Automotive Threat Landscape

MITRE Heatmap

ATT&CK Techniques. Powered by, and explicitly evidenced across Threat Feed reports.

28tagged stories
11 Oct 2026 — 09 Nov 202699 technique mappings

Reconnaissance

Active ScanningT15950
Gather Victim Host InformationT15920
Gather Victim Identity InformationT15890
Gather Victim Network InformationT15900
Gather Victim Org InformationT15910
Phishing for InformationT15980
Query Public AI ServicesT16820
Search Closed SourcesT15970
Search Open Technical DatabasesT15960
Search Open Websites/DomainsT15930
Search Threat Vendor DataT16810
Search Victim-Owned WebsitesT15940

Resource Development

Acquire AccessT16500
Acquire InfrastructureT15830
Compromise AccountsT15860
Compromise InfrastructureT15840
Develop CapabilitiesT15870
Establish AccountsT15850
Generate ContentT16830
Obtain CapabilitiesT15880
Stage CapabilitiesT16080

Initial Access

Content InjectionT16590
Drive-by CompromiseT11890
Exploit Public-Facing ApplicationT11902
External Remote ServicesT11330
Hardware AdditionsT12000
PhishingT15661
Replication Through Removable MediaT10910
Supply Chain CompromiseT11952
Trusted RelationshipT11990
Valid AccountsT10786
Wi-Fi NetworksT16690

Execution

BITS JobsT11970
Cloud Administration CommandT16510
Command and Scripting InterpreterT10591
Container Administration CommandT16090
Deploy ContainerT16100
ESXi Administration CommandT16750
Exploitation for Client ExecutionT12030
Hijack Execution FlowT15740
Input InjectionT16740
Inter-Process CommunicationT15590
Native APIT11060
Poisoned Pipeline ExecutionT16770
Scheduled Task/JobT10530
Serverless ExecutionT16480
Shared ModulesT11290
Software Deployment ToolsT10720
System ServicesT15690
Trusted Developer Utilities Proxy ExecutionT11270
User ExecutionT12042
Windows Management InstrumentationT104710

Persistence

Account ManipulationT10981
BITS JobsT11970
Boot or Logon Autostart ExecutionT15470
Boot or Logon Initialization ScriptsT10370
Cloud Application IntegrationT16710
Compromise Host Software BinaryT15540
Create AccountT11361
Create or Modify System ProcessT15430
Event Triggered ExecutionT15460
Exclusive ControlT16680
External Remote ServicesT11330
Implant Internal ImageT15250
Modify Authentication ProcessT15560
Modify RegistryT11120
Office Application StartupT11370
Power SettingsT16530
Pre-OS BootT15420
Scheduled Task/JobT10530
Server Software ComponentT15050
Software ExtensionsT11760
Traffic SignalingT12050
Valid AccountsT10786

Privilege Escalation

Abuse Elevation Control MechanismT15480
Access Token ManipulationT11340
Account ManipulationT10981
Boot or Logon Autostart ExecutionT15470
Boot or Logon Initialization ScriptsT10370
Create or Modify System ProcessT15430
Domain or Tenant Policy ModificationT14840
Escape to HostT16110
Event Triggered ExecutionT15460
Exploitation for Privilege EscalationT10681
Process InjectionT10550
Scheduled Task/JobT10530
Valid AccountsT10786

Stealth

Access Token ManipulationT11340
BITS JobsT11970
Build Image on HostT16120
Debugger EvasionT16220
Delay ExecutionT16780
Deobfuscate/Decode Files or InformationT11400
Direct Volume AccessT10060
Execution GuardrailsT14800
Exploitation for StealthT12110
Hide ArtifactsT15640
Hijack Execution FlowT15740
Indicator RemovalT10700
Indirect Command ExecutionT12020
MasqueradingT10360
Obfuscated Files or InformationT10270
Pre-OS BootT15420
Process InjectionT10550
Reflective Code LoadingT16200
RootkitT10140
Selective ExclusionT16790
Social EngineeringT16840
System Binary Proxy ExecutionT12180
System Script Proxy ExecutionT12160
Template InjectionT12210
Traffic SignalingT12050
Trusted Developer Utilities Proxy ExecutionT11270
Unused/Unsupported Cloud RegionsT15350
Valid AccountsT10786
Virtualization/Sandbox EvasionT14970
XSL Script ProcessingT12200

Defense Impairment

Disable or Modify System FirewallT16860
Disable or Modify ToolsT168510
Domain or Tenant Policy ModificationT14840
Downgrade AttackT16891
Exploitation for Defense ImpairmentT16870
File and Directory Permissions ModificationT12220
Modify Authentication ProcessT15560
Modify Cloud Compute InfrastructureT15780
Modify Cloud Resource HierarchyT16660
Modify RegistryT11120
Modify System ImageT16010
Network Boundary BridgingT15990
Plist File ModificationT16470
Prevent Command History LoggingT16900
Rogue Domain ControllerT12070
Safe Mode BootT16880
Subvert Trust ControlsT15530
Weaken EncryptionT16000

Credential Access

Adversary-in-the-MiddleT15572
Brute ForceT11101
Credentials from Password StoresT15550
Exploitation for Credential AccessT12120
Forced AuthenticationT11870
Forge Web CredentialsT16060
Input CaptureT10560
Modify Authentication ProcessT15560
Multi-Factor Authentication InterceptionT11110
Multi-Factor Authentication Request GenerationT16210
Network SniffingT10401
OS Credential DumpingT10030
Steal Application Access TokenT15281
Steal or Forge Authentication CertificatesT16490
Steal or Forge Kerberos TicketsT15580
Steal Web Session CookieT15391
Unsecured CredentialsT15524

Discovery

Account DiscoveryT10870
Application Window DiscoveryT10100
Browser Information DiscoveryT12170
Cloud Infrastructure DiscoveryT15800
Cloud Service DashboardT15380
Cloud Service DiscoveryT15260
Cloud Storage Object DiscoveryT16190
Container and Resource DiscoveryT16130
Debugger EvasionT16220
Device Driver DiscoveryT16520
Domain Trust DiscoveryT14820
File and Directory DiscoveryT10830
Group Policy DiscoveryT16150
Local Storage DiscoveryT16800
Log EnumerationT16540
Network Service DiscoveryT10460
Network Share DiscoveryT11350
Network SniffingT10401
Password Policy DiscoveryT12010
Peripheral Device DiscoveryT11200
Permission Groups DiscoveryT10690
Process DiscoveryT10570
Query RegistryT10120
Remote System DiscoveryT10180
Software DiscoveryT15180
System Information DiscoveryT10821
System Location DiscoveryT16140
System Network Configuration DiscoveryT10160
System Network Connections DiscoveryT10490
System Owner/User DiscoveryT10330
System Service DiscoveryT10070
System Time DiscoveryT11240
Virtual Machine DiscoveryT16730
Virtualization/ Sandbox EvasionT14970

Lateral Movement

Exploitation of Remote ServicesT12103
Internal SpearphishingT15340
Lateral Tool TransferT15700
Remote Service Session HijackingT15630
Remote ServicesT10211
Replication Through Removable MediaT10910
Software Deployment ToolsT10720
Taint Shared ContentT10800
Use Alternate Authentication MaterialT15500

Collection

Adversary-in-the-MiddleT15572
Archive Collected DataT15600
Audio CaptureT11230
Automated CollectionT11990
Browser Session HijackingT11850
Clipboard DataT11150
Data from Cloud StorageT15300
Data from Configuration RepositoryT16020
Data from Information RepositoriesT12130
Data from Local SystemT10050
Data from Network Shared DriveT10390
Data from Removable MediaT10250
Data StagedT10740
Email CollectionT11140
Input CaptureT10560
Screen CaptureT11130
Video CaptureT11250

Command and Control

Application Layer ProtocolT10710
Communication Through Removable MediaT10920
Content InjectionT16590
Data EncodingT11320
Data ObfuscationT10010
Dynamic ResolutionT15680
Encrypted ChannelT15730
Fallback ChannelsT10080
Hide InfrastructureT16650
Ingress Tool TransferT11050
Multi-Stage ChannelsT11040
Non-Application Layer ProtocolT10950
Non-Standard PortT15710
Protocol TunnelingT15720
ProxyT10900
Remote Access ToolsT15190
Traffic SignalingT12050
Web ServiceT11020

Exfiltration

Automated ExfiltrationT10200
Data Transfer Size LimitsT10300
Exfiltration Over Alternative ProtocolT10480
Exfiltration Over C2 ChannelT10410
Exfiltration Over Other Network MediumT10110
Exfiltration Over Physical MediumT10520
Exfiltration Over Web ServiceT15670
Scheduled TransferT10290
Transfer Data to Cloud AccountT15370

Impact

Account Access RemovalT15311
Data DestructionT14850
Data Encrypted for ImpactT148612
Data ManipulationT15652
DefacementT14910
Disk WipeT15610
Email BombingT16670
Endpoint Denial of ServiceT14990
Financial TheftT16570
Firmware CorruptionT14950
Inhibit System RecoveryT14900
Network Denial of ServiceT14980
Resource HijackingT14960
Service StopT14890
System Shutdown/RebootT15291

Colours represent relative occurrence frequency within the selected date range. MITRE ATT&CK® is a registered trademark of The MITRE Corporation. Technique definitions follow the MITRE ATT&CK matrix. Actor-profile intelligence is included in heatmap count.