CAPEC.

Common Attack Pattern Enumeration and Classification, a MITRE-maintained public catalogue of attack patterns used by adversaries to exploit known weaknesses. It belongs to the Compliance & Frameworks category of cybersecurity.

Common Attack Pattern Enumeration and Classification, a MITRE-maintained public catalogue of attack patterns used by adversaries to exploit known weaknesses.

CAPEC (Common Attack Pattern Enumeration and Classification) is a MITRE-stewarded community resource that describes common patterns adversaries use to exploit software, hardware, and operational weaknesses. Each entry has a unique CAPEC-ID, a description, prerequisites, attack steps, related weaknesses (CWE), and mitigations, organized into hierarchies such as Mechanisms of Attack and Domains of Attack (Software, Hardware, Supply Chain, Communications, Social Engineering, Physical). CAPEC complements CWE (weaknesses), CVE (vulnerabilities), and ATT&CK (real-world adversary techniques), and is widely used by threat modelers, secure-design reviewers, red teams, and pentest scoping to enumerate concrete attack scenarios.

Defences for CAPEC typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Common Attack Pattern Enumeration and Classification, CAPEC.