Searchable adversary behavior context, detection guidance, mitigations, and Glexia analyst summaries built from official MITRE ATT&CK source data.
Glexia mirrors official MITRE ATT&CK releases, normalizes objects into searchable records, and adds defensive context for executives, SOC teams, detection engineers, and incident responders.
MITRE’s official site centers on matrix navigation. Glexia keeps that familiar mental model, then adds fast search, defensive metadata, CVE relevance, and executive-ready triage context.
Official descriptions remain clearly labeled. Glexia layers on plain-English summaries, telemetry framing, mitigation prioritization, CVE exposure links, and service-relevant triage guidance.
Briefs leaders on why a behavior matters without requiring source-data familiarity.
Browse technique takesConnects techniques to logs, data components, and SOC validation paths.
Browse data sourcesTranslates course-of-action links into practical defensive sequencing.
Browse mitigationsLabels Glexia-inferred CVE relevance clearly and conservatively.
Open CVE mappingAdversary behaviors and sub-techniques drawn from official MITRE ATT&CK STIX data.
TacticsATT&CK tactical objectives, mapped to related techniques and matrices.
GroupsIntrusion-set and threat group profiles from official ATT&CK data.
SoftwareMalware and tool entries linked to techniques, groups, and campaigns.
CampaignsCampaign objects and their related groups, software, and techniques.
MitigationsATT&CK mitigations and Glexia implementation context.
Data SourcesDetection telemetry sources used by SOC and detection engineering teams.
Data ComponentsConcrete ATT&CK data components linked to detectable techniques.
DetectionsDetection strategies and analytics from ATT&CK where present.
ICS AssetsICS asset objects used by ATT&CK for ICS.
These records are sorted from the normalized ATT&CK object modified timestamp. Counts and rows come from imported data, not hard-coded totals.
ATT&CK for Mobile is a matrix of adversary behavior against mobile devices (smartphones and tablets running the Android or iOS/iPadOS operating systems). ATT&CK for Mobile builds upon NIST's Mobile Threat Catalogue and also contains a separate matrix of network-based effects, which are techniques that an adversary can employ without access to the mobile device itself.
The ATT&CK for Industrial Control Systems (ICS) knowledge base categorizes the unique set of tactics, techniques, and procedures (TTPs) used by threat actors in the ICS technology domain. ATT&CK for ICS outlines the portions of an ICS attack that are out of scope of Enterprise and reflects the various phases of an adversary’s attack life cycle and the assets and systems they are known to target.
ATT&CK for Enterprise provides a knowledge base of real-world adversary behavior targeting traditional enterprise networks. ATT&CK for Enterprise covers the following platforms: Windows, macOS, Linux, PRE, Office 365, Google Workspace, IaaS, Network, and Containers.
2015 Ukraine Electric Power Attack was a Sandworm Team campaign during which they used BlackEnergy (specifically BlackEnergy3) and KillDisk to target and disrupt transmission and distribution substations within the Ukrainian power grid. This campaign was the first major public attack conducted against the Ukrainian power grid by Sandworm Team.
2015 Ukraine Electric Power Attack was a Sandworm Team campaign during which they used BlackEnergy (specifically BlackEnergy3) and KillDisk to target and disrupt transmission and distribution substations within the Ukrainian power grid. This campaign was the first major public attack conducted against the Ukrainian power grid by Sandworm Team.
Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.[1][2][3]
Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.[4][5][6]
Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.
