Attacker techniques (ATT&CK)

697 pages, showing 1–100, ordered by identifier.

T1001 — Data Obfuscation Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2)...
T1001.001 — Junk Data Adversaries may add junk data to protocols used for command and control to make detection more difficult. By adding...
T1001.002 — Steganography Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more...
T1001.003 — Protocol or Service Impersonation Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and...
T1003 — OS Credential Dumping Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of...
T1003.001 — LSASS Memory Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority...
T1003.002 — Security Account Manager Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either...
T1003.003 — NTDS Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal...
T1003.004 — LSA Secrets Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can...
T1003.005 — Cached Domain Credentials Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a...
T1003.006 — DCSync Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain...
T1003.007 — Proc Filesystem Adversaries may gather credentials from the proc filesystem or /proc. The proc filesystem is a pseudo-filesystem...
T1003.008 — /etc/passwd and /etc/shadow Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable...
T1005 — Data from Local System Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual...
T1006 — Direct Volume Access Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows...
T1007 — System Service Discovery Adversaries may try to gather information about registered local system services. Adversaries may obtain information...
T1008 — Fallback Channels Adversaries may use fallback or alternate communication channels if the primary channel is compromised or...
T1010 — Application Window Discovery Adversaries may attempt to get a listing of open application windows. Window listings could convey information about...
T1011 — Exfiltration Over Other Network Medium Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If...
T1011.001 — Exfiltration Over Bluetooth Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the...
T1012 — Query Registry Adversaries may interact with the Windows Registry to gather information about the system, configuration, and...
T1014 — Rootkit Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and...
T1016 — System Network Configuration Discovery Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of...
T1016.001 — Internet Connection Discovery Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated...
T1016.002 — Wi-Fi Discovery Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised...
T1018 — Remote System Discovery Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a...
T1020 — Automated Exfiltration Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being...
T1020.001 — Traffic Duplication Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure....
T1021 — Remote Services Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and...
T1021.001 — Remote Desktop Protocol Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may...
T1021.002 — SMB/Windows Admin Shares Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The...
T1021.003 — Distributed Component Object Model Adversaries may use Valid Accounts to interact with remote machines by taking advantage of Distributed Component...
T1021.004 — SSH Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary may then...
T1021.005 — VNC Adversaries may use Valid Accounts to remotely control machines using Virtual Network Computing (VNC). VNC is a...
T1021.006 — Windows Remote Management Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The...
T1021.007 — Cloud Services Adversaries may log into accessible cloud services within a compromised environment using Valid Accounts that are...
T1021.008 — Direct Cloud VM Connections Adversaries may leverage Valid Accounts to log directly into accessible cloud hosted compute infrastructure through...
T1025 — Data from Removable Media Adversaries may search connected removable media on computers they have compromised to find files of interest....
T1027 — Obfuscated Files or Information Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or...
T1027.001 — Binary Padding Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be...
T1027.002 — Software Packing Adversaries may perform software packing or virtual machine software protection to conceal their code. Software...
T1027.003 — Steganography Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic...
T1027.004 — Compile After Delivery Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as...
T1027.005 — Indicator Removal from Tools Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or...
T1027.006 — HTML Smuggling Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign...
T1027.007 — Dynamic API Resolution Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal...
T1027.008 — Stripped Payloads Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human...
T1027.009 — Embedded Payloads Adversaries may embed payloads within other files to conceal malicious content from defenses. Otherwise seemingly...
T1027.010 — Command Obfuscation Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method...
T1027.011 — Fileless Storage Adversaries may store data in 'fileless' formats to conceal malicious activity from defenses. Fileless storage can...
T1027.012 — LNK Icon Smuggling Adversaries may smuggle commands to download malicious payloads past content filters by hiding them within otherwise...
T1027.013 — Encrypted/Encoded File Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede...
T1027.014 — Polymorphic Code Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection....
T1027.015 — Compression Adversaries may use compression to obfuscate their payloads or files. Compressed file formats such as ZIP, gzip, 7z,...
T1027.016 — Junk Code Insertion Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code that either does...
T1027.017 — SVG Smuggling Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign...
T1027.018 — Invisible Unicode Adversaries may abuse invisible or non-printing Unicode characters to conceal malicious content within files,...
T1029 — Scheduled Transfer Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals....
T1030 — Data Transfer Size Limits An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain...
T1033 — System Owner/User Discovery Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a...
T1036 — Masquerading Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users...
T1036.001 — Invalid Code Signature Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user,...
T1036.002 — Right-to-Left Override Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file...
T1036.003 — Rename Legitimate Utilities Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of...
T1036.004 — Masquerade Task or Service Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign....
T1036.005 — Match Legitimate Resource Name or Location Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources...
T1036.006 — Space after Filename Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types...
T1036.007 — Double File Extension Adversaries may abuse a double extension in the filename as a means of masquerading the true file type. A file name...
T1036.008 — Masquerade File Type Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting,...
T1036.009 — Break Process Trees An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID...
T1036.010 — Masquerade Account Name Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign. This...
T1036.011 — Overwrite Process Arguments Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or...
T1036.012 — Browser Fingerprint Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating...
T1037 — Boot or Logon Initialization Scripts Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. Initiali
T1037.001 — Logon Script (Windows) Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence....
T1037.002 — Login Hook Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file...
T1037.003 — Network Logon Script Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence....
T1037.004 — RC Scripts Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system’s...
T1037.005 — Startup Items Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup...
T1039 — Data from Network Shared Drive Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data...
T1040 — Network Sniffing Adversaries may passively sniff network traffic to capture information about an environment, including...
T1041 — Exfiltration Over C2 Channel Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded...
T1046 — Network Service Discovery Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure...
T1047 — Windows Management Instrumentation Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is...
T1048 — Exfiltration Over Alternative Protocol Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and...
T1048.001 — Exfiltration Over Symmetric Encrypted Non-C2 Protocol Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the...
T1048.002 — Exfiltration Over Asymmetric Encrypted Non-C2 Protocol Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of...
T1048.003 — Exfiltration Over Unencrypted Non-C2 Protocol Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing...
T1049 — System Network Connections Discovery Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently...
T1052 — Exfiltration Over Physical Medium Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain...
T1052.001 — Exfiltration over USB Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as...
T1053 — Scheduled Task/Job Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code....
T1053.002 — At Adversaries may abuse the at utility to perform task scheduling for initial or recurring execution of malicious code. The at
T1053.003 — Cron Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of...
T1053.005 — Scheduled Task Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of...
T1053.006 — Systemd Timers Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious...
T1053.007 — Container Orchestration Job Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to...
T1055 — Process Injection Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate...
T1055.001 — Dynamic-link Library Injection Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well...
T1055.002 — Portable Executable Injection Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as...

Browse by topic

Every page in the corpus, grouped. Search finds one page; this shows what else is here.