attack-cli

Offline MITRE ATT&CK technique explorer. All 697 techniques and sub-techniques (with tactics, platforms, and mitigations) are embedded in the binary, so no network access or API key is required.

Install

brew install berkanktk/tap/attack-cli

Usage

attack search "credential dumping"
attack technique T1003
attack tactic persistence
attack platform linux
attack mitigations                    # mitigations ranked by technique coverage
attack mitigation "password policies" # a mitigation and every technique it covers
attack stats                          # dataset overview: bar charts by tactic/platform
attack random
attack export T1059 --format json
attack tactics      # list all valid tactic names
attack platforms    # list all valid platform names

Listings (search, tactic, platform) render as an aligned table with sub-techniques nested under their parent technique. Output is colorized when attached to a real terminal (each tactic/platform gets a stable color so it's recognizable at a glance across commands), and drops to plain text automatically when piped, redirected, or when NO_COLOR is set.

Data

The dataset lives at internal/data/techniques.json, pulled from MITRE ATT&CK and embedded at build time via go:embed: no bundled runtime dependency, no network fetch.

Development

go build -o attack .
go vet ./...
gofmt -l .