MITRE ATT&CK technique ID

ID mitre_attack_technique_id

DatatypeNot PIIidentifierDraft

This record is a draft: it has not been reviewed yet and may be incomplete or wrong. Do not rely on it for compliance decisions. Help improve it (see CONTRIBUTING.md).

Identifier of a technique in MITRE ATT&CK, the knowledge base of adversary behavior: T followed by four digits. A sub-technique adds a dot and three digits, so T1059.001 (PowerShell) is a sub-technique of T1059 (Command and Scripting Interpreter). The Enterprise, Mobile and ICS matrices share the format.

Categories: Software development
Countries: Global (not tied to a country)
Languages: Common to most languages
Quality: 75/100 · missing: mapping (Wikidata, Schema.org, ...), translation, detector coverage
Metacrafter rules: no detection rule yet
Supported by tools: no tool record lists this type yet

Regular expression

^T[0-9]{4}(?:\.[0-9]{3})?$

Python re syntax.

Examples

Value	Description
T1059	Command and Scripting Interpreter
T1059.001	PowerShell, a sub-technique of T1059
T1059.1 invalid	Sub-technique part needs three digits
TA0001 invalid	Tactic ID

Sources

wikipedia: https://en.wikipedia.org/wiki/ATT%26CK
doc: https://attack.mitre.org/techniques/T1059/001
other: https://github.com/mitre-attack/attack-stix-data

Use this record

Page URL: http://registry.apicrafter.io/datatype/mitre_attack_technique_id
JSON: API v1 · legacy shape (used by metacrafter) · Markdown (for LLMs)
Improve it: edit data/datatypes/any/software/mitre_attack_technique_id.yaml on GitHub