CAPEC describes how attacks work. TLCTC classifies which generic vulnerability they exploit. The two questions cut across each other, which is why a CAPEC category cannot simply be renamed as a TLCTC cluster, and why the catalogue remains useful beneath the clusters.
This page is part of our MITRE overview, alongside ATT&CK and CWE.
What CAPEC is
CAPEC, the Common Attack Pattern Enumeration and Classification, is MITRE’s “publicly available catalog of common attack patterns that helps users understand how adversaries exploit weaknesses in applications and other cyber-enabled capabilities”.[1]
| CAPEC 3.9 | Figure |
|---|---|
| Latest version | 3.9, 24 January 2023[2] |
| Entries | 559 |
| Abstraction | 61 Meta, 181 Standard, 317 Detailed |
| Status | 402 Draft, 154 Stable, 2 Usable, 1 Obsolete |
| Name at least one CWE | 450 |
| Name at least one ATT&CK technique | 177 |
| Name both | 143 |
CAPEC has not changed since January 2023, but its site still lists 3.9 as the latest version and we found no retirement notice. We therefore describe it as unchanged, not retired.
More than software exploits
MITRE describes CAPEC’s focus as application security.[3] Its scope is wider than that label suggests. The Domains of Attack view covers six domains: Software, Hardware, Communications, Supply Chain, Social Engineering and Physical Security.[4]
It also recognises the abuse of legitimate functions. CAPEC-212 Functionality Misuse reads:
“An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact. The system functionality is not altered or modified but used in a way that was not intended.”[5]
That is close to the idea behind #1 Abuse of Functions. Its links show the limits of the surrounding structure, though. CAPEC-212 itself names no ATT&CK technique, and the three weaknesses it names are CWE-1242, CWE-1246 and CWE-1281, which concern hardware features and behaviour. More specific patterns do carry such links: CAPEC-575 Account Footprinting names T1087. The MITRE overview measures those links across all three catalogues.
Mechanism is not cause
CAPEC’s Mechanisms of Attack view organises patterns by “mechanisms that are frequently employed when exploiting a vulnerability”. It is explicit about its limits: the categories “do not, however, represent the consequences or goals of the attacks”, and “there exists the potential for some attack patterns to align with more than one category depending on one’s perspective”.[6]
That is a reasonable design for a catalogue of techniques. It also means its categories do not line up with generic vulnerabilities. Patterns in one category reach several TLCTC clusters:
| CAPEC 3.9 category | Member pattern | TLCTC |
|---|---|---|
| 210 Abuse Existing Functionality | 212 Functionality Misuse | #1 |
| 125 Flooding | #6 | |
| 216 Communication Channel Manipulation | #5 | |
| 225 Subvert Access Control | 94 Adversary in the Middle | #5 |
| 560 Use of Known Domain Credentials | #4 | |
| 507 Physical Theft | #8 | |
| 152 Inject Unexpected Items | 248 Command Injection | #2 → #7 |
| 624 Hardware Fault Injection | #8 | |
| 262 Manipulate System Resources | 438 Modification During Manufacture | #10 |
| 176 Configuration/Environment Manipulation | #1 |
The table comes from Table 2 of the TLCTC v2.7 core paper.[7] Even the category named Abuse Existing Functionality is not equivalent to #1: it also holds flooding and channel manipulation, which TLCTC separates under R-SPECIFIC.
Using CAPEC with TLCTC
The two work at different levels. MITRE recommends CAPEC for application threat modeling, developer training and penetration testing.[3] Those uses stand. A pattern’s execution flow, prerequisites and mitigations carry operational detail that a top-level cluster deliberately leaves out. TLCTC supplies the top level the patterns can roll up into.
- Read the pattern for its mechanism. Use CAPEC’s description, prerequisites and execution flow.
- Ask which generic vulnerability it exploits in your context. Do not classify by the pattern’s name or category.
- Split it if it spans more than one. Under Axiom VI one step maps to one cluster, so a pattern such as command injection becomes #2 → #7.
Sources
- [1] MITRE, About CAPEC.
- [2] MITRE, CAPEC News. Counts on this page are ours, from the CAPEC 3.9 CSV, 1 November 2026.
- [3] MITRE, CAPEC: ATT&CK Comparison.
- [4] MITRE, CAPEC View 3000: Domains of Attack.
- [5] MITRE, CAPEC-212: Functionality Misuse.
- [6] MITRE, CAPEC View 1000: Mechanisms of Attack.
- [7] TLCTC v2.7 core paper, Section 1.1, Table 2. MITRE and CAPEC are trademarks of The MITRE Corporation; this page is independent of MITRE.
TLCTC Framework · v2.7 · CC BY 4.0