How Attacks Work Screensaver
The How Attacks Work screensaver shows techniques from MITRE ATT&CK with the stage of an intrusion each belongs to, key-less. It’s free, runs in your browser, and ESC exits.
Live preview
Press ESC to leave fullscreen. Settings are saved in your browser only.
How the How Attacks Work screensaver works
The saver reads the source described above and draws it on a canvas — no account, no tracking.
Techniques from MITRE ATT&CK with the stage of an intrusion each belongs to, key-less. Nothing here is a bug to be patched — most of it abuses features behaving exactly as specified, which is why it keeps working.
It refreshes on a schedule, so what you see stays current.
Colours and any options can be changed in settings; nothing is stored beyond your own browser.
How MITRE ATT&CK is structured
MITRE ATT&CK is a public knowledge base of adversary tactics and techniques based on real-world observations of attacks. It grew out of MITRE’s Fort Meade Experiment research and was first published openly in 2015. The Enterprise matrix, used here, organises behaviours into tactics, the attacker’s goals at each stage such as initial access, persistence or exfiltration, with techniques as the methods used to reach each goal.
Each technique has an ID beginning with T, and sub-techniques add a suffix: T1496.003 is the SMS pumping variant of resource hijacking, a form of telecom fraud in which a victim’s messaging system is used to send texts to numbers the attacker profits from. Entries list their tactics, the platforms affected and a description. MITRE publishes the data as STIX 2.0 and 2.1 on GitHub and through a TAXII 2.1 server; the STIX data still includes revoked and deprecated objects, so consumers filter them out.
These are descriptions of behaviour, not vulnerabilities, and they are not ranked by risk. Many techniques use legitimate features of the system, so there is no single patch for them. The framework is a map used by defenders to check coverage and plan detections; it is not an exhaustive list of everything an attacker can do.
A worked example
Techniques from MITRE ATT&CK with the stage of an intrusion each belongs to, key-less. Nothing here is a bug to be patched — most of it abuses features behaving exactly as specified, which is why it keeps working.
Settings & tips
- Accent and Background recolour the display.
- Every value on screen comes from the live source — nothing is simulated.
- Press ESC to leave fullscreen.
Frequently asked questions
- Is this real data?
- Yes — it comes from the source named on this page and is refreshed on a schedule.
- Is a key needed?
- No. This source is fully key-less.
- Is it free?
- Yes, and it runs entirely in your browser.
- What is the difference between a tactic and a technique?
- A tactic is the attacker’s goal at a stage, like gaining persistence. A technique is a specific way to achieve it, and sub-techniques describe more specific variants.
- Are these vulnerabilities I should patch?
- Generally no. They describe adversary behaviour, much of which makes use of normal features. Defences involve detection and configuration, not one fix.
- What does revoked or deprecated mean?
- MITRE marks a technique revoked or deprecated when it has been retired from the current matrix. The STIX dataset keeps those objects, while MITRE’s Excel spreadsheets leave them out.