Automotive Threat Landscape

MITRE Heatmap

ATT&CK Techniques. Powered by, and explicitly evidenced across Threat Feed reports.

11tagged stories
26 Aug 2026 — 24 Sep 202644 technique mappings

Reconnaissance

Active ScanningT15950
Gather Victim Host InformationT15920
Gather Victim Identity InformationT15890
Gather Victim Network InformationT15900
Gather Victim Org InformationT15910
Phishing for InformationT15980
Query Public AI ServicesT16820
Search Closed SourcesT15970
Search Open Technical DatabasesT15960
Search Open Websites/DomainsT15930
Search Threat Vendor DataT16810
Search Victim-Owned WebsitesT15940

Resource Development

Acquire AccessT16500
Acquire InfrastructureT15830
Compromise AccountsT15860
Compromise InfrastructureT15840
Develop CapabilitiesT15870
Establish AccountsT15850
Generate ContentT16830
Obtain CapabilitiesT15880
Stage CapabilitiesT16080

Initial Access

Content InjectionT16590
Drive-by CompromiseT11890
Exploit Public-Facing ApplicationT11902
External Remote ServicesT11330
Hardware AdditionsT12000
PhishingT15661
Replication Through Removable MediaT10910
Supply Chain CompromiseT11951
Trusted RelationshipT11990
Valid AccountsT10781
Wi-Fi NetworksT16690

Execution

BITS JobsT11970
Cloud Administration CommandT16510
Command and Scripting InterpreterT10592
Container Administration CommandT16090
Deploy ContainerT16100
ESXi Administration CommandT16750
Exploitation for Client ExecutionT12030
Hijack Execution FlowT15740
Input InjectionT16740
Inter-Process CommunicationT15590
Native APIT11060
Poisoned Pipeline ExecutionT16770
Scheduled Task/JobT10530
Serverless ExecutionT16480
Shared ModulesT11290
Software Deployment ToolsT10720
System ServicesT15690
Trusted Developer Utilities Proxy ExecutionT11270
User ExecutionT12040
Windows Management InstrumentationT10475

Persistence

Account ManipulationT10980
BITS JobsT11970
Boot or Logon Autostart ExecutionT15470
Boot or Logon Initialization ScriptsT10370
Cloud Application IntegrationT16710
Compromise Host Software BinaryT15540
Create AccountT11360
Create or Modify System ProcessT15430
Event Triggered ExecutionT15460
Exclusive ControlT16680
External Remote ServicesT11330
Implant Internal ImageT15250
Modify Authentication ProcessT15560
Modify RegistryT11120
Office Application StartupT11370
Power SettingsT16530
Pre-OS BootT15420
Scheduled Task/JobT10530
Server Software ComponentT15050
Software ExtensionsT11760
Traffic SignalingT12050
Valid AccountsT10781

Privilege Escalation

Abuse Elevation Control MechanismT15480
Access Token ManipulationT11340
Account ManipulationT10980
Boot or Logon Autostart ExecutionT15470
Boot or Logon Initialization ScriptsT10370
Create or Modify System ProcessT15430
Domain or Tenant Policy ModificationT14840
Escape to HostT16110
Event Triggered ExecutionT15460
Exploitation for Privilege EscalationT10680
Process InjectionT10550
Scheduled Task/JobT10530
Valid AccountsT10781

Stealth

Access Token ManipulationT11340
BITS JobsT11970
Build Image on HostT16120
Debugger EvasionT16220
Delay ExecutionT16780
Deobfuscate/Decode Files or InformationT11400
Direct Volume AccessT10060
Execution GuardrailsT14800
Exploitation for StealthT12110
Hide ArtifactsT15640
Hijack Execution FlowT15740
Indicator RemovalT10700
Indirect Command ExecutionT12020
MasqueradingT10360
Obfuscated Files or InformationT10270
Pre-OS BootT15420
Process InjectionT10550
Reflective Code LoadingT16200
RootkitT10140
Selective ExclusionT16790
Social EngineeringT16840
System Binary Proxy ExecutionT12180
System Script Proxy ExecutionT12160
Template InjectionT12210
Traffic SignalingT12050
Trusted Developer Utilities Proxy ExecutionT11270
Unused/Unsupported Cloud RegionsT15350
Valid AccountsT10781
Virtualization/Sandbox EvasionT14970
XSL Script ProcessingT12200

Defense Impairment

Disable or Modify System FirewallT16860
Disable or Modify ToolsT16855
Domain or Tenant Policy ModificationT14840
Downgrade AttackT16890
Exploitation for Defense ImpairmentT16870
File and Directory Permissions ModificationT12220
Modify Authentication ProcessT15560
Modify Cloud Compute InfrastructureT15780
Modify Cloud Resource HierarchyT16660
Modify RegistryT11120
Modify System ImageT16010
Network Boundary BridgingT15990
Plist File ModificationT16470
Prevent Command History LoggingT16900
Rogue Domain ControllerT12070
Safe Mode BootT16880
Subvert Trust ControlsT15530
Weaken EncryptionT16000

Credential Access

Adversary-in-the-MiddleT15570
Brute ForceT11100
Credentials from Password StoresT15550
Exploitation for Credential AccessT12120
Forced AuthenticationT11870
Forge Web CredentialsT16060
Input CaptureT10560
Modify Authentication ProcessT15560
Multi-Factor Authentication InterceptionT11110
Multi-Factor Authentication Request GenerationT16210
Network SniffingT10400
OS Credential DumpingT10030
Steal Application Access TokenT15280
Steal or Forge Authentication CertificatesT16490
Steal or Forge Kerberos TicketsT15580
Steal Web Session CookieT15390
Unsecured CredentialsT15520

Discovery

Account DiscoveryT10870
Application Window DiscoveryT10100
Browser Information DiscoveryT12170
Cloud Infrastructure DiscoveryT15800
Cloud Service DashboardT15380
Cloud Service DiscoveryT15260
Cloud Storage Object DiscoveryT16190
Container and Resource DiscoveryT16130
Debugger EvasionT16220
Device Driver DiscoveryT16520
Domain Trust DiscoveryT14820
File and Directory DiscoveryT10830
Group Policy DiscoveryT16150
Local Storage DiscoveryT16800
Log EnumerationT16540
Network Service DiscoveryT10460
Network Share DiscoveryT11350
Network SniffingT10400
Password Policy DiscoveryT12010
Peripheral Device DiscoveryT11200
Permission Groups DiscoveryT10690
Process DiscoveryT10570
Query RegistryT10120
Remote System DiscoveryT10180
Software DiscoveryT15180
System Information DiscoveryT10820
System Location DiscoveryT16140
System Network Configuration DiscoveryT10160
System Network Connections DiscoveryT10490
System Owner/User DiscoveryT10330
System Service DiscoveryT10070
System Time DiscoveryT11240
Virtual Machine DiscoveryT16730
Virtualization/ Sandbox EvasionT14970

Lateral Movement

Exploitation of Remote ServicesT12100
Internal SpearphishingT15340
Lateral Tool TransferT15700
Remote Service Session HijackingT15630
Remote ServicesT10210
Replication Through Removable MediaT10910
Software Deployment ToolsT10720
Taint Shared ContentT10800
Use Alternate Authentication MaterialT15500

Collection

Adversary-in-the-MiddleT15570
Archive Collected DataT15600
Audio CaptureT11231
Automated CollectionT11990
Browser Session HijackingT11850
Clipboard DataT11150
Data from Cloud StorageT15300
Data from Configuration RepositoryT16020
Data from Information RepositoriesT12130
Data from Local SystemT10050
Data from Network Shared DriveT10390
Data from Removable MediaT10250
Data StagedT10740
Email CollectionT11140
Input CaptureT10560
Screen CaptureT11130
Video CaptureT11251

Command and Control

Application Layer ProtocolT10710
Communication Through Removable MediaT10920
Content InjectionT16590
Data EncodingT11320
Data ObfuscationT10010
Dynamic ResolutionT15680
Encrypted ChannelT15730
Fallback ChannelsT10080
Hide InfrastructureT16650
Ingress Tool TransferT11050
Multi-Stage ChannelsT11040
Non-Application Layer ProtocolT10950
Non-Standard PortT15710
Protocol TunnelingT15720
ProxyT10900
Remote Access ToolsT15190
Traffic SignalingT12050
Web ServiceT11020

Exfiltration

Automated ExfiltrationT10200
Data Transfer Size LimitsT10300
Exfiltration Over Alternative ProtocolT10480
Exfiltration Over C2 ChannelT10410
Exfiltration Over Other Network MediumT10110
Exfiltration Over Physical MediumT10520
Exfiltration Over Web ServiceT15670
Scheduled TransferT10290
Transfer Data to Cloud AccountT15370

Impact

Account Access RemovalT15310
Data DestructionT14850
Data Encrypted for ImpactT14865
Data ManipulationT15650
DefacementT14910
Disk WipeT15610
Email BombingT16670
Endpoint Denial of ServiceT14991
Financial TheftT16570
Firmware CorruptionT14950
Inhibit System RecoveryT14900
Network Denial of ServiceT14980
Resource HijackingT14961
Service StopT14890
System Shutdown/RebootT15290

Colours represent relative occurrence frequency within the selected date range. MITRE ATT&CK® is a registered trademark of The MITRE Corporation. Technique definitions follow the MITRE ATT&CK matrix. Actor-profile intelligence is included in heatmap count.