MITRE ATT&CK

`get_mitre_technique`

Retrieve a single MITRE ATT&CK Enterprise technique by its identifier (e.g. T1059 or T1059.001), including description, platforms, kill-chain phases, detection guidance, and associated data sources. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

technique_idstringrequired

ATT&CK technique identifier matching ^T[0-9]{4}(\.[0-9]{3})?$. Use the T####.### form for sub-techniques (e.g. T1059.001 for PowerShell). Pass the parent ID (e.g. T1059) to retrieve the top-level technique.

Example invocation

Ask your agent:

Get the MITRE ATT&CK technique detail for T1059.001, including its platforms, detection guidance, and kill-chain phases.

Raw JSON-RPC:

curl -s https://mcp.precursorintelligence.com \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "get_mitre_technique",
      "arguments": { "technique_id": "T1059.001" }
    }
  }'

Response

result.content[0].text (parsed)

{
  "technique_id": "T1059.001",
  "parent_technique": "T1059",
  "name": "PowerShell",
  "description": "Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.",
  "platforms": ["Windows"],
  "data_sources": [
    "Command: Command Execution",
    "Module: Module Load",
    "Process: Process Creation",
    "Script: Script Execution"
  ],
  "detection": "If proper execution policy is set, adversaries will likely be able to define their own policies if they obtain administrator or system access, either through the Registry or at the command line. Monitor for loading and/or execution of artifacts associated with PowerShell specific cmdlets, such as PowerSploit. Logging of PowerShell scripts is also recommended.",
  "is_subtechnique": true,
  "deprecated": false,
  "revoked": false,
  "phases": ["execution"],
  "permissions_required": ["User"],
  "defense_bypassed": null,
  "effective_permissions": null,
  "modified": "2023-10-16T00:00:00.000Z",
  "generated_at": "2026-05-18T10:24:31.118Z"
}

The full MCP envelope wrapping this payload is documented in Response Format.

Response fields

technique_idstringoptional

The canonical ATT&CK technique identifier (e.g. T1059.001).

parent_techniquestring | nulloptional

Parent technique identifier for sub-techniques (e.g. T1059). null for top-level techniques.

namestringoptional

Human-readable technique name (e.g. PowerShell).

descriptionstringoptional

Full ATT&CK technique description, as published by MITRE.

platformsarrayoptional

Operating systems and environments where the technique applies (e.g. ["Windows", "Linux", "macOS"]).

data_sourcesarrayoptional

ATT&CK data sources relevant to detecting this technique (e.g. "Command: Command Execution").

detectionstringoptional

ATT&CK detection guidance describing what to monitor and how to identify this technique in the environment.

is_subtechniquebooleanoptional

true if this entry is a sub-technique (identifier contains a dot).

deprecatedbooleanoptional

true if MITRE has marked this technique as deprecated.

revokedbooleanoptional

true if MITRE has revoked this technique entry.

phasesarrayoptional

ATT&CK tactic shortnames this technique falls under (e.g. ["execution"]).

permissions_requiredarray | nulloptional

Privilege levels required to execute this technique (e.g. ["User", "Administrator"]). null when not specified by MITRE.

defense_bypassedarray | nulloptional

Defensive controls this technique can bypass. null when not applicable.

effective_permissionsarray | nulloptional

Permissions an adversary gains after executing this technique. null when not specified.

modifiedstring | nulloptional

ISO 8601 date when MITRE last modified this technique entry.

generated_atstringoptional

ISO 8601 timestamp indicating when this record was assembled.

Errors

Code	Message	When
`-32602`	`invalid_params: technique_id: required_string`	The `technique_id` argument is missing.
`-32602`	`invalid_params: technique_id: pattern`	The value does not match `^T[0-9]{4}(\.[0-9]{3})?$`.
`-32001`	`unauthorized`	The API key is invalid or revoked.
`-32002`	`insufficient_credits`	The organisation's credit balance is below 1.

If the technique identifier is well-formed but not in the dataset, the tool returns a successful response with a payload of { "error": "not_found" } and the credit is refunded automatically.

For a complete reference of JSON-RPC error codes, see Errors.