ATT&CK techniques by threat group

Which MITRE ATT&CK threat groups are known to use which techniques, with group aliases and links, and whether the link came through a sub-technique.

Query it in Studio Use the OData API

Preview

The first ten rows

Live from the table, no sign-in needed.

SELECT technique_id, group_id, group_name, group_aliases, via_subtechnique
  FROM demo.security.technique_groups
 LIMIT 10

Example questions

Run any of these here, or open it in Studio to change the SQL. Studio is free to start: 100 queries a day.

SELECT group_name, COUNT(*) AS techniques
  FROM demo.security.technique_groups
 GROUP BY group_name
 ORDER BY techniques DESC, group_name
 LIMIT 10

Edit in Studio

SELECT technique_id, COUNT(*) AS groups
  FROM demo.security.technique_groups
 GROUP BY technique_id
 ORDER BY groups DESC, technique_id
 LIMIT 10

Edit in Studio

Schema