Loading AttackTrace...
ATT&CK tactic
96 techniques mapped to this tactic.
Boot or Logon Initialization Scripts (T1037) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. Initialization scripts can be used to perfo…
Logon Script (Windows) (T1037.001) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence.
Login Hook (T1037.002) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may use a Login Hook to establish persistence executed upon user logon.
Network Logon Script (T1037.003) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence.
RC Scripts (T1037.004) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix like system’s startup.
Startup Items (T1037.005) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may use startup items automatically executed at boot initialization to establish persistence.
Scheduled Task/Job (T1053) is a MITRE ATT&CK technique associated with Execution, Persistence, Privilege Escalation . Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.
At (T1053.002) is a MITRE ATT&CK technique associated with Execution, Persistence, Privilege Escalation . Adversaries may abuse the at utility to perform task scheduling for initial or recurring execution of malicious code.
Cron (T1053.003) is a MITRE ATT&CK technique associated with Execution, Persistence, Privilege Escalation . Adversaries may abuse the <code cron</code utility to perform task scheduling for initial or recurring execution of malicious code. The <code cron</code utility is a tim…
Scheduled Task (T1053.005) is a MITRE ATT&CK technique associated with Execution, Persistence, Privilege Escalation . Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code.
Systemd Timers (T1053.006) is a MITRE ATT&CK technique associated with Execution, Persistence, Privilege Escalation . Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code.
Container Orchestration Job (T1053.007) is a MITRE ATT&CK technique associated with Execution, Persistence, Privilege Escalation . Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of contain…
Process Injection (T1055) is a MITRE ATT&CK technique associated with Stealth, Privilege Escalation . Adversaries may inject code into processes in order to evade process based defenses as well as possibly elevate privileges.
Dynamic link Library Injection (T1055.001) is a MITRE ATT&CK technique associated with Stealth, Privilege Escalation . Adversaries may inject dynamic link libraries (DLLs) into processes in order to evade process based defenses as well as possibly elevate privileges.
Portable Executable Injection (T1055.002) is a MITRE ATT&CK technique associated with Stealth, Privilege Escalation . Adversaries may inject portable executables (PE) into processes in order to evade process based defenses as well as possibly elevate privileges.
Thread Execution Hijacking (T1055.003) is a MITRE ATT&CK technique associated with Stealth, Privilege Escalation . Adversaries may inject malicious code into hijacked processes in order to evade process based defenses as well as possibly elevate privileges.
Asynchronous Procedure Call (T1055.004) is a MITRE ATT&CK technique associated with Stealth, Privilege Escalation . Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process based defenses as well as possibly…
Thread Local Storage (T1055.005) is a MITRE ATT&CK technique associated with Stealth, Privilege Escalation . Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade process based defenses as well as possibly elevate privi…
Ptrace System Calls (T1055.008) is a MITRE ATT&CK technique associated with Stealth, Privilege Escalation . Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process based defenses as well as possibly elevate privile…
Proc Memory (T1055.009) is a MITRE ATT&CK technique associated with Stealth, Privilege Escalation . Adversaries may inject malicious code into processes via the /proc filesystem in order to evade process based defenses as well as possibly elevate privileges.
Extra Window Memory Injection (T1055.011) is a MITRE ATT&CK technique associated with Stealth, Privilege Escalation . Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process based defenses as well as possibly elevate privileges.
Process Hollowing (T1055.012) is a MITRE ATT&CK technique associated with Stealth, Privilege Escalation . Adversaries may inject malicious code into suspended and hollowed processes in order to evade process based defenses.
Process Doppelgänging (T1055.013) is a MITRE ATT&CK technique associated with Stealth, Privilege Escalation . Adversaries may inject malicious code into process via process doppelgänging in order to evade process based defenses as well as possibly elevate privileges.
VDSO Hijacking (T1055.014) is a MITRE ATT&CK technique associated with Stealth, Privilege Escalation . Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process based defenses as well as possibly elevate privileges.
ListPlanting (T1055.015) is a MITRE ATT&CK technique associated with Stealth, Privilege Escalation . Adversaries may abuse list view controls to inject malicious code into hijacked processes in order to evade process based defenses as well as possibly elevate privileges.
Exploitation for Privilege Escalation (T1068) is a MITRE ATT&CK technique associated with Privilege Escalation . Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Valid Accounts (T1078) is a MITRE ATT&CK technique associated with Stealth, Persistence, Privilege Escalation, Initial Access . Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense…
Default Accounts (T1078.001) is a MITRE ATT&CK technique associated with Stealth, Persistence, Privilege Escalation, Initial Access . Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or D…
Domain Accounts (T1078.002) is a MITRE ATT&CK technique associated with Stealth, Persistence, Privilege Escalation, Initial Access . Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Def…
Local Accounts (T1078.003) is a MITRE ATT&CK technique associated with Stealth, Persistence, Privilege Escalation, Initial Access . Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defen…
Cloud Accounts (T1078.004) is a MITRE ATT&CK technique associated with Stealth, Persistence, Privilege Escalation, Initial Access . Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or De…
Account Manipulation (T1098) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.
Additional Cloud Credentials (T1098.001) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may add adversary controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.
Additional Email Delegate Permissions (T1098.002) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may grant additional permission levels to maintain persistent access to an adversary controlled email account.
Additional Cloud Roles (T1098.003) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . An adversary may add additional roles or permissions to an adversary controlled cloud account to maintain persistent access to a tenant.
SSH Authorized Keys (T1098.004) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may modify the SSH <code authorized keys</code file to maintain persistence on a victim host.
Device Registration (T1098.005) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may register a device to an adversary controlled account.
Additional Container Cluster Roles (T1098.006) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . An adversary may add additional roles or permissions to an adversary controlled user or service account to maintain persistent access to a container o…
Additional Local or Domain Groups (T1098.007) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . An adversary may add additional local or domain groups to an adversary controlled account to maintain persistent access to a system or domain.
Access Token Manipulation (T1134) is a MITRE ATT&CK technique associated with Stealth, Privilege Escalation . Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls.
Token Impersonation/Theft (T1134.001) is a MITRE ATT&CK technique associated with Stealth, Privilege Escalation . Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls.
Create Process with Token (T1134.002) is a MITRE ATT&CK technique associated with Stealth, Privilege Escalation . Adversaries may create a new process with an existing token to escalate privileges and bypass access controls.
Make and Impersonate Token (T1134.003) is a MITRE ATT&CK technique associated with Stealth, Privilege Escalation . Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls.
Parent PID Spoofing (T1134.004) is a MITRE ATT&CK technique associated with Stealth, Privilege Escalation . Adversaries may spoof the parent process identifier (PPID) of a new process to evade process monitoring defenses or to elevate privileges.
SID History Injection (T1134.005) is a MITRE ATT&CK technique associated with Stealth, Privilege Escalation . Adversaries may use SID History Injection to escalate privileges and bypass access controls.
Domain or Tenant Policy Modification (T1484) is a MITRE ATT&CK technique associated with Defense Impairment, Privilege Escalation . Adversaries may modify the configuration settings of a domain or identity tenant to evade defenses and/or escalate privileges in centrally manage…
Group Policy Modification (T1484.001) is a MITRE ATT&CK technique associated with Defense Impairment, Privilege Escalation . Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of esc…
Trust Modification (T1484.002) is a MITRE ATT&CK technique associated with Defense Impairment, Privilege Escalation . Adversaries may add new domain trusts, modify the properties of existing domain trusts, or otherwise change the configuration of trust relationships between do…
Create or Modify System Process (T1543) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may create or modify system level processes to repeatedly execute malicious payloads as part of persistence.
Launch Agent (T1543.001) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
Systemd Service (T1543.002) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence.
Windows Service (T1543.003) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence.
Launch Daemon (T1543.004) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence.
Container Service (T1543.005) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may create or modify container or container cluster management tools that run as daemons, agents, or services on individual hosts.
Event Triggered Execution (T1546) is a MITRE ATT&CK technique associated with Privilege Escalation, Persistence . Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events.
Change Default File Association (T1546.001) is a MITRE ATT&CK technique associated with Privilege Escalation, Persistence . Adversaries may establish persistence by executing malicious content triggered by a file type association.
Screensaver (T1546.002) is a MITRE ATT&CK technique associated with Privilege Escalation, Persistence . Adversaries may establish persistence by executing malicious content triggered by user inactivity.
Windows Management Instrumentation Event Subscription (T1546.003) is a MITRE ATT&CK technique associated with Privilege Escalation, Persistence . Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instr…
Unix Shell Configuration Modification (T1546.004) is a MITRE ATT&CK technique associated with Privilege Escalation, Persistence . Adversaries may establish persistence through executing malicious commands triggered by a user’s shell.
Trap (T1546.005) is a MITRE ATT&CK technique associated with Privilege Escalation, Persistence . Adversaries may establish persistence by executing malicious content triggered by an interrupt signal.
LC LOAD DYLIB Addition (T1546.006) is a MITRE ATT&CK technique associated with Privilege Escalation, Persistence . Adversaries may establish persistence by executing malicious content triggered by the execution of tainted binaries.
Netsh Helper DLL (T1546.007) is a MITRE ATT&CK technique associated with Privilege Escalation, Persistence . Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs.
Accessibility Features (T1546.008) is a MITRE ATT&CK technique associated with Privilege Escalation, Persistence . Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features.
AppCert DLLs (T1546.009) is a MITRE ATT&CK technique associated with Privilege Escalation, Persistence . Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes.
AppInit DLLs (T1546.010) is a MITRE ATT&CK technique associated with Privilege Escalation, Persistence . Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
Application Shimming (T1546.011) is a MITRE ATT&CK technique associated with Privilege Escalation, Persistence . Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.
Image File Execution Options Injection (T1546.012) is a MITRE ATT&CK technique associated with Privilege Escalation, Persistence . Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) de…
PowerShell Profile (T1546.013) is a MITRE ATT&CK technique associated with Privilege Escalation, Persistence . Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles.
Emond (T1546.014) is a MITRE ATT&CK technique associated with Privilege Escalation, Persistence . Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon (emond).
Component Object Model Hijacking (T1546.015) is a MITRE ATT&CK technique associated with Privilege Escalation, Persistence . Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
Installer Packages (T1546.016) is a MITRE ATT&CK technique associated with Privilege Escalation, Persistence . Adversaries may establish persistence and elevate privileges by using an installer to trigger the execution of malicious content.
Udev Rules (T1546.017) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may maintain persistence through executing malicious content triggered using udev rules.
Python Startup Hooks (T1546.018) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may achieve persistence by leveraging Python’s startup mechanisms, including path configuration (.pth) files and the sitecustomize.py or usercustomize…
Boot or Logon Autostart Execution (T1547) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher level privi…
Registry Run Keys / Startup Folder (T1547.001) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
Authentication Package (T1547.002) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may abuse authentication packages to execute DLLs when the system boots.
Time Providers (T1547.003) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may abuse time providers to execute DLLs when the system boots.
Winlogon Helper DLL (T1547.004) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.
Security Support Provider (T1547.005) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots.
Kernel Modules and Extensions (T1547.006) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may modify the kernel to automatically execute programs on system boot.
Re opened Applications (T1547.007) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may modify plist files to automatically run an application when a user logs in.
LSASS Driver (T1547.008) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
Shortcut Modification (T1547.009) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may create or modify shortcuts that can execute a program during system boot or user login.
Port Monitors (T1547.010) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
Print Processors (T1547.012) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
XDG Autostart Entries (T1547.013) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may add or modify XDG Autostart Entries to execute malicious programs or commands when a user’s desktop environment is loaded at login.
Active Setup (T1547.014) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Login Items (T1547.015) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may add login items to execute upon user login to gain persistence or escalate privileges.
Abuse Elevation Control Mechanism (T1548) is a MITRE ATT&CK technique associated with Privilege Escalation . Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher level permissions.
Setuid and Setgid (T1548.001) is a MITRE ATT&CK technique associated with Privilege Escalation . An adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user’s con…
Bypass User Account Control (T1548.002) is a MITRE ATT&CK technique associated with Privilege Escalation . Adversaries may bypass UAC mechanisms to elevate process privileges on system.
Sudo and Sudo Caching (T1548.003) is a MITRE ATT&CK technique associated with Privilege Escalation . Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges.
Elevated Execution with Prompt (T1548.004) is a MITRE ATT&CK technique associated with Privilege Escalation . Adversaries may leverage the <code AuthorizationExecuteWithPrivileges</code API to escalate privileges by prompting the user for credentials. The purpose of this API i…
Temporary Elevated Cloud Access (T1548.005) is a MITRE ATT&CK technique associated with Privilege Escalation . Adversaries may abuse permission configurations that allow them to gain temporarily elevated access to cloud resources.
TCC Manipulation (T1548.006) is a MITRE ATT&CK technique associated with Privilege Escalation . Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database to grant malicious executables elevated permissions.
Escape to Host (T1611) is a MITRE ATT&CK technique associated with Privilege Escalation . Adversaries may break out of a container or virtualized environment to gain access to the underlying host.