z",
      "name": "Execution",
      "platforms": [],
      "references": [],
      "revoked": false,
      "shortname": "execution",
      "stix_id": "x-mitre-tactic--4ca45d45-df4d-4613-8980-bac22d278fa5",
      "stix_type": "x-mitre-tactic",
      "technique_count": 64,
      "url": "https://attack.mitre.org/tactics/TA0002",
      "version": "1.0"
    }
  ],
  "total_count": 15,
  "truncated": false
}

List techniques

Browse a domain's techniques through every filter ATT&CK supports: tactic, platform, whether to include sub-techniques, and free text over IDs, names and descriptions. Order the results and page through them. This is the general-purpose browse action: 'every macOS technique under Credential Access' is one step. No API key required.

Inputs

ATT&CK domaindomaintext: Which of the three ATT&CK knowledge bases to read. Enterprise covers IT, cloud, SaaS and network devices; Mobile covers Android and iOS; ICS covers industrial control systems. They are separate matrices with their own techniques and IDs, so a technique in one is not in the others.One of: enterprise (Enterprise (IT, cloud, SaaS, network)), mobile (Mobile (Android and iOS)), ics (ICS (industrial control systems)). Default: enterprise.
Tactictactictext: Only techniques filed under this tactic (the adversary goal, such as Credential Access). The list is read from the chosen domain's own matrix, in its left-to-right order, with the number of techniques beside each one. Leave it unset for every tactic.
Platformsplatformslist: Only entries that apply to at least one of these platforms, such as Windows or Containers. The list is read from the chosen domain, so it offers what that matrix actually names. Leave every option unchecked to include them all.
Technique leveltechnique_typetext: Whether to include both levels of the technique tree, only the top-level techniques (T1059), or only the sub-techniques that refine them (T1059.001).One of: all (All techniques), parent (Top-level techniques only), sub (Sub-techniques only). Default: all.
Text containsquerytext: Only entries whose ATT&CK ID, name, alias or description contain this text. Not case sensitive. Leave it empty for all of them.
Include retired entriesinclude_inactivetrue/false: ATT&CK never deletes: a technique that has been superseded stays in the matrix marked revoked, and one that no longer describes anything real stays marked deprecated. Both are left out unless this is turned on, which is what you want when auditing coverage of older content.Default: false.
Order bysorttext: How to order the results. ATT&CK ID order is the numeric one a reader expects, so T1002 comes before T1059 and each sub-technique sits directly under its parent.One of: attack_id_asc (ATT&CK ID (lowest first)), attack_id_desc (ATT&CK ID (highest first)), name_asc (Name (A to Z)), name_desc (Name (Z to A)), modified_desc (Last updated (newest first)), created_desc (Added to ATT&CK (newest first)). Default: attack_id_asc.
Maximum resultslimitnumber: How many entries to return. The answer also carries the total number that matched, so a capped list never reads as a complete one.From 1 to 500. Default: 25.
Skipoffsetnumber: How many matching entries to skip before returning any, for reading a long list a page at a time. Leave it at 0 for the first page.From 0 to 20000. Default: 0.

Outputs

attack_versiontext: The ATT&CK release the answer was read from, for example '19.2'. Two identical questions asked either side of a release can differ, so every answer says which one it read.
countnumber: How many entries this answer carries.
domaintext: The ATT&CK domain that was read: enterprise, mobile or ics.
domain_titletext: That domain's full name, for example 'Enterprise ATT&CK'.
offsetnumber: How many matching entries were skipped before this page.
sorttext: The order the entries were returned in.
techniqueslist: The matching techniques.
total_countnumber: How many entries matched in all, before any cap was applied.
truncatedtrue/false: True when more entries matched than were returned.

Example output

{
  "attack_version": "19.2",
  "count": 1,
  "domain": "enterprise",
  "domain_title": "Enterprise ATT&CK",
  "offset": 0,
  "sort": "attack_id_asc",
  "techniques": [
    {
      "aliases": [],
      "attack_id": "T1059.001",
      "contributors": [
        "Praetorian"
      ],
      "created": "2020-03-09T14:35:22.156Z",
      "deprecated": false,
      "description": "Adversaries may abuse PowerShell commands and scripts for execution.",
      "domains": [
        "enterprise-attack"
      ],
      "impact_types": [],
      "is_subtechnique": true,
      "kind": "technique",
      "modified": "2026-05-12T15:12:00.625Z",
      "name": "PowerShell",
      "parent_technique_id": "T1059",
      "platforms": [
        "Windows"
      ],
      "references": [
        {
          "description": "Microsoft. (2017). PowerShell Documentation.",
          "external_id": null,
          "source_name": "Microsoft PowerShell",
          "url": "https://learn.microsoft.com/powershell/"
        }
      ],
      "remote_support": true,
      "revoked": false,
      "stix_id": "attack-pattern--970a3432-3237-47ad-bcca-7d8cbb217736",
      "stix_type": "attack-pattern",
      "tactic_shortnames": [
        "execution"
      ],
      "tactics": [
        "Execution"
      ],
      "url": "https://attack.mitre.org/techniques/T1059/001",
      "version": "1.6"
    }
  ],
  "total_count": 64,
  "truncated": true
}

Search ATT&CK

Search a whole domain for a word, name, alias or ATT&CK ID and get the best matches first, across techniques, groups, software, campaigns, mitigations, data sources and detection strategies at once. A hit on the ATT&CK ID outranks one on the name, which outranks an alias, which outranks a word buried in a description, and each result says which fields it matched on. Use it when you have a term from a report rather than an ID. No API key required.

Inputs

ATT&CK domaindomaintext: Which of the three ATT&CK knowledge bases to read. Enterprise covers IT, cloud, SaaS and network devices; Mobile covers Android and iOS; ICS covers industrial control systems. They are separate matrices with their own techniques and IDs, so a technique in one is not in the others.One of: enterprise (Enterprise (IT, cloud, SaaS, network)), mobile (Mobile (Android and iOS)), ics (ICS (industrial control systems)). Default: enterprise.
Search forquerytextRequired: The text to look for. Matched against ATT&CK IDs, names, aliases and descriptions. Not case sensitive.
Object typesobject_typeslist: Which kinds of ATT&CK object to include. Leave every option unchecked to cover all of them.One or more of: technique (Techniques), tactic (Tactics), group (Groups), software (Software (malware and tools)), campaign (Campaigns), mitigation (Mitigations), data_component (Data components), data_source (Data sources (retired in ATT&CK v19)), detection_strategy (Detection strategies), asset (Assets (ICS only)).
Include retired entriesinclude_inactivetrue/false: ATT&CK never deletes: a technique that has been superseded stays in the matrix marked revoked, and one that no longer describes anything real stays marked deprecated. Both are left out unless this is turned on, which is what you want when auditing coverage of older content.Default: false.
Maximum resultslimitnumber: How many matches to return, best first. The answer also carries how many matched in all.From 1 to 200. Default: 25.

Outputs

attack_versiontext: The ATT&CK release the answer was read from, for example '19.2'. Two identical questions asked either side of a release can differ, so every answer says which one it read.
countnumber: How many entries this answer carries.
domaintext: The ATT&CK domain that was read: enterprise, mobile or ics.
domain_titletext: That domain's full name, for example 'Enterprise ATT&CK'.
object_typeslist: The kinds of object that were searched.
offsetnumber: How many matching entries were skipped before this page.
querytext: The text that was searched for.
resultslist: The matches, best first.
total_countnumber: How many entries matched in all, before any cap was applied.
truncatedtrue/false: True when more entries matched than were returned.

Example output

{
  "attack_version": "19.2",
  "count": 1,
  "domain": "enterprise",
  "domain_title": "Enterprise ATT&CK",
  "object_types": [
    "technique",
    "group",
    "software"
  ],
  "offset": 0,
  "query": "Cozy Bear",
  "results": [
    {
      "aliases": [
        "APT29",
        "Cozy Bear",
        "Midnight Blizzard",
        "NOBELIUM"
      ],
      "attack_id": "G0016",
      "contributors": [],
      "created": "2017-05-31T21:31:52.748Z",
      "deprecated": false,
      "description": "APT29 is a threat group attributed to Russia's Foreign Intelligence Service.",
      "domains": [
        "enterprise-attack"
      ],
      "kind": "group",
      "matched_fields": [
        "aliases"
      ],
      "modified": "2026-07-31T18:47:44.949Z",
      "name": "APT29",
      "platforms": [],
      "references": [],
      "revoked": false,
      "score": 25,
      "stix_id": "intrusion-set--899ce53f-13a0-479b-a0e4-67d46e241542",
      "stix_type": "intrusion-set",
      "url": "https://attack.mitre.org/groups/G0016",
      "version": "6.2"
    }
  ],
  "total_count": 3,
  "truncated": true
}

ActionsCopy Anchor Link

Export techniques as CSVCopy Anchor Link

Inputs

Outputs

Get a campaignCopy Anchor Link

Inputs

Outputs

Get a groupCopy Anchor Link

Inputs

Outputs

Get a mitigationCopy Anchor Link

Inputs

Outputs

Get a tacticCopy Anchor Link

Inputs

Outputs

Get a techniqueCopy Anchor Link

Inputs

Outputs

Get domain detailsCopy Anchor Link

Inputs

Outputs

Get raw STIX objectCopy Anchor Link

Inputs

Outputs

Get softwareCopy Anchor Link

Inputs

Outputs

List ATT&CK domainsCopy Anchor Link

Inputs

Outputs

List campaignsCopy Anchor Link

Inputs

Outputs

List data componentsCopy Anchor Link

Inputs

Outputs

List groupsCopy Anchor Link

Inputs

Outputs

List mitigationsCopy Anchor Link

Inputs

Outputs

List recent changesCopy Anchor Link

Inputs

Outputs

List related objectsCopy Anchor Link

Inputs

Outputs

List softwareCopy Anchor Link

Inputs

Outputs

List tacticsCopy Anchor Link

Inputs

Outputs

List techniquesCopy Anchor Link

Inputs

Outputs

Search ATT&CKCopy Anchor Link

Inputs

Outputs

On this page

Actions

Export techniques as CSV

Get a campaign

Get a group

Get a mitigation

Get a tactic

Get a technique

Get domain details

Get raw STIX object

Get software

List ATT&CK domains

List campaigns

List data components

List groups

List mitigations

List recent changes

List related objects

List software

List tactics

List techniques

Search ATT&CK