CAPEC patterns to ATT&CK techniques

Links from CAPEC attack patterns to the MITRE ATT&CK techniques they map to, including mappings inherited from a parent pattern (capec_hops counts how far up the mapping came from).

Table: demo.security.pattern_techniques
Source: Opteryx view over MITRE CAPEC and ATT&CK
Rows
Updated

Query it in Studio Use the OData API

Preview

The first ten rows

Live from the table, no sign-in needed.

SELECT capec_id, via_capec_id, capec_hops, technique_id, technique_name, tactics
  FROM demo.security.pattern_techniques
 LIMIT 10

Example questions

Ask it something

Run any of these here, or open it in Studio to change the SQL. Studio is free to start: 100 queries a day.

Which ATT&CK techniques do the most attack patterns map to?

SELECT technique_id, technique_name, COUNT(*) AS patterns
  FROM demo.security.pattern_techniques
 GROUP BY technique_id, technique_name
 ORDER BY patterns DESC, technique_id
 LIMIT 10

Edit in Studio

Which patterns map to a technique directly, not through a parent?

SELECT capec_id, technique_id, technique_name
  FROM demo.security.pattern_techniques
 WHERE capec_hops = 0
 ORDER BY capec_id, technique_id
 LIMIT 10

Edit in Studio

Schema

Columns

Column	Type
capec_id	VARCHAR
via_capec_id	VARCHAR
capec_hops	INT64
technique_id	VARCHAR
technique_name	VARCHAR
tactics	VARCHAR
technique_url	VARCHAR