T1189 Stage 03
Drive-by Compromise
Drive-by Compromise is a way for attackers to gain access to a computer when a person visits a website during normal browsing.
- Initial Access
Technique
Threat Library
Techniques. Explained Plainly.
The attack techniques behind most intrusions, with a real example, how to detect them and how to defend.
03
Initial Access
3 entriesT1190 Stage 03
Exploit Public-Facing Application
Exploit Public-Facing Application is when an attacker abuses a weakness in a system that is reachable from the Internet to get into a network.
- Initial Access
Technique
T1566 Stage 03
Phishing (T1566): ATT&CK Technique
Phishing is when an attacker sends a message that tricks someone into opening a malicious file, following a link or giving away a password.
- Initial Access
Technique
04
Execution
3 entriesT1059 Stage 04
Command And Scripting Interpreter
Command and Scripting Interpreter is a technique where an attacker uses the built-in shells and scripting languages of a system to run commands, scripts or programs.
- Execution
Technique
T1053 Stage 04
Scheduled Task/Job
Scheduled Task/Job is a technique where an attacker uses the task scheduling feature built into an operating system.
- Execution
Technique
T1204 Stage 04
User Execution
User Execution is when an attacker gets a person to run malicious code for them.
- Execution
Technique
05
Persistence
4 entriesT1547 Stage 05
Boot Or Logon Autostart Execution
Boot or logon autostart execution is when an attacker sets up a computer so that their program starts by itself when the system boots or a user logs on.
- Persistence
Technique
T1133 Stage 05
External Remote Services
External Remote Services is a technique where an attacker uses a remote access service that faces the internet, such as a VPN or Citrix, to enter a network or to keep access to it.
- Persistence
Technique
T1547.001 Stage 05
Registry Run Keys / Startup Folder
Windows can start programs on its own when a user logs in.
- Persistence
Technique
T1505.003 Stage 05
Server Software Component: Web Shell (T1505.003)
A web shell is a small script that an attacker places on a web server.
- Persistence
Technique
06
Privilege Escalation
1 entryT1068 Stage 06
Exploitation For Privilege Escalation
Exploitation for privilege escalation is when an attacker uses a flaw in software to gain higher permissions than they started with.
- Privilege Escalation
Technique
07
Stealth
9 entriesT1140 Stage 07
Deobfuscate/Decode Files Or Information
Deobfuscate/Decode Files or Information is a technique where attackers unpack, decode or decrypt content they had hidden earlier, so it can be used on the target system.
- Stealth
Technique
T1574.001 Stage 07
DLL
DLL hijacking is when an attacker abuses the shared library files (DLLs) that Windows programs load.
- Stealth
Technique
T1564 Stage 07
Hide Artifacts
Hide Artifacts is a technique where attackers hide the traces of their activity, such as files, folders, user accounts or running tasks.
- Stealth
Technique
T1070 Stage 07
Indicator Removal
Indicator Removal is a technique where an attacker deletes or changes the traces that their activity leaves behind.
- Stealth
Technique
T1036 Stage 07
Masquerading
Masquerading is when an attacker changes how a file, program, service or account looks so it seems legitimate.
- Stealth
Technique
T1027 Stage 07
Obfuscated Files Or Information
Obfuscated Files or Information is a technique where an attacker hides the real content of a file, program or command by encrypting, encoding or packing it.
- Stealth
Technique
T1055 Stage 07
Process Injection
Process injection is when an attacker runs their own code inside another program that is already running.
- Stealth
Technique
T1078 Stage 07
Valid Accounts
Valid Accounts means an attacker logs in with real credentials that were stolen or bought.
- Stealth
Technique
T1497 Stage 07
Virtualization/Sandbox Evasion
Virtualization/Sandbox Evasion is when malware checks whether it is running inside a virtual machine or an analysis sandbox, and changes what it does if it is.
- Stealth
Technique
08
Defense Impairment
1 entryT1112 Stage 08
Modify Registry
Modify Registry is a technique where an attacker changes settings in the Windows Registry.
- Defense Impairment
Technique
09
Credential Access
2 entriesT1555 Stage 09
Credentials From Password Stores
Credentials from password stores is when an attacker looks in the places where passwords are saved and takes the logins they find.
- Credential Access
Technique
T1003 Stage 09
OS Credential Dumping
OS credential dumping is when an attacker pulls account login material out of a computer.
- Credential Access
Technique
10
Discovery
4 entriesT1087 Stage 10
Account Discovery
Account Discovery is when an attacker builds a list of valid accounts, usernames or email addresses on a system or inside a compromised environment.
- Discovery
Technique
T1083 Stage 10
File And Directory Discovery
File and Directory Discovery is a technique where an attacker lists files and folders on a system or a network share to learn what is there.
- Discovery
Technique
T1057 Stage 10
Process Discovery
Process Discovery is a technique where attackers list the programs running on a system.
- Discovery
Technique
T1082 Stage 10
System Information Discovery
System Information Discovery is when an attacker collects details about a device, such as its operating system version, patch level and hardware.
- Discovery
Technique
11
Lateral Movement
1 entryT1021 Stage 11
Remote Services
Remote Services is when an attacker uses a valid account to log in to a service built for remote access, such as SSH, RDP or VNC.
- Lateral Movement
Technique
12
Collection
3 entriesT1560 Stage 12
Archive Collected Data
Archive collected data is when an attacker packs stolen files into compressed or encrypted bundles before sending them out.
- Collection
Technique
T1005 Stage 12
Data From Local System
Data from local system is when an attacker searches a computer they already control to find files and other data worth taking.
- Collection
Technique
T1056 Stage 12
Input Capture
Input capture is when an attacker records what a user types or enters, to steal passwords or other information.
- Collection
Technique
13
Command and Control
3 entriesT1071 Stage 13
Application Layer Protocol
Application Layer Protocol is a technique where attackers talk to a system they control using ordinary network protocols, such as those used for web browsing, file transfer, email or DNS.
- Command and Control
Technique
T1573 Stage 13
Encrypted Channel
Encrypted Channel is a technique where attackers encrypt the traffic they use to control a compromised system.
- Command and Control
Technique
T1105 Stage 13
Ingress Tool Transfer
Ingress Tool Transfer is a technique where attackers bring tools or other files from outside into a network they have already broken into.
- Command and Control
Technique
14
Exfiltration
1 entryT1041 Stage 14
Exfiltration Over C2 Channel
Exfiltration over a C2 channel is when an attacker sends stolen data out through the same channel they already use to control the infected system.
- Exfiltration
Technique
15
Impact
1 entryT1486 Stage 15
Data Encrypted For Impact
Data Encrypted for Impact is when attackers encrypt files or whole systems so the owner can no longer use them, and then hold back the key.
- Impact
Technique
Nothing matches. Try another word or filter.
More In The Library.
Counts as of 17 October 2026
- 101 Guides Short, plain guides to the main ideas in external threat protection. 21 Guides
- Glossary Security terms in plain words, A to Z, each with its own page. 135 Terms
- APT Groups State-backed hacking groups, who they go after and how they get in. 49 Profiles
- Ransomware Groups How each group gets in, how it extorts and what stops it. 24 Profiles
- Malware And Tools Malware families and abused tools, what they do and how to spot them. 46 Profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 Profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 Profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 Profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 Profiles
- Agentic Security Best practices for securing AI agents and for using agents in security work, from the main public frameworks. 12 Articles
- How To Defend A playbook for every alert: the first 24 hours, the checklist and the fix. 18 Playbooks
Brandefense
Stay Ahead Of Digital Threats.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.