/MITRE ATT&CK Reference

Adversaries may send phishing messages to gain access to victim systems.

Adversaries may attempt to take advantage of a weakness in an Internet-facing computer or program using software exploits.

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access.

Adversaries may manipulate products or product delivery mechanisms prior to receipt.

Adversaries may abuse PowerShell commands and scripts for execution.

Adversaries may abuse Unix shell commands and scripts for execution.

Adversaries may abuse WMI to execute malicious commands and payloads.

Adversaries may rely on specific actions by a user in order to gain execution.

Adversaries may create or modify Windows services to repeatedly execute malicious payloads.

Adversaries may create or modify systemd services to repeatedly execute malicious payloads.

Adversaries may configure system settings to automatically execute a program during system boot or logon.

Adversaries may backdoor web servers with web shells to establish persistent access.

Adversaries may abuse the Windows Task Scheduler to perform task scheduling.

Adversaries may abuse the cron utility to perform task scheduling for persistence.

Adversaries may bypass UAC mechanisms to elevate process privileges on system.

Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges.

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

Adversaries may impair defensive mechanisms by disabling or modifying security tools.

Adversaries may clear Windows Event Logs to hide the activity of an intrusion.

Adversaries may clear system logs to hide the activity of an intrusion.

Adversaries may clear the command history of a compromised account to hide the actions performed.

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).

Adversaries may attempt to access the /etc/passwd and /etc/shadow files to discover credentials.

Adversaries may attempt to steal or forge Kerberos authentication tickets.

Adversaries may use brute force techniques to attempt access to accounts when passwords are unknown.

Adversaries may search for common password storage locations to obtain user credentials.

Adversaries may look for details about the network configuration and settings.

Adversaries may enumerate files and directories or search specific locations.

Adversaries may attempt to find domain-level groups and permission settings.

Adversaries may use Valid Accounts to log into a service specifically designed to accept remote connections via RDP.

Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH).

Adversaries may use stolen password hashes to bypass normal authentication.

Adversaries may compress and/or encrypt data that is collected prior to exfiltration.

Adversaries may communicate using application layer protocols to avoid detection.

Adversaries may transfer tools or other files from an external system into a compromised environment.

Adversaries may use an existing, legitimate external Web service to exfiltrate data.

Adversaries may steal data by exfiltrating it over a different protocol than that of the C2 channel.

Adversaries may encrypt data on target systems to interrupt availability.

Adversaries may destroy data and files on specific systems.

Adversaries may manipulate accounts to maintain or elevate access to victim systems.

Adversaries may request service tickets and crack vulnerable service-account material offline.

Adversaries may search web-browser data stores for credentials.

Adversaries may identify shared folders and drives on local or remote systems.

Adversaries may delete files to remove artifacts or tools.

Adversaries may abuse cmd.exe and its commands for execution.

Adversaries may communicate using DNS to avoid or blend with normal traffic.

Adversaries may rely on a user clicking a malicious link to gain execution.

Adversaries may rely on a user opening a malicious file to gain execution.

Adversaries may send spearphishing emails with malicious attachments.

Adversaries may send spearphishing messages containing malicious links.

Adversaries may obtain credentials from the Security Account Manager database.

Adversaries may exfiltrate data to a cloud storage service.

Adversaries may rely on a user copying and pasting malicious commands or content.

Adversaries may scan victim-owned infrastructure to gather information for targeting.

Adversaries may gather information about victim hosts that can be used to plan targeting.

Adversaries may buy or register domains to support operations.

Adversaries may obtain capabilities such as malware, exploits or credentials for use in operations.

Adversaries may detect analysis environments and change or suppress malicious behavior.