Current Explorer scope

Explorer currently supports 15 ATT&CK-aligned network behaviors.

This is the current Explorer behavior scope. It is not a claim of complete ATT&CK coverage.

T1018Remote System Discovery

T1049System Network Connections Discovery

T1087Account Discovery

T1046Network Service Discovery

T1021Remote Services

T1059Command and Scripting Interpreter

T1570Lateral Tool Transfer

T1569.002Service Execution

T1048Exfiltration Over Alternative Protocol

T1095Non-Application Layer Protocol

T1573Encrypted Channel

T1020Automated Exfiltration

T1105Ingress Tool Transfer

T1071Application Layer Protocol

T1041Exfiltration Over C2 Channel

Coverage boundary

These mappings describe the network behaviors supported by Explorer today. They do not imply endpoint emulation, malware execution, full adversary emulation, or complete MITRE ATT&CK coverage.

See the output

Inspect the supported behavior in the public PCAPs.

Use the public sample datasets to inspect NetMetria-generated traffic directly.

Inspect sample PCAPs