CAPEC — the Common Attack Pattern Enumeration and Classification — is a public catalog maintained by MITRE (the same organization behind ATT&CK and the CWE weakness list) that documents, in detail, the recurring ways attackers actually exploit things. Where a CWE entry describes a weakness in the abstract ("improper input validation") and an ATT&CK technique describes an adversary's post-compromise behavior in a live campaign, CAPEC sits in between: it documents the reusable attack mechanism — SQL injection, phishing, session fixation, buffer overflow — as a named, numbered, structured pattern anyone can reference the same way.
Quick definition: CAPEC is MITRE's public catalog of documented attack patterns, each with a stable ID (e.g. CAPEC-66), describing how a specific class of weakness is commonly exploited — prerequisites, required skill, typical mitigations, and links to the CWEs it targets and the CVEs where it's shown up in the wild.
How CAPEC fits with CWE, CVE, and ATT&CK
These four MITRE-adjacent catalogs answer four different questions about the same underlying problem, and CAPEC is the piece that connects the abstract to the concrete:
| Catalog | Question it answers | Example |
|---|---|---|
| CWE | What kind of weakness is this, in the abstract? | CWE-89: Improper Neutralization of Special Elements in SQL Commands |
| CAPEC | How does an attacker typically exploit that weakness? | CAPEC-66: SQL Injection |
| CVE | Where has this actually shown up, in a specific product? | A specific SQL injection CVE in a named product/version |
| ATT&CK | How does this fit into a broader real-world adversary campaign? | T1190: Exploit Public-Facing Application |
CAPEC entries link directly to related CWEs ("this pattern typically targets these weaknesses") and to example CVEs where the pattern was used, so you can walk from an abstract weakness class down to concrete, cited incidents without leaving MITRE's own taxonomy.
CAPEC vs. MITRE ATT&CK: a common point of confusion
Both are MITRE catalogs, both use IDs, and both get referenced in the same conversations — but they're scoped differently. ATT&CK is organized around adversary behavior observed in real intrusions: tactics (the "why," like Initial Access or Privilege Escalation) and techniques (the "how," like Phishing or Valid Accounts), built from threat intelligence reporting on actual campaigns. CAPEC is organized around attack mechanisms against software and systems, most of it grounded in application and system-level weaknesses rather than network intrusion behavior — it existed before ATT&CK and predates its focus on adversary tracking.
In practice: reach for ATT&CK when you're thinking about an adversary's overall campaign — how they'd move through your environment after getting a foothold. Reach for CAPEC when you're thinking about a specific weakness in a specific component — how would someone actually exploit this input field, this authentication check, this API endpoint. Attack tree leaf nodes are almost always the second kind of question, which is why CAPEC — not ATT&CK — is usually the better fit for tagging them.
CAPEC's structure
CAPEC organizes patterns into domains of attack (Software, Hardware, Communications, Supply Chain, Social Engineering, Physical Security) and arranges them hierarchically — broad "meta" patterns at the top, increasingly specific patterns underneath. Each individual entry follows a consistent structure:
- ID and name — a stable reference like CAPEC-66: SQL Injection
- Likelihood of attack and typical severity — how common and how damaging this pattern tends to be
- Prerequisites — what has to be true about the target for this pattern to apply
- Skills and resources required — how sophisticated an attacker needs to be
- Execution flow — the actual steps: explore, experiment, exploit
- Related weaknesses — the CWE entries this pattern typically targets
- Mitigations — concrete defensive measures, not generic advice
A handful of patterns that show up constantly in real attack trees, with their CAPEC IDs:
| CAPEC ID | Pattern | Typical attack tree leaf |
|---|---|---|
| 66 | SQL Injection | "Inject malicious SQL via unvalidated search field" |
| 98 | Phishing | "Trick an employee into entering credentials on a lookalike login page" |
| 94 | Adversary-in-the-Middle | "Intercept and alter traffic on an unencrypted internal link" |
| 16 | Dictionary-based Password Attack | "Brute-force a login with a common-password list" |
Why CAPEC is the natural source for attack tree leaves
An attack tree's leaf nodes are, by definition, answers to "how would an attacker actually accomplish this step" — and that's exactly the question each CAPEC entry is built to answer. Writing a leaf as "Attacker exploits SQL injection in the login form" is fine, but it's ad hoc: it depends on whoever wrote it having the same mental model as whoever reads it later. Writing it as "CAPEC-66: SQL Injection" instead pins it to a maintained, structured definition with its own prerequisites, mitigations, and related weaknesses attached — anyone on the team, or auditing the tree six months later, gets the same shared reference instead of a free-text guess.
This is also where STRIDE and CAPEC compose cleanly rather than compete: STRIDE tells you what category of threat you're looking at against a DFD element (Tampering, Information Disclosure, and so on), and CAPEC gives you the concrete, named mechanism that actually realizes it. A Tampering threat against a data store might realize as CAPEC-66 (SQL Injection) or CAPEC-108 (Command Line Execution through SQL Injection) depending on the specifics — STRIDE narrows the search space, CAPEC names the actual attack.
CAPEC vs. the OWASP Top 10
The OWASP Top 10 is a prioritized list of the ten most critical web application risk categories, refreshed periodically and aimed at raising awareness of what matters most right now. CAPEC is a much larger, more granular catalog of attack mechanisms, not ranked by current relevance and not limited to web applications. In practice they overlap heavily — most OWASP Top 10 categories map to a cluster of specific CAPEC patterns underneath them — but OWASP is the "start here, these matter most" list, while CAPEC is the detailed reference you reach for once you know which specific mechanism you're documenting.