Techniques, weaknesses and evidence
3,962 records: 3,950 source taxonomy/vulnerability records and 12 historical concepts. 24,721 explicit source assertions. Twelve separate publication references preserve authorship roles without inventorship claims.
Search techniques, groups, weaknesses and CVEs · Full dataset JSON — large, explicit download · Source notices and licenses
ATT&CK 20.0 across enterprise, mobile and ICS; CAPEC 3.9; CWE 4.20; five illustrative CVEs and their KEV membership. These five examples are not a complete vulnerability catalog. Source-derived records retain machine-extraction status; this is not an independent adjudication of actor claims. Historical concept mappings remain labeled provisional.
Inspect structured metadata and provenance
{
"source": "ATT&CK enterprise",
"version": "20.0",
"source_objects": 26690,
"imported": {
"Campaign": 57,
"Mitigation": 44,
"IntrusionSet": 178,
"Software": 842,
"Subtechnique": 479,
"Technique": 227,
"Tactic": 15
},
"excluded_revoked_or_deprecated": 446,
"scope": "Selected active entity types and explicit relationships; not all STIX object types"
}Inspect structured metadata and provenance
{
"source": "ATT&CK mobile",
"version": "20.0",
"source_objects": 2684,
"imported": {
"Campaign": 3,
"Mitigation": 13,
"IntrusionSet": 20,
"Software": 128,
"Technique": 78,
"Subtechnique": 47,
"Tactic": 12
},
"excluded_revoked_or_deprecated": 79,
"scope": "Selected active entity types and explicit relationships; not all STIX object types"
}Inspect structured metadata and provenance
{
"source": "ATT&CK ics",
"version": "20.0",
"source_objects": 2566,
"imported": {
"Campaign": 10,
"Mitigation": 53,
"IntrusionSet": 14,
"Software": 25,
"Technique": 78,
"Subtechnique": 26,
"Tactic": 12
},
"excluded_revoked_or_deprecated": 50,
"scope": "Selected active entity types and explicit relationships; not all STIX object types"
}Inspect structured metadata and provenance
{
"source": "CAPEC",
"version": "3.9",
"imported": 615,
"status_counts": {
"Draft": 402,
"Stable": 154,
"Deprecated": 56,
"Usable": 2,
"Obsolete": 1
},
"nondeprecated": 559,
"source_date": "2023-01-24",
"scope": "Attack_Pattern entries only; categories and views excluded; statuses retained"
}Inspect structured metadata and provenance
{
"source": "CWE",
"version": "4.20",
"imported": 969,
"status_counts": {
"Incomplete": 486,
"Draft": 432,
"Deprecated": 25,
"Stable": 26
},
"nondeprecated": 944,
"source_date": "2026-04-30",
"scope": "Weakness entries only; categories and views excluded; statuses retained"
}Inspect structured metadata and provenance
{
"source": "CVE",
"version": "per-record dataVersion",
"imported": 5,
"scope": "Five explicitly selected historical/high-impact examples; not representative or complete"
}Inspect structured metadata and provenance
{
"source": "CISA KEV",
"version": "2026.10.15",
"source_count": 1746,
"parsed": 1746,
"imported": 5,
"scope": "Membership assertions for the five selected CVEs only"
}