MITRE ATT&CK matrix

The MITRE ATT&CK (Enterprise) tactics and techniques that show up in Hack The Box machines. Each technique takes you to the machines where you can practice it, with the exact minute of the video, to our guides and to ready-to-copy commands.

70 techniques · 277 machines to practice on · 414 commands

Reconnaissance TA0043 · 2 techniques

Gathering information about the target before attacking it: directories, subdomains, users and technologies.

Initial Access TA0001 · 4 techniques

Getting the first foothold: almost always a vulnerable web application or a set of valid credentials.

Execution TA0002 · 5 techniques

Running code on the victim: shells, PowerShell, WMI, services or scheduled tasks.

Persistence TA0003 · 4 techniques

Keeping access even if the machine reboots or passwords change.

Privilege Escalation TA0004 · 14 techniques

Going from an unprivileged user to root, SYSTEM or domain admin.

Defense Evasion TA0005 · 3 techniques

Getting around antivirus, AMSI, AppLocker and security controls so the attack is not stopped.

Credential Access TA0006 · 22 techniques

Stealing passwords, hashes, tickets and certificates: the most common tactic in Active Directory.

Discovery TA0007 · 5 techniques

Learning the environment from the inside: services, shares, users, groups and domain trusts.

Lateral Movement TA0008 · 5 techniques

Jumping from one machine or user to another with stolen credentials, hashes or tickets.

Collection TA0009 · 2 techniques

Gathering data of interest: code repositories, network configuration and traffic.

Command and Control TA0011 · 4 techniques

Keeping communication with the victim: tunnels, proxies, tool transfer and C2.

Each technique appears in the column of its main tactic; its page lists every tactic it belongs to.

Would you rather search by tool? Tools →

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. Descriptions and the mapping to machines are our own.