{"uid":"cap_MS5qS2PSh0pvzjSFpidLQ","slug":"mitre-att-ck-technique-lookup-2s-io-bebc96d1","name":"MITRE ATT&CK Technique Lookup (2s.io)","description":"Authoritative MITRE ATT&CK (Enterprise) technique lookup. Pass id (e.g. T1059 or sub-technique T1059.001) for the canonical technique — name, tactics (kill-chain phases), description, platforms, sub-technique flag + parent, mitigations, and detection guidance — or query for a keyword search returning ranked techniques. Bundled current ATT&CK matrix (~700 techniques), zero external calls. Agents cite T-numbers and tactic names that must be exact; this returns version-pinned, citeable data instead of hallucinated IDs. For threat modeling, detection engineering, and report enrichment.","url":"https://2s.io/api/security/attack","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","queryParams"],"properties":{"type":{"const":"http"},"method":{"const":"GET"},"queryParams":{"required":[],"properties":{"id":{"type":"string","description":"ATT&CK technique id (T1059 / T1059.001)."},"limit":{"type":"integer"},"query":{"type":"string","description":"Keyword search."}}}}}}},"responseSchema":null,"example":{"request":{"input":{"type":"http","method":"GET","queryParams":{"id":"T1059.001"}}},"response":{"data":{"ok":true,"items":[{"item":{"id":"T1059.001","name":"PowerShell","parent":"T1059","tactics":["execution"],"detection":null,"platforms":["Windows"],"description":"Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).\n\nPowerShell may also be used to download and run executables from ","mitigations":["Disable or Remove Feature or Program","Antivirus/Antimalware","Code Signing","Privileged Account Management","Execution Prevention"],"isSubtechnique":true},"mode":"lookup","source":{"url":"https://attack.mitre.org/","license":"MITRE ATT&CK is free to use with attribution (Apache-2.0 data).","provider":"MITRE ATT&CK — Enterprise"}}],"total":1,"source":{"url":"https://attack.mitre.org/","license":"MITRE ATT&CK is free to use with attribution (Apache-2.0 data).","provider":"MITRE ATT&CK — Enterprise"}},"meta":{"cost":{"usd":0.001,"tier":0},"caller":"x402","version":null,"endpoint":"security.attack","settlement":{"txHash":"0x01958679d13b509d20a74435b199f3a6bb2c73b940c7b51ce2f6fb585876b6ba","network":"eip155:8453","success":true}}}},"exampleRequest":{"id":"T1059.001"},"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.0025","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.0025","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_mAmYveIRm0Vyy7nwoVkuf","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.0025","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Look up MITRE ATT&CK Enterprise techniques by ID or keyword, returning tactic classifications and affected platforms","exampleAgentPrompt":"What does MITRE ATT&CK say about T1059.001 — what tactic category does it fall under and which platforms does it affect?","exampleUseCases":null,"resultDescription":"A JSON array of ATT&CK technique objects each containing a technique ID, human-readable name, list of tactic categories (e.g. execution, persistence), and list of affected platforms (Windows, macOS, Linux). Also includes the total count of results and source attribution to MITRE ATT&CK with its Apache-2.0 license.","failureModes":["Invalid or non-existent technique ID returns empty items array with total 0","Overly broad keyword query returns large result sets that may require pagination via limit","Payment not processed results in HTTP 402 response before any data is returned","Malformed queryParams (wrong type for limit) may cause a 400 error"],"whenToPreferThis":"Use this endpoint when you need authoritative, ground-truth MITRE ATT&CK technique data without setting up an API key or account — ideal for AI agents doing threat analysis, red team planning, or security enrichment that need to map observed behaviors to ATT&CK IDs. Prefer this over scraping attack.mitre.org directly, or over CVE-focused endpoints that don't return tactic/platform classifications.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T06:55:33.862Z","isFirstParty":false}