⬡ ATT&CK Heatmap — Live Threat Data
26 techniques · 172 events · REAL SESSION DATA
| Technique ID | Name | Tactic | Frequency | Count | Severity |
|---|---|---|---|---|---|
| T1542.001 | Pre-OS Boot: Bootkit | Persistence | 11 | 11C | |
| T1596 | Search Open Technical Databases | Reconnaissance | 10 | ||
| T1505.003 | Server Software: Web Shell | Persistence | 10 | 10C | |
| T1558.003 | Steal Kerberos Tickets: Kerberoasting | Credential Access | 6 | 6H | |
| T1490 | Inhibit System Recovery | Impact | 6 | 6C | |
| T1068 | Exploitation for Privilege Escalation | Privilege Escalation | 6 | 6C | |
| T1003.006 | OS Credential Dumping: DCSync | Credential Access | 6 | 6C | |
| T1055.001 | Process Injection: DLL Injection | Defense Evasion | 6 | 6C | |
| T1070.006 | Indicator Removal: Timestomping | Defense Evasion | 6 | ||
| T1003.001 | OS Credential Dumping: LSASS Memory | Credential Access | 6 | 6C | |
| T1552.001 | Unsecured Credentials: Credentials In Files | Credential Access | 6 | ||
| T1600.001 | Weaken Encryption: Reduce Key Space | Defense Evasion | 6 | 6H | |
| T1003.008 | OS Credential Dumping: /etc/passwd | Credential Access | 6 | ||
| T1021.001 | Remote Services: Remote Desktop Protocol | Lateral Movement | 6 | 6H | |
| T1572 | Protocol Tunneling | Command and Control | 5 | 5H | |
| T1059.001 | Command and Scripting: PowerShell | Execution | 5 | 5H | |
| T1548.002 | Abuse Elevation Control: Bypass UAC | Privilege Escalation | 5 | 5H | |
| T1565.001 | Data Manipulation: Stored Data Manipulation | Impact | 5 | ||
| T1550.002 | Use Alternate Auth: Pass the Hash | Lateral Movement | 5 | 5C | |
| T1110.003 | Brute Force: Password Spraying | Credential Access | 5 | 5H | |
| T1195.001 | Supply Chain Compromise: Software Dependencies | Initial Access | 5 | 5H | |
| T1110.001 | Brute Force: Password Guessing | Credential Access | 5 | 5H | |
| T1027 | Obfuscated Files or Information | Defense Evasion | 5 | ||
| T1053.005 | Scheduled Task/Job: Scheduled Task | Persistence | 5 | ||
| T1547.001 | Boot Autostart: Registry Run Keys | Persistence | 5 | ||
| T1498 | Network Denial of Service | Impact | 4 | 4H |
⬡ Technique Drill-Down
Select a row
Click any technique row to see
events, severity breakdown,
and recent detections
events, severity breakdown,
and recent detections
⚡ Live Event Stream
30 events · LIVE
23:12:14CRITICALCVE-2026-0001 kernel priv esclinux-srv-05T1068
23:12:12CRITICALVSS shadow copy deletionws-finance-03T1490
23:12:07MEDIUM.env probe — CensysInspectweb-trap-01T1552.001
23:12:03CRITICALCreateRemoteThread → lsass.exews-dev-12T1055.001
23:12:01MEDIUMSuspicious scheduled task SYSTEMws-finance-03T1053.005
23:11:56MEDIUMTimestomping — MACE attribute modifiedws-dev-12T1070.006
23:11:53HIGHSSH brute force — root:password123honeypot-ssh-01T1110.001
23:11:49CRITICALChina Chopper web shell in uploads/web-app-01T1505.003
23:11:45HIGHRDP from powershell.exe parentws-admin-01T1021.001
23:11:42CRITICALLSASS dump via MiniDumpWriteDumpws-hr-07T1003.001
23:11:38LOW313-BIND chain verified — 3180 bindsledger-01
23:11:36HIGHUnsigned dependency in build pipelinebuild-runner-02T1195.001
23:11:33MEDIUMRegistry Run key — non-standard pathws-hr-07T1547.001
23:11:29MEDIUMeBPF: cat /etc/shadow interceptedlinux-srv-05T1003.008
23:11:26HIGHOpenSSL PQC downgrade CVE-2026-1847api-gw-01T1600.001
23:11:24HIGHKerberoasting — RC4 TGS from jsmithdc-01T1558.003
23:11:20MEDIUMWE-FORGE decoy — DNS beacon firedvortex.ghost.watch.localT1596
23:11:16CRITICALDCSync — non-DC replicationdc-01T1003.006
23:11:13MEDIUMPE analyzer: UPX-packed entropy 7.8edge-node-04T1027
23:11:10CRITICALFirmware hash mismatch — edge-node-04edge-node-04T1542.001
23:11:05HIGHUAC bypass via fodhelper.exews-hr-07T1548.002
23:11:04HIGHKerberoasting — RC4 TGS from jsmithdc-01T1558.003
23:11:00LOWPE-7 retraining checkpoint F1=0.94nc-04
23:10:57LOW313-BIND chain verified — 3180 bindsledger-01
23:10:55MEDIUMWE-FORGE decoy — DNS beacon firedvortex.ghost.watch.localT1596
23:10:52CRITICALBehinder JSP AES shelltomcat-prod-01T1505.003
23:10:50HIGHDNS tunneling — entropy 4.2ws-finance-03T1572
23:10:46HIGHMirai botnet Telnet staginghoneypot-01T1498
23:10:44HIGHUnsigned dependency in build pipelinebuild-runner-02T1195.001
23:10:41HIGHPassword spraying — 15 accountsad-srv-01T1110.003