MITRE ATT&CK
All 222 techniques across 15 tactics in MITRE ATT&CK Enterprise v19.1, each mapped to how TurboPentest tests for it.
ATT&CK covers the full adversary lifecycle, from reconnaissance through impact, including many techniques (lateral movement, persistence on already-compromised hosts, and more) that a black-box web pentest does not perform. Each technique page states plainly whether TurboPentest tests for it or whether it falls to IntegSec's manual engagement coverage.
Tactics
- Reconnaissance
12 techniques
- Resource Development
9 techniques
- Initial Access
11 techniques
- Execution
20 techniques
- Persistence
22 techniques
- Privilege Escalation
13 techniques
- Stealth
30 techniques
- Defense Impairment
18 techniques
- Credential Access
17 techniques
- Discovery
34 techniques
- Lateral Movement
9 techniques
- Collection
17 techniques
- Command and Control
18 techniques
- Exfiltration
9 techniques
- Impact
15 techniques
Browse all 222 techniques
Every technique in MITRE ATT&CK v19.1, in id order.
- T1001: Data Obfuscation
- T1003: OS Credential Dumping
- T1005: Data from Local System
- T1006: Direct Volume Access
- T1007: System Service Discovery
- T1008: Fallback Channels
- T1010: Application Window Discovery
- T1011: Exfiltration Over Other Network Medium
- T1012: Query Registry
- T1014: Rootkit
- T1016: System Network Configuration Discovery
- T1018: Remote System Discovery
- T1020: Automated Exfiltration
- T1021: Remote Services
- T1025: Data from Removable Media
- T1027: Obfuscated Files or Information
- T1029: Scheduled Transfer
- T1030: Data Transfer Size Limits
- T1033: System Owner/User Discovery
- T1036: Masquerading
- T1037: Boot or Logon Initialization Scripts
- T1039: Data from Network Shared Drive
- T1040: Network Sniffing
- T1041: Exfiltration Over C2 Channel
- T1046: Network Service Discovery
- T1047: Windows Management Instrumentation
- T1048: Exfiltration Over Alternative Protocol
- T1049: System Network Connections Discovery
- T1052: Exfiltration Over Physical Medium
- T1053: Scheduled Task/Job
- T1055: Process Injection
- T1056: Input Capture
- T1057: Process Discovery
- T1059: Command and Scripting Interpreter
- T1068: Exploitation for Privilege Escalation
- T1069: Permission Groups Discovery
- T1070: Indicator Removal
- T1071: Application Layer Protocol
- T1072: Software Deployment Tools
- T1074: Data Staged
- T1078: Valid Accounts
- T1080: Taint Shared Content
- T1082: System Information Discovery
- T1083: File and Directory Discovery
- T1087: Account Discovery
- T1090: Proxy
- T1091: Replication Through Removable Media
- T1092: Communication Through Removable Media
- T1095: Non-Application Layer Protocol
- T1098: Account Manipulation
- T1102: Web Service
- T1104: Multi-Stage Channels
- T1105: Ingress Tool Transfer
- T1106: Native API
- T1110: Brute Force
- T1111: Multi-Factor Authentication Interception
- T1112: Modify Registry
- T1113: Screen Capture
- T1114: Email Collection
- T1115: Clipboard Data
- T1119: Automated Collection
- T1120: Peripheral Device Discovery
- T1123: Audio Capture
- T1124: System Time Discovery
- T1125: Video Capture
- T1127: Trusted Developer Utilities Proxy Execution
- T1129: Shared Modules
- T1132: Data Encoding
- T1133: External Remote Services
- T1134: Access Token Manipulation
- T1135: Network Share Discovery
- T1136: Create Account
- T1137: Office Application Startup
- T1140: Deobfuscate/Decode Files or Information
- T1176: Software Extensions
- T1185: Browser Session Hijacking
- T1187: Forced Authentication
- T1189: Drive-by Compromise
- T1190: Exploit Public-Facing Application
- T1195: Supply Chain Compromise
- T1197: BITS Jobs
- T1199: Trusted Relationship
- T1200: Hardware Additions
- T1201: Password Policy Discovery
- T1202: Indirect Command Execution
- T1203: Exploitation for Client Execution
- T1204: User Execution
- T1205: Traffic Signaling
- T1207: Rogue Domain Controller
- T1210: Exploitation of Remote Services
- T1211: Exploitation for Stealth
- T1212: Exploitation for Credential Access
- T1213: Data from Information Repositories
- T1216: System Script Proxy Execution
- T1217: Browser Information Discovery
- T1218: System Binary Proxy Execution
- T1219: Remote Access Tools
- T1220: XSL Script Processing
- T1221: Template Injection
- T1222: File and Directory Permissions Modification
- T1480: Execution Guardrails
- T1482: Domain Trust Discovery
- T1484: Domain or Tenant Policy Modification
- T1485: Data Destruction
- T1486: Data Encrypted for Impact
- T1489: Service Stop
- T1490: Inhibit System Recovery
- T1491: Defacement
- T1495: Firmware Corruption
- T1496: Resource Hijacking
- T1497: Virtualization/Sandbox Evasion
- T1498: Network Denial of Service
- T1499: Endpoint Denial of Service
- T1505: Server Software Component
- T1518: Software Discovery
- T1525: Implant Internal Image
- T1526: Cloud Service Discovery
- T1528: Steal Application Access Token
- T1529: System Shutdown/Reboot
- T1530: Data from Cloud Storage
- T1531: Account Access Removal
- T1534: Internal Spearphishing
- T1535: Unused/Unsupported Cloud Regions
- T1537: Transfer Data to Cloud Account
- T1538: Cloud Service Dashboard
- T1539: Steal Web Session Cookie
- T1542: Pre-OS Boot
- T1543: Create or Modify System Process
- T1546: Event Triggered Execution
- T1547: Boot or Logon Autostart Execution
- T1548: Abuse Elevation Control Mechanism
- T1550: Use Alternate Authentication Material
- T1552: Unsecured Credentials
- T1553: Subvert Trust Controls
- T1554: Compromise Host Software Binary
- T1555: Credentials from Password Stores
- T1556: Modify Authentication Process
- T1557: Adversary-in-the-Middle
- T1558: Steal or Forge Kerberos Tickets
- T1559: Inter-Process Communication
- T1560: Archive Collected Data
- T1561: Disk Wipe
- T1563: Remote Service Session Hijacking
- T1564: Hide Artifacts
- T1565: Data Manipulation
- T1566: Phishing
- T1567: Exfiltration Over Web Service
- T1568: Dynamic Resolution
- T1569: System Services
- T1570: Lateral Tool Transfer
- T1571: Non-Standard Port
- T1572: Protocol Tunneling
- T1573: Encrypted Channel
- T1574: Hijack Execution Flow
- T1578: Modify Cloud Compute Infrastructure
- T1580: Cloud Infrastructure Discovery
- T1583: Acquire Infrastructure
- T1584: Compromise Infrastructure
- T1585: Establish Accounts
- T1586: Compromise Accounts
- T1587: Develop Capabilities
- T1588: Obtain Capabilities
- T1589: Gather Victim Identity Information
- T1590: Gather Victim Network Information
- T1591: Gather Victim Org Information
- T1592: Gather Victim Host Information
- T1593: Search Open Websites/Domains
- T1594: Search Victim-Owned Websites
- T1595: Active Scanning
- T1596: Search Open Technical Databases
- T1597: Search Closed Sources
- T1598: Phishing for Information
- T1599: Network Boundary Bridging
- T1600: Weaken Encryption
- T1601: Modify System Image
- T1602: Data from Configuration Repository
- T1606: Forge Web Credentials
- T1608: Stage Capabilities
- T1609: Container Administration Command
- T1610: Deploy Container
- T1611: Escape to Host
- T1612: Build Image on Host
- T1613: Container and Resource Discovery
- T1614: System Location Discovery
- T1615: Group Policy Discovery
- T1619: Cloud Storage Object Discovery
- T1620: Reflective Code Loading
- T1621: Multi-Factor Authentication Request Generation
- T1622: Debugger Evasion
- T1647: Plist File Modification
- T1648: Serverless Execution
- T1649: Steal or Forge Authentication Certificates
- T1650: Acquire Access
- T1651: Cloud Administration Command
- T1652: Device Driver Discovery
- T1653: Power Settings
- T1654: Log Enumeration
- T1657: Financial Theft
- T1659: Content Injection
- T1665: Hide Infrastructure
- T1666: Modify Cloud Resource Hierarchy
- T1667: Email Bombing
- T1668: Exclusive Control
- T1669: Wi-Fi Networks
- T1671: Cloud Application Integration
- T1673: Virtual Machine Discovery
- T1674: Input Injection
- T1675: ESXi Administration Command
- T1677: Poisoned Pipeline Execution
- T1678: Delay Execution
- T1679: Selective Exclusion
- T1680: Local Storage Discovery
- T1681: Search Threat Vendor Data
- T1682: Query Public AI Services
- T1683: Generate Content
- T1684: Social Engineering
- T1685: Disable or Modify Tools
- T1686: Disable or Modify System Firewall
- T1687: Exploitation for Defense Impairment
- T1688: Safe Mode Boot
- T1689: Downgrade Attack
- T1690: Prevent Command History Logging
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest