# MITRE ATT&CK — Top 50 Techniques Reference

## Initial Access
- T1190 — Exploit Public-Facing Application
- T1133 — External Remote Services
- T1566.001 — Phishing: Spearphishing Attachment
- T1566.002 — Phishing: Spearphishing Link
- T1078 — Valid Accounts
- T1195 — Supply Chain Compromise
- T1199 — Trusted Relationship

## Execution
- T1059.001 — Command and Scripting Interpreter: PowerShell
- T1059.003 — Command and Scripting Interpreter: Windows Command Shell
- T1059.004 — Command and Scripting Interpreter: Unix Shell
- T1204.001 — User Execution: Malicious Link
- T1204.002 — User Execution: Malicious File
- T1053 — Scheduled Task/Job

## Persistence
- T1547.001 — Boot or Logon Autostart Execution: Registry Run Keys
- T1136 — Create Account
- T1543 — Create or Modify System Process
- T1505.003 — Server Software Component: Web Shell
- T1098 — Account Manipulation

## Privilege Escalation
- T1068 — Exploitation for Privilege Escalation
- T1548.002 — Abuse Elevation Control Mechanism: Bypass UAC
- T1134 — Access Token Manipulation

## Defense Evasion
- T1027 — Obfuscated Files or Information
- T1070 — Indicator Removal
- T1036 — Masquerading
- T1562.001 — Impair Defenses: Disable or Modify Tools
- T1140 — Deobfuscate/Decode Files or Information
- T1218 — System Binary Proxy Execution

## Credential Access
- T1003 — OS Credential Dumping
- T1110 — Brute Force
- T1555 — Credentials from Password Stores
- T1552 — Unsecured Credentials
- T1557 — Adversary-in-the-Middle

## Discovery
- T1083 — File and Directory Discovery
- T1082 — System Information Discovery
- T1016 — System Network Configuration Discovery
- T1046 — Network Service Discovery
- T1087 — Account Discovery

## Lateral Movement
- T1021.001 — Remote Services: Remote Desktop Protocol
- T1021.002 — Remote Services: SMB/Windows Admin Shares
- T1021.004 — Remote Services: SSH
- T1570 — Lateral Tool Transfer

## Collection
- T1005 — Data from Local System
- T1113 — Screen Capture
- T1056.001 — Input Capture: Keylogging
- T1560 — Archive Collected Data

## Command and Control
- T1071.001 — Application Layer Protocol: Web Protocols
- T1105 — Ingress Tool Transfer
- T1572 — Protocol Tunneling
- T1090 — Proxy

## Exfiltration
- T1041 — Exfiltration Over C2 Channel
- T1567 — Exfiltration Over Web Service

## Impact
- T1486 — Data Encrypted for Impact (Ransomware)
- T1489 — Service Stop
