Data Obfuscation (T1001) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attemp…

Command and Control

4 platforms

T1001.001

Junk Data

Junk Data (T1001.001) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may add junk data to protocols used for command and control to make detection more difficult. By adding random or meaningless data to the protocols used for command and control,…

Command and Control

4 platforms

T1001.002

Steganography

Steganography (T1001.002) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult.

Command and Control

4 platforms

T1001.003

Protocol or Service Impersonation

Protocol or Service Impersonation (T1001.003) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts.

Command and Control

4 platforms

T1003

OS Credential Dumping

OS Credential Dumping (T1003) is a MITRE ATT&CK technique associated with Credential Access . Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password.

Credential Access

3 platforms

T1003.001

LSASS Memory

The Local Security Authority Subsystem Service (lsass.exe) enforces Windows security policy and processes authentication. Depending on system configuration and active sessions, its memory may contain credential material useful for lateral movement or privilege escalation. Adve…

Credential Access

1 platform

T1003.002

Security Account Manager

Security Account Manager (T1003.002) is a MITRE ATT&CK technique associated with Credential Access . Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in memory techniques or through the Windows Registry wher…

Credential Access

1 platform

T1003.003

NTDS

NTDS (T1003.003) is a MITRE ATT&CK technique associated with Credential Access . Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such a…

Credential Access

1 platform

T1003.004

LSA Secrets

LSA Secrets (T1003.004) is a MITRE ATT&CK technique associated with Credential Access . Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for…

Credential Access

1 platform

T1003.005

Cached Domain Credentials

Cached Domain Credentials (T1003.005) is a MITRE ATT&CK technique associated with Credential Access . On Windows Vista and newer, the hash format is DCC2 (Domain Cached Credentials version 2) hash, also known as MS Cache v2 hash. The number of default cached credentials varies…

Credential Access

2 platforms

T1003.006

DCSync

DCSync abuses Active Directory replication rights to request password derived data as though the requester were a domain controller. The request can originate from a non domain controller system and may expose high impact credential material, including data associated with pri…

Credential Access

1 platform

T1003.007

Proc Filesystem

Proc Filesystem (T1003.007) is a MITRE ATT&CK technique associated with Credential Access . Adversaries may gather credentials from the proc filesystem or /proc.

Credential Access

1 platform

T1003.008

/etc/passwd and /etc/shadow

/etc/passwd and /etc/shadow (T1003.008) is a MITRE ATT&CK technique associated with Credential Access . Adversaries may attempt to dump the contents of <code /etc/passwd</code and <code /etc/shadow</code to enable offline password cracking.

Credential Access

1 platform

T1005

Data from Local System

Data from Local System (T1005) is a MITRE ATT&CK technique associated with Collection . Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive da…

Collection

5 platforms

T1006

Direct Volume Access

Direct Volume Access (T1006) is a MITRE ATT&CK technique associated with Stealth . Adversaries may directly access a volume to bypass file access controls and file system monitoring.

Stealth

2 platforms

T1007

System Service Discovery

System Service Discovery (T1007) is a MITRE ATT&CK technique associated with Discovery . Adversaries may try to gather information about registered local system services.

Discovery

3 platforms

T1008

Fallback Channels

Fallback Channels (T1008) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid dat…

Command and Control

4 platforms

T1010

Application Window Discovery

Application Window Discovery (T1010) is a MITRE ATT&CK technique associated with Discovery . Adversaries may attempt to get a listing of open application windows.

Discovery

3 platforms

T1011

Exfiltration Over Other Network Medium

Exfiltration Over Other Network Medium (T1011) is a MITRE ATT&CK technique associated with Exfiltration . Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel.

Exfiltration

3 platforms

T1011.001

Exfiltration Over Bluetooth

Exfiltration Over Bluetooth (T1011.001) is a MITRE ATT&CK technique associated with Exfiltration . Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel.

Exfiltration

3 platforms

T1012

Query Registry

Query Registry (T1012) is a MITRE ATT&CK technique associated with Discovery . Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.

Discovery

1 platform

T1014

Rootkit

Rootkit (T1014) is a MITRE ATT&CK technique associated with Stealth . Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.

Stealth

3 platforms

T1016

System Network Configuration Discovery

System Network Configuration Discovery (T1016) is a MITRE ATT&CK technique associated with Discovery . Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of rem…

Discovery

5 platforms

T1016.001

Internet Connection Discovery

Internet Connection Discovery (T1016.001) is a MITRE ATT&CK technique associated with Discovery . Adversaries may check for Internet connectivity on compromised systems.

Discovery

4 platforms

T1016.002

Wi-Fi Discovery

Wi Fi Discovery (T1016.002) is a MITRE ATT&CK technique associated with Discovery . Adversaries may search for information about Wi Fi networks, such as network names and passwords, on compromised systems.

Discovery

3 platforms

T1018

Remote System Discovery

Remote System Discovery (T1018) is a MITRE ATT&CK technique associated with Discovery . Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.

Discovery

5 platforms

T1020

Automated Exfiltration

Automated Exfiltration (T1020) is a MITRE ATT&CK technique associated with Exfiltration . When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel and Exfiltrati…

Exfiltration

4 platforms

T1020.001

Traffic Duplication

Traffic Duplication (T1020.001) is a MITRE ATT&CK technique associated with Exfiltration . Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure.

Exfiltration

2 platforms

T1021

Remote Services

Remote Services (T1021) is a MITRE ATT&CK technique associated with Lateral Movement . Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC.

Lateral Movement

5 platforms

T1021.001

Remote Desktop Protocol

Remote Desktop Protocol (T1021.001) is a MITRE ATT&CK technique associated with Lateral Movement . Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP).

Lateral Movement

1 platform