ATT&CK Technique Lookup

Search by ID, by name, by tactic, or by a phrase from the description. Searching a parent ID returns its sub-techniques with it — T1566 brings back Phishing and every T1566.00x beneath it, because the question behind that search is almost never about the parent alone.

Nothing you type is sent anywhere

The technique dataset is downloaded once, on your first search, and every query after that is matched inside your own tab. No search term reaches a server. That matters more here than it looks: the technique someone searches for during an incident is a statement about what they think is happening.

Tactic names come from the data, never from a list here

ATT&CK renames tactics — TA0005 became Stealth in the May 2026 release — so tactic labels are derived from the shortnames in the dataset rather than a table written into this page. A tactic added upstream appears correctly the day the data carries it, instead of rendering under a name that stopped being true.

Reference data, not detection coverage

This tells you what a technique is. It does not tell you whether you detect it, which groups use it, or how it has been seen in the wild — that last question is what Quietlytic's threat actor profiles and malware coverage are for. Descriptions are trimmed; the authoritative text is on MITRE's own page for each technique.

credential dumping returns T1003 by name. login material returns the same technique by description, because the phrase appears in MITRE's own text and not in the title. Both results say which field matched, so a description hit is never mistaken for a name.

MITRE ATT&CK® — attack.mitre.org . Used under the ATT&CK Terms of Use . Technique descriptions are MITRE's; the search, ranking and presentation here are not, and nothing on this page is endorsed by MITRE. Descriptions are trimmed, and MITRE's inline citation markers and footnote link syntax are removed because neither resolves outside their own bundle — no wording is rewritten.