CAPEC: Common Attack Pattern Enumeration Guide

The Common Attack Pattern Enumeration and Classification (CAPEC) is an open catalog and classification taxonomy of known cyber attack patterns. Maintained by The MITRE Corporation and sponsored by the Cybersecurity and Infrastructure Security Agency (CISA), CAPEC provides software developers, security architects, and penetration testers with a common vocabulary to understand how adversaries exploit weaknesses in applications and cyber-enabled systems.

What is CAPEC?

CAPEC defines and structures attack patterns: formalized descriptions of the common approaches, techniques, and pathways that adversaries employ to exploit known weaknesses in software, hardware, and network architectures. While traditional vulnerability lists focus on specific implementation bugs in isolated products, an attack pattern captures the generalized attacker methodology, adapting the concept of architectural design patterns to a destructive, adversary-oriented perspective.

Each CAPEC entry documents the attacker’s mindset, outlining prerequisites, execution phases, required technical capabilities, targeted systems, and effective defense mitigations. By studying these patterns, engineering teams can anticipate offensive techniques during software design rather than reacting only after an exploit is discovered in production.

Who runs it and what it covers

CAPEC was established in 2007 under the Software Assurance (SwA) initiative of the U.S. Department of Homeland Security (DHS) and is operated by The MITRE Corporation with ongoing sponsorship from CISA. Governance is supported by an international community advisory board representing government agencies, enterprise software vendors, and cybersecurity research organizations.

CAPEC covers an extensive taxonomy of offensive techniques spanning applications, physical hardware, communications protocols, and supply chains. Rather than presenting an unstructured list, CAPEC organizes attack patterns through two primary architectural views:

Mechanisms of Attack (CAPEC-1000): Classifies patterns based on the technical mechanism used to execute the attack, such as Subverting Access Control, Injecting Unexpected Items, Manipulating Data Structures, or Abusing Existing Functionality.
Domains of Attack (CAPEC-3000): Categorizes attack patterns across physical and digital operational domains, including Software, Hardware, Communications, Physical/Supply Chain, and Social Engineering.

Structure and abstraction levels

To support both high-level threat modeling and low-level security testing, CAPEC structures attack patterns into three hierarchical abstraction levels:

Meta Attack Patterns: High-level architectural approaches that are independent of specific technologies or programming paradigms (for example, CAPEC-153: Input Data Manipulation). Meta patterns help system architects identify broad threat classes during early development.
Standard Attack Patterns: More specific approaches targeting a recognizable design structure or technology family (for example, CAPEC-66: SQL Injection). Standard patterns assist security teams in defining defensive security requirements.
Detailed Attack Patterns: Highly granular techniques with step-by-step execution workflows tailored to a specific implementation context (for example, CAPEC-108: Command Line Execution through SQL Injection). Detailed patterns directly guide penetration testing and unit test suites.

How to search or use it

Security teams, research laboratory administrators, and software developers can operationalize CAPEC through the following practical steps:

Select a navigation perspective: Access the official CAPEC registry to browse either by Mechanism (CAPEC-1000) for development defense or by Domain (CAPEC-3000) for operational environment scoping.
Locate a target attack pattern: Search for a specific technique (such as Cross-Site Scripting or Session Fixation) using the CAPEC identifier lookup tool or hierarchical tree navigation.
Analyze the Execution Flow: Review the formalized execution steps broken down into the Explore phase (reconnaissance and system probing), Experiment phase (verifying exploitability), and Exploit phase (payload delivery and execution).
Review Prerequisites and Skills: Evaluate the technical skills, privileges, and environmental requirements an attacker must possess to successfully execute the attack pattern.
Examine preventative Mitigations: Extract actionable remediation guidance, such as parameterized queries, strict input filtering, or architectural isolation, to embed defensive controls into system codebases.
Trace related weaknesses: Follow cross-references to the Common Weakness Enumeration to determine which underlying code defects make systems vulnerable to this pattern.
Connect to enterprise defense: Link the identified pattern to adversary behavior documented in enterprise intrusion frameworks.

How CAPEC relates to MITRE ATT&CK and CWE

A central strength of MITRE’s cybersecurity standards is how CAPEC, Common Weakness Enumeration (CWE), and MITRE ATT&CK interlock to provide end-to-end security insight across the software development and operations lifecycle:

CWE defines the flaw: CWE catalogs intrinsic software and hardware weaknesses (the developer’s mistake, such as an unvalidated input buffer or missing authorization check).
CAPEC defines the exploit method: CAPEC describes how an attacker identifies, tests, and exploits that specific CWE weakness in an application. It provides the bridge connecting vulnerable code to offensive tradecraft.
ATT&CK defines operational post-exploit behavior: ATT&CK catalogs the broader tactical lifecycle of network intrusions (such as persistence, lateral movement, credential dumping, and data exfiltration).

In short: CWE describes the vulnerability in code, CAPEC explains how an attacker exploits that vulnerability to breach an application, and ATT&CK describes what the adversary does across the enterprise network once inside.

Strengths and limits

CAPEC offers significant value for preventative cybersecurity engineering, but teams must recognize its practical boundaries:

Strengths:
- Proactive engineering: Embeds offensive reality into the early requirements and design phases of the software development lifecycle (SDLC).
- Structured taxonomy: Provides a repeatable schema (execution flow, prerequisites, mitigations) rather than informal advisory descriptions.
- Public and vendor-neutral: Fully open resource accessible to developers, students, and research organizations without commercial licensing barriers.
Limits:
- Not a live threat feed: CAPEC documents persistent attack patterns and archetypes; it is not a real-time indicator-of-compromise (IOC) database or daily threat stream.
- Application and design focus: While expanding into hardware and supply chains, CAPEC is optimized for software security rather than broad enterprise network monitoring.

When implementing institutional standards such as NIST Cybersecurity Framework 2.0 and enterprise cybersecurity management programs, CAPEC serves as a premier reference for secure architectural design and threat modeling.

Alternatives and complementary frameworks

Security teams often pair CAPEC with other structured methodologies. The table below compares CAPEC with related threat modeling and offensive taxonomies:

Framework	Primary Focus	Primary User	Level of Analysis	Governance Body
CAPEC	Common attack patterns and exploit mechanisms	Software architects, penetration testers	Application and technical attack mechanisms	MITRE / CISA
CWE	Software and hardware design and code weaknesses	Developers, code auditors	Source code and architectural defects	MITRE / CISA
MITRE ATT&CK	Adversary tactics, techniques, and procedures	SOC analysts, threat hunters, red teams	Enterprise network and operational intrusion lifecycle	MITRE
STRIDE	Threat categorization mnemonic	Security architects during threat modeling	High-level system threat categories	Microsoft

Frequently Asked Questions

What is an attack pattern in CAPEC?

In CAPEC, an attack pattern is a formalized description of the common attributes, approaches, and technical methods employed by adversaries to exploit known weaknesses in cyber-enabled capabilities. Attack patterns describe the challenges an attacker faces and how they systematically overcome them to breach a system.

How does CAPEC map to MITRE ATT&CK?

CAPEC maps to MITRE ATT&CK by linking application-level exploitation techniques to broader adversary intrusion tactics. Many attack patterns defined in CAPEC serve as the technical execution mechanism for specific ATT&CK techniques, allowing defenders to trace an operational threat campaign back to specific application exploitation pathways.

Is CAPEC free to use for commercial and academic purposes?

Yes. CAPEC is an open community initiative operated by MITRE and funded by CISA. The catalog, schemas, and classification views are publicly accessible and free to incorporate into commercial products, academic research, and internal organizational development processes under MITRE terms of use.

Sources

MITRE CAPEC Program Overview: https://capec.mitre.org/ (November 8, 2026)
MITRE CAPEC About and History: https://capec.mitre.org/about/index.html (November 8, 2026)
MITRE CAPEC Frequently Asked Questions: https://capec.mitre.org/about/faq.html (November 8, 2026)
MITRE CAPEC and ATT&CK Comparison: https://capec.mitre.org/about/attack_comparison.html (November 8, 2026)
MITRE CAPEC Mechanisms of Attack View (CAPEC-1000): https://capec.mitre.org/data/definitions/1000.html (November 8, 2026)