Loading AttackTrace...
ATT&CK tactic
41 techniques mapped to this tactic.
Data from Local System (T1005) is a MITRE ATT&CK technique associated with Collection . Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive da…
Data from Removable Media (T1025) is a MITRE ATT&CK technique associated with Collection . Adversaries may search connected removable media on computers they have compromised to find files of interest.
Data from Network Shared Drive (T1039) is a MITRE ATT&CK technique associated with Collection . Adversaries may search network shares on computers they have compromised to find files of interest.
Input Capture (T1056) is a MITRE ATT&CK technique associated with Collection, Credential Access . Adversaries may use methods of capturing user input to obtain credentials or collect information.
Keylogging (T1056.001) is a MITRE ATT&CK technique associated with Collection, Credential Access . Adversaries may log user keystrokes to intercept credentials as the user types them.
GUI Input Capture (T1056.002) is a MITRE ATT&CK technique associated with Collection, Credential Access . Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt.
Web Portal Capture (T1056.003) is a MITRE ATT&CK technique associated with Collection, Credential Access . Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service.
Credential API Hooking (T1056.004) is a MITRE ATT&CK technique associated with Collection, Credential Access . Adversaries may hook into Windows application programming interface (API) functions and Linux system functions to collect user credentials.
Data Staged (T1074) is a MITRE ATT&CK technique associated with Collection . Adversaries may stage collected data in a central location or directory prior to Exfiltration.
Local Data Staging (T1074.001) is a MITRE ATT&CK technique associated with Collection . Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration.
Remote Data Staging (T1074.002) is a MITRE ATT&CK technique associated with Collection . Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration.
Screen Capture (T1113) is a MITRE ATT&CK technique associated with Collection . Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation.
Email Collection (T1114) is a MITRE ATT&CK technique associated with Collection . Adversaries may target user email to collect sensitive information.
Local Email Collection (T1114.001) is a MITRE ATT&CK technique associated with Collection . Adversaries may target user email on local systems to collect sensitive information.
Remote Email Collection (T1114.002) is a MITRE ATT&CK technique associated with Collection . Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information.
Email Forwarding Rule (T1114.003) is a MITRE ATT&CK technique associated with Collection . Adversaries may setup email forwarding rules to collect sensitive information.
Clipboard Data (T1115) is a MITRE ATT&CK technique associated with Collection . Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Automated Collection (T1119) is a MITRE ATT&CK technique associated with Collection . Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Audio Capture (T1123) is a MITRE ATT&CK technique associated with Collection . Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture audio.
Video Capture (T1125) is a MITRE ATT&CK technique associated with Collection . An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering i…
Browser Session Hijacking (T1185) is a MITRE ATT&CK technique associated with Collection . A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as…
Data from Information Repositories (T1213) is a MITRE ATT&CK technique associated with Collection . Adversaries may leverage information repositories to mine valuable information.
Confluence (T1213.001) is a MITRE ATT&CK technique associated with Collection . Adversaries may leverage Confluence repositories to mine valuable information.
Sharepoint (T1213.002) is a MITRE ATT&CK technique associated with Collection . Adversaries may leverage the SharePoint repository as a source to mine valuable information.
Code Repositories (T1213.003) is a MITRE ATT&CK technique associated with Collection . Adversaries may leverage code repositories to collect valuable information.
Customer Relationship Management Software (T1213.004) is a MITRE ATT&CK technique associated with Collection . Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable information.
Messaging Applications (T1213.005) is a MITRE ATT&CK technique associated with Collection . Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information.
Databases (T1213.006) is a MITRE ATT&CK technique associated with Collection . Adversaries may leverage databases to mine valuable information.
Data from Cloud Storage (T1530) is a MITRE ATT&CK technique associated with Collection . Adversaries may access data from cloud storage.
Adversary in the Middle (T1557) is a MITRE ATT&CK technique associated with Credential Access, Collection . Adversaries may attempt to position themselves between two or more networked devices using an adversary in the middle (AiTM) technique to support follow on behaviors suc…
Name Resolution Poisoning and SMB Relay (T1557.001) is a MITRE ATT&CK technique associated with Credential Access, Collection . By responding to LLMNR/NBT NS/mDNS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an…
ARP Cache Poisoning (T1557.002) is a MITRE ATT&CK technique associated with Credential Access, Collection . Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices.
DHCP Spoofing (T1557.003) is a MITRE ATT&CK technique associated with Credential Access, Collection . Adversaries may redirect network traffic to adversary owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the…
Evil Twin (T1557.004) is a MITRE ATT&CK technique associated with Credential Access, Collection . By using a Service Set Identifier (SSID) of a legitimate Wi Fi network, fraudulent Wi Fi access points may trick devices or users into connecting to malicious Wi Fi networks. Adve…
Archive Collected Data (T1560) is a MITRE ATT&CK technique associated with Collection . An adversary may compress and/or encrypt data that is collected prior to exfiltration.
Archive via Utility (T1560.001) is a MITRE ATT&CK technique associated with Collection . Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.
Archive via Library (T1560.002) is a MITRE ATT&CK technique associated with Collection . An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries.
Archive via Custom Method (T1560.003) is a MITRE ATT&CK technique associated with Collection . An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method.
Data from Configuration Repository (T1602) is a MITRE ATT&CK technique associated with Collection . Adversaries may collect data related to managed devices from configuration repositories.
SNMP (MIB Dump) (T1602.001) is a MITRE ATT&CK technique associated with Collection . Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP).
Network Device Configuration Dump (T1602.002) is a MITRE ATT&CK technique associated with Collection . Adversaries may access network configuration files to collect sensitive data about the device and the network.