Skip to content
Release: Australia · Updated: 2026-03-12 · Official documentation · View source

Attack patterns

Attack patterns are a type of Tactics, Techniques, and Procedures (TTPs) that describe the methods that adversaries attempt to compromise targets. Attack Patterns apply for STIX 2.x.

Attack patterns are used to help categorize attacks. They generalize specific attacks to the patterns that they follow, and provide detailed information about how attacks are performed.

For example, spear phishing is a common type of attack where an attacker sends a carefully crafted email message to a party with the intent of getting them to click a link or open an attachment to deliver malware. Attack Patterns are more specific, such as spear phishing by a particular threat actor (example - that the target won a contest) can also be an Attack pattern.

Parent Topic:IoC Repository

Related topics

Attack modes and methods

Indicators of compromise

Observables

Campaigns

Course of actions

Identities

Infrastructure

Intrusion set

Locations

Malware

Malware analysis

Observed data

Threat actors

Threat groupings

Marking definitions

Threat notes

Threat opinions

Threat reports

Sightings

Tools

Vulnerabilities

Relationships

STIX Visualizer