// Arsenal coverage

The arsenal, over the ATT&CK map.

Each tactic of an intrusion, from reconnaissance to impact, and the free CyberEscudo tool that helps you analyze or detect it. Hover a column to isolate it; click a technique to open its tool.

12of 14 tactics covered 25techniques mapped 24tools involved
With a toolNo direct tool
Reconnaissance
TA0043
3 technique(s)
T1595 Active Scanning Perimeter Scanner T1590 Gather Victim Network Info DNS Lookup T1596 Search Open Technical DBs OSINT Recon
Resource Development
TA0042
1 technique(s)
T1587 Develop Capabilities Wordlist Generator
Initial Access
TA0001
3 technique(s)
T1566 Phishing Email Triage T1566 Phishing (analizar) Phishing dissection T1190 Exploit Public-Facing App WAF Bypass
Execution
TA0002
2 technique(s)
T1059.001 PowerShell PowerShell Decoder T1059 Command & Scripting Reverse Shells
Persistence
TA0003
2 technique(s)
T1543.003 Windows Service Event 7045 T1053 Scheduled Task Event 4698
Privilege Escalation
TA0004
1 technique(s)
T1078 Valid Accounts (AD) BloodHound AD
Defense Evasion
TA0005
3 technique(s)
T1027 Obfuscated Files PowerShell Decoder T1140 Deobfuscate/Decode Multi Decoder T1070.001 Clear Windows Logs Event 1102
Credential Access
TA0006
3 technique(s)
T1110 Brute Force Hash Analyzer T1003.001 LSASS Memory Event 10 (Sysmon) T1552 Unsecured Credentials Secret Scanner
Discovery
TA0007
2 technique(s)
T1046 Network Service Discovery Nmap Builder T1580 Cloud Infrastructure Discovery Cloud Enum
Lateral Movement
TA0008
1 technique(s)
T1021 Remote Services Event 4624
Collection
TA0009
no direct coverage
—
Command & Control
TA0011
3 technique(s)
T1071 Application Layer Protocol C2 Web Simulator T1071 IOCs / neutralizar IOC Defang T1071 Patrones en logs Log Analyzer
Exfiltration
TA0010
no direct coverage
—
Impact
TA0040
1 technique(s)
T1486 Endurecer / postura Posture Radar
🧭 MITRE ATT&CK reference ⛓️ Anatomy of an attack 🧰 See the arsenal

Indicative mapping: a tool may touch several techniques and a technique, several tools. Based on MITRE ATT&CK Enterprise. The gaps are honest: CyberEscudo is an analysis and defense toolkit, strongest in recon → execution → credentials → C2.