MITRE ATT&CK for Visual Studio Code
Provides features for working with MITRE ATT&CK techniques.
This extension provides Intellisense-like support for ATT&CK tactics, techniques and sub-techniques. This includes completions for technique names too, so typing either
If enabled, code completion is supported for Group, Mitigation, and Software IDs/names. However, by default, these providers are disabled. To enable them, go into the
This extension provides descriptions when hovering over tactic and technique IDs, which include the name, MITRE ATT&CK source link, and configurable descriptions pulled from the ATT&CK technique information.
Like code completion, hovers are supported for Group, Mitigation, and Software IDs, and they can be enabled using the appropriate toggles.
This extension provides a command that allows searching for techniques by their technique IDs, names, or interesting keywords found in the descriptions.
For example, searching for the keyword
The extension will attempt to keep track of new versions of the MITRE ATT&CK framework and download them from The Cyber Threat Intelligence Repository of ATT&CK and CAPEC catalogs if available.
The version of ATT&CK currently in use will be displayed in the lower right-hand corner of the IDE (e.g.
Clicking on this item will also execute the
Certain aspects of this extension can be configured using the Visual Studio Code Settings page.
By default, this extension applies to saved Markdown and YAML files, but this setting is configurable using the
Users can add DocumentFilters to register new document types.
For example, if a user wants this extension to apply to all Python scripts, all
By default, this extension inserts ATT&CK objects by their object ID, such as
Users can modify the setting
By default, this extension displays only the first line in ATT&CK object descriptions, such as those found in the Hover and Code Completion messages.
Users can modify the