{
  "name": "Hoxhunt PH!SH coverage",
  "domain": "enterprise-attack",
  "versions": {
    "attack": "19",
    "navigator": "5.1.0",
    "layer": "4.5"
  },
  "description": "ATT&CK techniques referenced by the Hoxhunt PH!SH phishing framework (PH!SH v1.0). Score is the number of PH!SH entries mapped to the technique; the comment lists them. Parent techniques with a score of 0 are present only so ATT&CK Navigator can expand their annotated sub-techniques. A technique that ATT&CK files under several tactics is annotated once under each of them. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. PH!SH is not affiliated with or endorsed by The MITRE Corporation.",
  "metadata": [
    {
      "name": "PH!SH version",
      "value": "PH!SH v1.0"
    },
    {
      "name": "PH!SH source",
      "value": "https://framework.hoxhunt.com/attack/"
    },
    {
      "name": "ATT&CK version",
      "value": "Enterprise ATT&CK v19"
    }
  ],
  "techniques": [
    {
      "techniqueID": "T1027",
      "tactic": "stealth",
      "score": 4,
      "enabled": true,
      "comment": "PH!SH: TE0010.1 Obfuscation; TE0010.3 Email Body Is An Image; TE0010.6 Encoded URL; TE0018.1 Constructed QR Code",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0010.1, TE0010.3, TE0010.6, TE0018.1"
        }
      ],
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1027.003",
      "tactic": "stealth",
      "score": 1,
      "enabled": true,
      "comment": "PH!SH: TE0005.9 Image Files",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0005.9"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1027.006",
      "tactic": "stealth",
      "score": 1,
      "enabled": true,
      "comment": "PH!SH: TE0005.2 HTML-Files",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0005.2"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1027.015",
      "tactic": "stealth",
      "score": 1,
      "enabled": true,
      "comment": "PH!SH: TE0005.7 Compressed Files",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0005.7"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1027.017",
      "tactic": "stealth",
      "score": 1,
      "enabled": true,
      "comment": "PH!SH: TE0005.9 Image Files",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0005.9"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1027.018",
      "tactic": "stealth",
      "score": 1,
      "enabled": true,
      "comment": "PH!SH: TE0010.5 Obscured URL",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0010.5"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1036",
      "tactic": "stealth",
      "score": 3,
      "enabled": true,
      "comment": "PH!SH: TE0016 Fake Email Banner; TE0025 Attachment Padding; TE0034 Email Local Part Stuffing",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0016, TE0025, TE0034"
        }
      ],
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1036.002",
      "tactic": "stealth",
      "score": 1,
      "enabled": true,
      "comment": "PH!SH: TE0003 Right-To-Left Override",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0003"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1036.007",
      "tactic": "stealth",
      "score": 2,
      "enabled": true,
      "comment": "PH!SH: TE0005.7 Compressed Files; TE0024 Dual File Type",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0005.7, TE0024"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1036.008",
      "tactic": "stealth",
      "score": 1,
      "enabled": true,
      "comment": "PH!SH: TE0024 Dual File Type",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0024"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1059",
      "tactic": "execution",
      "score": 2,
      "enabled": true,
      "comment": "PH!SH: TE0021 User Execution; TE0021.1 Powershell Commands",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0021, TE0021.1"
        }
      ],
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1059.001",
      "tactic": "execution",
      "score": 1,
      "enabled": true,
      "comment": "PH!SH: TE0021.1 Powershell Commands",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0021.1"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1059.005",
      "tactic": "execution",
      "score": 1,
      "enabled": true,
      "comment": "PH!SH: TE0005.5 Office Files",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0005.5"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1111",
      "tactic": "credential-access",
      "score": 1,
      "enabled": true,
      "comment": "PH!SH: TE0013 AitM Capable Credential Harvester",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0013"
        }
      ],
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1204",
      "tactic": "execution",
      "score": 2,
      "enabled": true,
      "comment": "PH!SH: TE0021 User Execution; TE0021.1 Powershell Commands",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0021, TE0021.1"
        }
      ],
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1204.002",
      "tactic": "execution",
      "score": 3,
      "enabled": true,
      "comment": "PH!SH: TE0005.1 Executables; TE0005.3 PDF-Files; TE0005.5 Office Files",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0005.1, TE0005.3, TE0005.5"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1204.004",
      "tactic": "execution",
      "score": 2,
      "enabled": true,
      "comment": "PH!SH: TE0005.8 Text-Based Files; TE0021.1 Powershell Commands",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0005.8, TE0021.1"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1497",
      "tactic": "stealth",
      "score": 1,
      "enabled": true,
      "comment": "PH!SH: TE0019 Fake CAPTCHA",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0019"
        }
      ],
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1534",
      "tactic": "lateral-movement",
      "score": 1,
      "enabled": true,
      "comment": "PH!SH: TE0011.3 Compromised Internal Email Account",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0011.3"
        }
      ],
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1539",
      "tactic": "credential-access",
      "score": 1,
      "enabled": true,
      "comment": "PH!SH: TE0013 AitM Capable Credential Harvester",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0013"
        }
      ],
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1553",
      "tactic": "defense-impairment",
      "score": 0,
      "enabled": true,
      "comment": "No PH!SH entry maps to the parent technique. Annotated sub-techniques: T1553.005.",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": ""
        }
      ],
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1553.005",
      "tactic": "defense-impairment",
      "score": 1,
      "enabled": true,
      "comment": "PH!SH: TE0005.4 Disk Image",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0005.4"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1557",
      "tactic": "collection",
      "score": 1,
      "enabled": true,
      "comment": "PH!SH: TE0013 AitM Capable Credential Harvester",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0013"
        }
      ],
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1557",
      "tactic": "credential-access",
      "score": 1,
      "enabled": true,
      "comment": "PH!SH: TE0013 AitM Capable Credential Harvester",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0013"
        }
      ],
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1566",
      "tactic": "initial-access",
      "score": 2,
      "enabled": true,
      "comment": "PH!SH: TE0022 Fake Email Thread; TE0029 Email",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0022, TE0029"
        }
      ],
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1566.001",
      "tactic": "initial-access",
      "score": 9,
      "enabled": true,
      "comment": "PH!SH: TE0005 Malicious Attachment; TE0005.1 Executables; TE0005.2 HTML-Files; TE0005.3 PDF-Files; TE0005.4 Disk Image; TE0005.5 Office Files; TE0005.7 Compressed Files; TE0005.8 Text-Based Files; TE0005.9 Image Files",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0005, TE0005.1, TE0005.2, TE0005.3, TE0005.4, TE0005.5, TE0005.7, TE0005.8, TE0005.9"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1566.002",
      "tactic": "initial-access",
      "score": 4,
      "enabled": true,
      "comment": "PH!SH: TE0006 Malicious Link; TE0006.1 Open Redirect; TE0006.2 URL Shortener; TE0027 Spoofed Hyperlink",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0006, TE0006.1, TE0006.2, TE0027"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1566.003",
      "tactic": "initial-access",
      "score": 3,
      "enabled": true,
      "comment": "PH!SH: TE0011.2 Third-Party Service Misuse; TE0031 Teams; TE0033 Contact Form",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0011.2, TE0031, TE0033"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1566.004",
      "tactic": "initial-access",
      "score": 3,
      "enabled": true,
      "comment": "PH!SH: TE0004 Malicious Phone Number; TE0017 Callback Phishing; TE0032 Phone Call",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0004, TE0017, TE0032"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1583",
      "tactic": "resource-development",
      "score": 0,
      "enabled": true,
      "comment": "No PH!SH entry maps to the parent technique. Annotated sub-techniques: T1583.001, T1583.006.",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": ""
        }
      ],
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1583.001",
      "tactic": "resource-development",
      "score": 3,
      "enabled": true,
      "comment": "PH!SH: TE0011.1 Look-Alike Domain; TE0023.1 Reply-To Contains Look-alike Domain; TE0023.3 Email Body Contains Look-alike Domain",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0011.1, TE0023.1, TE0023.3"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1583.006",
      "tactic": "resource-development",
      "score": 2,
      "enabled": true,
      "comment": "PH!SH: TE0010.4 Links To Third-Party Service; TE0011.2 Third-Party Service Misuse",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0010.4, TE0011.2"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1585",
      "tactic": "resource-development",
      "score": 0,
      "enabled": true,
      "comment": "No PH!SH entry maps to the parent technique. Annotated sub-techniques: T1585.002.",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": ""
        }
      ],
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1585.002",
      "tactic": "resource-development",
      "score": 3,
      "enabled": true,
      "comment": "PH!SH: TE0011.5 Free Email Address; TE0023.2 Reply-To Contains Free Email Address; TE0023.4 Email Body Contains Free Email Address",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0011.5, TE0023.2, TE0023.4"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1586",
      "tactic": "resource-development",
      "score": 0,
      "enabled": true,
      "comment": "No PH!SH entry maps to the parent technique. Annotated sub-techniques: T1586.002.",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": ""
        }
      ],
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1586.002",
      "tactic": "resource-development",
      "score": 1,
      "enabled": true,
      "comment": "PH!SH: TE0011.4 Compromised External Email Account",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0011.4"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1588",
      "tactic": "resource-development",
      "score": 0,
      "enabled": true,
      "comment": "No PH!SH entry maps to the parent technique. Annotated sub-techniques: T1588.007.",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": ""
        }
      ],
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1588.007",
      "tactic": "resource-development",
      "score": 1,
      "enabled": true,
      "comment": "PH!SH: TE0026.1 LLM Chat Bot",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0026.1"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1589",
      "tactic": "reconnaissance",
      "score": 1,
      "enabled": true,
      "comment": "PH!SH: TE0009.1 Automated",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0009.1"
        }
      ],
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1589.002",
      "tactic": "reconnaissance",
      "score": 1,
      "enabled": true,
      "comment": "PH!SH: TE0010.7 Reconnaissance Email",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0010.7"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1591",
      "tactic": "reconnaissance",
      "score": 0,
      "enabled": true,
      "comment": "No PH!SH entry maps to the parent technique. Annotated sub-techniques: T1591.004.",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": ""
        }
      ],
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1591.004",
      "tactic": "reconnaissance",
      "score": 1,
      "enabled": true,
      "comment": "PH!SH: TE0009.2 Manual",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0009.2"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1593",
      "tactic": "reconnaissance",
      "score": 0,
      "enabled": true,
      "comment": "No PH!SH entry maps to the parent technique. Annotated sub-techniques: T1593.001.",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": ""
        }
      ],
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1593.001",
      "tactic": "reconnaissance",
      "score": 1,
      "enabled": true,
      "comment": "PH!SH: TE0009.2 Manual",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0009.2"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1598",
      "tactic": "reconnaissance",
      "score": 2,
      "enabled": true,
      "comment": "PH!SH: TE0010.7 Reconnaissance Email; TE0020 Sequential Phishing",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0010.7, TE0020"
        }
      ],
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1598.003",
      "tactic": "reconnaissance",
      "score": 9,
      "enabled": true,
      "comment": "PH!SH: TE0006 Malicious Link; TE0006.1 Open Redirect; TE0006.2 URL Shortener; TE0012 BitB Capable Credential Harvester; TE0013 AitM Capable Credential Harvester; TE0014 Address Pre-Populating; TE0015 Single-Stage Credential Harvester; TE0018 Malicious QR Code; TE0018.1 Constructed QR Code",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0006, TE0006.1, TE0006.2, TE0012, TE0013, TE0014, TE0015, TE0018, TE0018.1"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1598.004",
      "tactic": "reconnaissance",
      "score": 3,
      "enabled": true,
      "comment": "PH!SH: TE0004 Malicious Phone Number; TE0017 Callback Phishing; TE0032 Phone Call",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0004, TE0017, TE0032"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1608",
      "tactic": "resource-development",
      "score": 0,
      "enabled": true,
      "comment": "No PH!SH entry maps to the parent technique. Annotated sub-techniques: T1608.005.",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": ""
        }
      ],
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1608.005",
      "tactic": "resource-development",
      "score": 3,
      "enabled": true,
      "comment": "PH!SH: TE0006.1 Open Redirect; TE0006.2 URL Shortener; TE0010.4 Links To Third-Party Service",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0006.1, TE0006.2, TE0010.4"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1621",
      "tactic": "credential-access",
      "score": 2,
      "enabled": true,
      "comment": "PH!SH: TH0035 MFA; TH0045 Account Authentication",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TH0035, TH0045"
        }
      ],
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1657",
      "tactic": "impact",
      "score": 5,
      "enabled": true,
      "comment": "PH!SH: TH0015 Invoice Phishing; TH0016 Supply Chain Fraud; TH0017 Fake Extortion; TH0018 Data Exploitation and Illicit Sales; TH0022 Romance Scam",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TH0015, TH0016, TH0017, TH0018, TH0022"
        }
      ],
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1683",
      "tactic": "resource-development",
      "score": 2,
      "enabled": true,
      "comment": "PH!SH: TE0026.1 LLM Chat Bot; TH0023 Disinformation",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0026.1, TH0023"
        }
      ],
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1684",
      "tactic": "stealth",
      "score": 10,
      "enabled": true,
      "comment": "PH!SH: TE0007 Pretexting; TE0008 Behavioral and Emotional Triggers; TE0016 Fake Email Banner; TE0020 Sequential Phishing; TE0025 Attachment Padding; TE0026 Live Chat; TE0026.1 LLM Chat Bot; TE0028 Emotional Framing; TH0017 Fake Extortion; TH0022 Romance Scam",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0007, TE0008, TE0016, TE0020, TE0025, TE0026, TE0026.1, TE0028, TH0017, TH0022"
        }
      ],
      "showSubtechniques": true
    },
    {
      "techniqueID": "T1684.001",
      "tactic": "stealth",
      "score": 5,
      "enabled": true,
      "comment": "PH!SH: TE0022 Fake Email Thread; TH0010 External Authority Impersonation; TH0011 Internal Authority Impersonation; TH0016 Supply Chain Fraud; TH0044 Government Entity Impersonation",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0022, TH0010, TH0011, TH0016, TH0044"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1684.002",
      "tactic": "stealth",
      "score": 2,
      "enabled": true,
      "comment": "PH!SH: TE0001 Spoofed Sender; TE0002 Spoofed HOPS",
      "metadata": [
        {
          "name": "PH!SH entries",
          "value": "TE0001, TE0002"
        }
      ],
      "showSubtechniques": false
    }
  ],
  "gradient": {
    "colors": [
      "#1a1c34ff",
      "#6f5f9cff",
      "#8d7cc0ff",
      "#b3a3ddff",
      "#e6dbffff"
    ],
    "minValue": 0,
    "maxValue": 10
  },
  "legendItems": [],
  "showTacticRowBackground": false,
  "tacticRowBackground": "#14132b",
  "selectTechniquesAcrossTactics": true,
  "sorting": 0,
  "hideDisabled": false,
  "layout": {
    "layout": "side",
    "showID": true,
    "showName": true,
    "expandedSubtechniques": "annotated"
  }
}