CAPEC.

CAPEC (Common Attack Pattern Enumeration and Classification) is a MITRE-stewarded community resource, sponsored by CISA, that describes common patterns adversaries use to exploit software, hardware, and operational weaknesses. Each entry has a unique CAPEC-ID, a description, prerequisites, attack steps, severity/likelihood, related weaknesses (CWE), and mitigations. As of version 3.9 (released January 2023) the catalogue holds 559 attack patterns.

Patterns are organised by Mechanisms of Attack (e.g. Engage in Deceptive Interactions, Inject Unexpected Items, Manipulate Data Structures) and by Domains of Attack (Software, Hardware, Communications, Supply Chain, Social Engineering, Physical Security). Entries sit at an abstraction level — Meta, Standard, or Detailed — so CAPEC-66 (SQL Injection) refines the broader CAPEC-152 (Inject Unexpected Items).

flowchart TD
  CAT[CAPEC catalogue] --> MECH[Mechanisms of Attack]
  CAT --> DOM[Domains of Attack]
  MECH --> META["Meta pattern<br/>(abstract)"]
  META --> STD["Standard pattern"]
  STD --> DET["Detailed pattern<br/>e.g. CAPEC-66 SQLi"]
  DET -->|exploits| CWE[Related CWE weakness]
  DET -->|realised by| ATTACK[ATT&CK technique]

CAPEC complements CWE (weaknesses), CVE (specific vulnerabilities), and ATT&CK (observed adversary techniques), which cross-reference each other. Threat modelers, secure-design reviewers, red teams, and pentest scopers use it to enumerate concrete attack scenarios and to justify the controls that counter each one.