Behaviour
MITRE ATT&CK coverage
What attackers do after they get a (fake) shell. Every command is mapped to ATT&CK techniques; cell shade = how often the technique was observed.
Technique heatmap
fewer moreinitial access
execution
persistence
defense evasion
credential access
discovery
command and control
impact
Most common commands
executions (defanged)No shell commands in this window yet