In MITRE ATT&CK Enterprise data, version 19.2, the most widely mapped technique is Command and Scripting Interpreter. It is linked to 124 of 172 groups with technique links, or 72.1 percent. User Execution (99 groups) and Phishing (98) follow. The spread is wide: 72 techniques are used by at least 10 percent of groups, while 32 are used by exactly one.
- 72.1%Groups mapped to Command and Scripting Interpreter (124 of 172)Source: MITRE ATT&CK Enterprise, version 19.2 (modified 2026-08-05)
- 72Techniques used by at least 10% of groupsSource: MITRE ATT&CK Enterprise, version 19.2 (modified 2026-08-05)
- 32Techniques used by only one groupSource: MITRE ATT&CK Enterprise, version 19.2 (modified 2026-08-05)
- 16Median techniques mapped per groupSource: MITRE ATT&CK Enterprise, version 19.2 (modified 2026-08-05)
Which ATT&CK techniques do the most groups use?
The table lists the ten techniques with the most groups. A group counts once per technique, even if it uses several sub-techniques of it.
| Technique | Groups | Share of 172 | Tactic in this version |
|---|---|---|---|
| T1059 Command and Scripting Interpreter | 124 | 72.1% | execution |
| T1204 User Execution | 99 | 57.6% | execution |
| T1566 Phishing | 98 | 57.0% | initial-access |
| T1027 Obfuscated Files or Information | 93 | 54.1% | stealth |
| T1036 Masquerading | 89 | 51.7% | stealth |
| T1105 Ingress Tool Transfer | 88 | 51.2% | command-and-control |
| T1588 Obtain Capabilities | 87 | 50.6% | resource-development |
| T1078 Valid Accounts | 66 | 38.4% | stealth, persistence, privilege-escalation, initial-access |
| T1583 Acquire Infrastructure | 65 | 37.8% | resource-development |
| T1071 Application Layer Protocol | 65 | 37.8% | command-and-control |
Seven techniques sit above 50 percent. Two of them are about getting a user to run something: User Execution and Phishing. Valid Accounts is the first technique below the halfway mark, at 38.4 percent, and ATT&CK lists it under four tactics.
Which sub-techniques lead?
Counted at sub-technique level, Malicious File (T1204.002) leads with 86 groups. PowerShell (T1059.001) has 85, Tool (T1588.002) 82 and Spearphishing Attachment (T1566.001) 78. Windows Command Shell (T1059.003) has 73.
The next three are Match Legitimate Resource Name or Location (T1036.005) with 63, Web Protocols (T1071.001) with 57 and Registry Run Keys / Startup Folder (T1547.001) with 57. The sub-technique view shows what sits inside the parent counts. Most of Command and Scripting Interpreter is PowerShell (85 of 124) and Windows Command Shell (73 of 124).
How much of ATT&CK is shared, and how much is rare?
Of 222 techniques in this version, 203 are used by at least one group. Counting the other side, 19 techniques have no group mapped to them. Use is concentrated: 72 techniques reach at least 10 percent of groups, and 32 reach exactly one.
So the matrix has a shared core and a long tail. The core is a small part of the 222 techniques. The tail is where a single group’s mapped behavior sits. This read follows the counts only. It does not say which part matters more to a given organization. The ten rows in the table are all above 37 percent, so the head of the distribution is broad, but it still covers only a fraction of the 203 techniques that have any group at all.
Which tactics do the techniques fall under?
We also counted tactic pairs, each pairing of a mapped technique with a tactic. Discovery has the largest share at 13.2 percent (586 pairs). Stealth follows at 13.0 percent (574), then execution at 10.7 percent (474) and persistence at 9.1 percent (403).
| Tactic | Pairs | Share |
|---|---|---|
| discovery | 586 | 13.2% |
| stealth | 574 | 13.0% |
| execution | 474 | 10.7% |
| defense-impairment | 152 | 3.4% |
| exfiltration | 91 | 2.1% |
| impact | 86 | 1.9% |
Names are as the data gives them. This version of ATT&CK uses stealth and defense-impairment as tactic names. Impact has the smallest share, 1.9 percent (86 pairs), and exfiltration has 2.1 percent (91). Because a technique can sit under several tactics, the shares describe how mapped techniques spread across the matrix, not how many attacks reach each stage.
How many techniques does a typical group map?
The median group maps 16 techniques. The range runs from 1 to 87. Sixteen groups map 50 or more, and 59 map 10 or fewer. The group with the most mapped techniques is Kimsuky with 87, followed by APT28 with 73 and Lazarus Group with 69.
A few heavily documented groups pull the totals up, and many groups have thin mappings. The top-technique shares therefore blend a few rich profiles with many short ones. For a profile of a single actor, see Kimsuky. For how origin changes the mix, see groups by attributed origin, and for tooling see software shared across groups.
Method
We used the MITRE ATT&CK Enterprise STIX data from the attack-stix-data repository, file enterprise-attack.json, ATT&CK version 19.2 (modified 2026-08-05), downloaded 2026-10-09. We kept groups (intrusion sets) that are not revoked or deprecated: 176, of which 172 have technique links. For each technique we counted the groups with a “uses” link to it. Sub-techniques roll up to their parent, so a group counts once per parent technique. Shares are out of 172. For a related list focused on one tactic, see initial access techniques. For background on the framework, see MITRE ATT&CK.
Limits
ATT&CK describes groups as activity clusters, and its technique mappings are a subset of publicly reported use. They do not represent all possible technique use. Mapping effort is uneven between groups, so a low count can mean little public reporting rather than little activity. A technique used by many groups is not automatically the best place to defend, and a rare technique is not automatically minor. The data shows what has been reported and mapped, not how often an attack succeeds. One question it can support: which of the widely shared techniques in the table do your own detections already cover?