MITRE ATT&CK techniques, ranked by observed volume

Live leaderboard of techniques ranked by attacks observed by the OffSeq global honeypot fleet in the last 30 days.

Ranked by attacks observed by the OffSeq honeypot fleet · last 30 days

#	Technique	Attacks	Source IPs
1	T1110 Brute Force	24,201,403	31,408
2	T1190 Exploit Public-Facing Application	2,425,743	58,350
3	T1657 Financial Theft	2,334,611	363
4	T1021.005 VNC	1,395,389	2,252
5	T1595 Active Scanning	655,826	16,939
6	T1105 Ingress Tool Transfer	220,484	625
7	T1046 Network Service Discovery	103,242	9,723
8	T1552 Unsecured Credentials	74,690	2,052
9	T1595.002 Vulnerability Scanning	66,537	4,769
10	T1059 Command and Scripting Interpreter	59,946	803
11	T1210 Exploitation of Remote Services	26,886	3,791
12	T0846 Remote System Discovery	7,422	1,365
13	T1498.002 Reflection Amplification	6,225	1,833
14	T1552.001 Credentials In Files	5,605	254
15	T1187 Forced Authentication	4,903	1,048
16	T1592 Gather Victim Host Information	4,530	391
17	T1071.003 Mail Protocols	3,416	208
18	T1505.003 Web Shell	1,286	419
19	T1090 Proxy	1,179	63
20	T1078 Valid Accounts	1,024	372
21	T1040 Network Sniffing	747	471
22	T1505 Server Software Component	599	115
23	T1589.002 Email Addresses	178	86

Every row links to a live-updating profile of what OffSeq honeypot sensors captured worldwide. See all planes on the threat-intelligence index.