API Reference

Get a Technique

Fetch a single MITRE ATT&CK Enterprise technique by its identifier, including description, platforms, kill-chain phases, detection guidance, and data sources. The REST response is enriched: alongside the base technique fields, a related block lists the ATT&CK groups, software, and campaigns that use the technique, the mitigations that mitigate it, and its detection strategies.

GET

/v1/mitre/techniques/{technique-id}

Cost: 1 credit per successful call

Path parameters

technique-idstringrequired

An ATT&CK technique identifier matching the pattern ^T\d{4}(\.\d{3})?$. Use the T####.### form for sub-techniques (e.g. T1059.001 for PowerShell) or the parent ID (e.g. T1059) for a top-level technique. Input is case-insensitive and normalised to upper case server-side.

Request

curl https://api.precursorintelligence.com/functions/v1/mitre/techniques/T1059.001 \
  -H "Authorization: Bearer $PRECURSOR_API_KEY"

Response

200 OK

{
  "data": {
    "technique_id": "T1059.001",
    "parent_technique": "T1059",
    "name": "PowerShell",
    "description": "Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.",
    "platforms": ["Windows"],
    "data_sources": [
      "Command: Command Execution",
      "Module: Module Load",
      "Process: Process Creation",
      "Script: Script Execution"
    ],
    "detection": "If proper execution policy is set, adversaries will likely be able to define their own policies if they obtain administrator or system access. Monitor for loading and/or execution of artifacts associated with PowerShell specific cmdlets, such as PowerSploit. Logging of PowerShell scripts is also recommended.",
    "is_subtechnique": true,
    "deprecated": false,
    "revoked": false,
    "phases": ["execution"],
    "permissions_required": ["User"],
    "defense_bypassed": null,
    "effective_permissions": null,
    "modified": "2023-10-16T00:00:00.000Z",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "related": {
      "groups": [
        { "attack_id": "G0016", "name": "APT29" },
        { "attack_id": "G0050", "name": "APT32" }
      ],
      "software": [
        { "attack_id": "S0363", "name": "Empire", "type": "tool" },
        { "attack_id": "S0194", "name": "PowerSploit", "type": "tool" }
      ],
      "campaigns": [
        { "attack_id": "C0046", "name": "ArcaneDoor" }
      ],
      "mitigations": [
        {
          "attack_id": "M1038",
          "name": "Execution Prevention",
          "description": "Block execution of code on a system through application control, and/or script blocking."
        }
      ],
      "detections": [
        {
          "attack_id": "DET0516",
          "name": "Detection Strategy for PowerShell Execution",
          "description": "Monitor PowerShell module loads, script block logging, and command-line arguments for signs of malicious cmdlet use."
        }
      ]
    }
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Response fields

data.technique_idstringoptional

The canonical ATT&CK technique identifier (e.g. T1059.001).

data.parent_techniquestring | nulloptional

Parent technique identifier for sub-techniques (e.g. T1059). null for top-level techniques.

data.namestringoptional

Human-readable technique name (e.g. PowerShell).

data.descriptionstringoptional

Full ATT&CK technique description, as published by MITRE.

data.platformsarrayoptional

Operating systems and environments where the technique applies (e.g. ["Windows", "Linux", "macOS"]).

data.data_sourcesarrayoptional

ATT&CK data sources relevant to detecting this technique (e.g. "Command: Command Execution").

data.detectionstringoptional

ATT&CK detection guidance describing what to monitor and how to identify this technique in the environment.

data.is_subtechniquebooleanoptional

true if this entry is a sub-technique (identifier contains a dot).

data.deprecatedbooleanoptional

true if MITRE has marked this technique as deprecated.

data.revokedbooleanoptional

true if MITRE has revoked this technique entry.

data.phasesarrayoptional

ATT&CK tactic shortnames this technique falls under (e.g. ["execution"]).

data.permissions_requiredarray | nulloptional

Privilege levels required to execute this technique (e.g. ["User", "Administrator"]). null when not specified by MITRE.

data.defense_bypassedarray | nulloptional

Defensive controls this technique can bypass. null when not applicable.

data.effective_permissionsarray | nulloptional

Permissions an adversary gains after executing this technique. null when not specified.

data.modifiedstring | nulloptional

ISO 8601 date when MITRE last modified this technique entry.

data.generated_atstringoptional

ISO 8601 timestamp indicating when this record was assembled.

data.relatedobjectoptional

Enrichment block linking this technique to the rest of the ATT&CK graph. Each member array is always present and may be empty. Contains groups, software, campaigns, mitigations, and detections.

data.related.groupsarrayoptional

ATT&CK groups (intrusion sets) observed using this technique. Each element contains attack_id (the G#### group ID) and name. Sorted by name.

data.related.softwarearrayoptional

ATT&CK software (malware and tools) observed using this technique. Each element contains attack_id (the S#### software ID), name, and type (malware or tool). Sorted by name.

data.related.campaignsarrayoptional

ATT&CK campaigns that used this technique. Each element contains attack_id (the C#### campaign ID) and name. Sorted by name.

data.related.mitigationsarrayoptional

ATT&CK mitigations that mitigate this technique. Each element contains attack_id (the M#### mitigation ID), name, and description. Sorted by name.

data.related.detectionsarrayoptional

ATT&CK detection strategies for this technique. Each element contains attack_id (the DET#### strategy ID), name, and description. Revoked and deprecated strategies are excluded. Sorted by attack_id.

Errors

Status	`error`	When
400	`invalid_technique_id`	The path segment did not match the `^T\d{4}(\.\d{3})?$` pattern.
401	`invalid_authorization`	The `Authorization` header is missing or malformed.
401	`unauthorized`	The key is invalid, revoked, or the request IP is not on the allowlist.
402	`insufficient_credits`	The organisation's credit balance is below 1.
404	`not_found`	The technique identifier is valid but is not in the dataset.
405	`method_not_allowed`	Only `GET` and `OPTIONS` are accepted.
500	`internal`	An unexpected server error occurred.

See Errors for the full error reference.