Attacker techniques (ATT&CK)

697 pages, showing 101–200, ordered by identifier.

T1055.003 — Thread Execution Hijacking Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as...
T1055.004 — Asynchronous Procedure Call Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to...
T1055.005 — Thread Local Storage Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade...
T1055.008 — Ptrace System Calls Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade...
T1055.009 — Proc Memory Adversaries may inject malicious code into processes via the /proc filesystem in order to evade process-based...
T1055.011 — Extra Window Memory Injection Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based...
T1055.012 — Process Hollowing Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based...
T1055.013 — Process Doppelgänging Adversaries may inject malicious code into process via process doppelgänging in order to evade process-based...
T1055.014 — VDSO Hijacking Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process-based defenses as...
T1055.015 — ListPlanting Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade...
T1056 — Input Capture Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal...
T1056.001 — Keylogging Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used...
T1056.002 — GUI Input Capture Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly...
T1056.003 — Web Portal Capture Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit...
T1056.004 — Credential API Hooking Adversaries may hook into Windows application programming interface (API) functions and Linux system functions to...
T1057 — Process Discovery Adversaries may attempt to get information about running processes on a system. Information obtained could be used...
T1059 — Command and Scripting Interpreter Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces...
T1059.001 — PowerShell Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive...
T1059.002 — AppleScript Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control...
T1059.003 — Windows Command Shell Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary...
T1059.004 — Unix Shell Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on...
T1059.005 — Visual Basic Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with...
T1059.006 — Python Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming...
T1059.007 — JavaScript Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent...
T1059.008 — Network Device CLI Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious...
T1059.009 — Cloud API Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various...
T1059.010 — AutoHotKey & AutoIT Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts. AutoIT...
T1059.011 — Lua Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming...
T1059.012 — Hypervisor CLI Adversaries may abuse hypervisor command line interpreters (CLIs) to execute malicious commands. Hypervisor CLIs...
T1059.013 — Container CLI/API Adversaries may abuse built-in CLI tools or API calls to execute malicious commands in containerized environments.
T1068 — Exploitation for Privilege Escalation Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software...
T1069 — Permission Groups Discovery Adversaries may attempt to discover group and permission settings. This information can help adversaries determine...
T1069.001 — Local Groups Adversaries may attempt to find local system groups and permission settings. The knowledge of local system...
T1069.002 — Domain Groups Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level...
T1069.003 — Cloud Groups Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can...
T1070 — Indicator Removal Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend...
T1070.003 — Clear Command History In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal...
T1070.004 — File Deletion Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other...
T1070.005 — Network Share Connection Removal Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation....
T1070.006 — Timestomp Adversaries may modify file time attributes to hide new files or changes to existing files. Timestomping is a...
T1070.007 — Clear Network Connection History and Configurations Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their...
T1070.008 — Clear Mailbox Data Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow...
T1070.009 — Clear Persistence Adversaries may clear artifacts associated with previously established persistence on a host system to remove...
T1070.010 — Relocate Malware Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove...
T1071 — Application Layer Protocol Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending...
T1071.001 — Web Protocols Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network...
T1071.002 — File Transfer Protocols Adversaries may communicate using application layer protocols associated with transferring files to avoid...
T1071.003 — Mail Protocols Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid...
T1071.004 — DNS Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network...
T1071.005 — Publish/Subscribe Protocols Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network...
T1072 — Software Deployment Tools Adversaries may gain access to and use centralized software suites installed within an enterprise to execute...
T1074 — Data Staged Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in...
T1074.001 — Local Data Staging Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration....
T1074.002 — Remote Data Staging Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to...
T1078 — Valid Accounts Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence,...
T1078.001 — Default Accounts Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence,...
T1078.002 — Domain Accounts Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence,...
T1078.003 — Local Accounts Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence,...
T1078.004 — Cloud Accounts Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access,...
T1080 — Taint Shared Content Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network...
T1082 — System Information Discovery An adversary may attempt to get detailed information about the operating system and hardware, including version,...
T1083 — File and Directory Discovery Adversaries may enumerate files and directories or may search in specific locations of a host or network share for...
T1087 — Account Discovery Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a...
T1087.001 — Local Account Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine...
T1087.002 — Domain Account Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which...
T1087.003 — Email Account Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange...
T1087.004 — Cloud Account Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an...
T1090 — Proxy Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for...
T1090.001 — Internal Proxy Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a...
T1090.002 — External Proxy Adversaries may use an external proxy to act as an intermediary for network communications to a command and control...
T1090.003 — Multi-hop Proxy Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender...
T1090.004 — Domain Fronting Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host...
T1091 — Replication Through Removable Media Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to...
T1092 — Communication Through Removable Media Adversaries can perform command and control between compromised hosts on potentially disconnected networks using...
T1095 — Non-Application Layer Protocol Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among...
T1098 — Account Manipulation Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may...
T1098.001 — Additional Cloud Credentials Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim...
T1098.002 — Additional Email Delegate Permissions Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account.
T1098.003 — Additional Cloud Roles An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent...
T1098.004 — SSH Authorized Keys Adversaries may modify the SSH <code>authorized_keys</code> file to maintain persistence on a victim host. Linux...
T1098.005 — Device Registration Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor...
T1098.006 — Additional Container Cluster Roles An adversary may add additional roles or permissions to an adversary-controlled user or service account to maintain...
T1098.007 — Additional Local or Domain Groups An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent...
T1102 — Web Service Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised...
T1102.001 — Dead Drop Resolver Adversaries may use an existing, legitimate external Web service to host information that points to additional...
T1102.002 — Bidirectional Communication Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving...
T1102.003 — One-Way Communication Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised...
T1104 — Multi-Stage Channels Adversaries may create multiple stages for command and control that are employed under different conditions or for...
T1105 — Ingress Tool Transfer Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files...
T1106 — Native API Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native...
T1110 — Brute Force Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password...
T1110.001 — Password Guessing Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords...
T1110.002 — Password Cracking Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when...
T1110.003 — Password Spraying Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to...
T1110.004 — Credential Stuffing Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts...
T1111 — Multi-Factor Authentication Interception Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to...
T1112 — Modify Registry Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense...
T1113 — Screen Capture Adversaries may attempt to take screen captures of the desktop to gather information over the course of an...
T1114 — Email Collection Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including...
T1114.001 — Local Email Collection Adversaries may target user email on local systems to collect sensitive information. Files containing email data can...

Browse by topic

Every page in the corpus, grouped. Search finds one page; this shows what else is here.