JavaScript (T1059.007) is a MITRE ATT&CK technique associated with Execution . Adversaries may abuse various implementations of JavaScript for execution.

Execution

3 platforms

T1059.008

Network Device CLI

Network Device CLI (T1059.008) is a MITRE ATT&CK technique associated with Execution . Adversaries may abuse scripting or built in command line interpreters (CLI) on network devices to execute malicious command and payloads.

Execution

1 platform

T1059.009

Cloud API

Cloud API (T1059.009) is a MITRE ATT&CK technique associated with Execution . Adversaries may abuse cloud APIs to execute malicious commands.

Execution

4 platforms

T1059.010

AutoHotKey & AutoIT

AutoHotKey & AutoIT (T1059.010) is a MITRE ATT&CK technique associated with Execution . Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts.

Execution

1 platform

T1059.011

Lua

Lua (T1059.011) is a MITRE ATT&CK technique associated with Execution . Adversaries may abuse Lua commands and scripts for execution.

Execution

4 platforms

T1059.012

Hypervisor CLI

Hypervisor CLI (T1059.012) is a MITRE ATT&CK technique associated with Execution . Adversaries may abuse hypervisor command line interpreters (CLIs) to execute malicious commands.

Execution

1 platform

T1059.013

Container CLI/API

Container CLI/API (T1059.013) is a MITRE ATT&CK technique associated with Execution . Adversaries may abuse built in CLI tools or API calls to execute malicious commands in containerized environments.

Execution

1 platform

T1068

Exploitation for Privilege Escalation

Exploitation for Privilege Escalation (T1068) is a MITRE ATT&CK technique associated with Privilege Escalation . Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

Privilege Escalation

4 platforms

T1069

Permission Groups Discovery

Permission Groups Discovery (T1069) is a MITRE ATT&CK technique associated with Discovery . Adversaries may attempt to discover group and permission settings.

Discovery

8 platforms

T1069.001

Local Groups

Local Groups (T1069.001) is a MITRE ATT&CK technique associated with Discovery . Adversaries may attempt to find local system groups and permission settings.

Discovery

3 platforms

T1069.002

Domain Groups

Domain Groups (T1069.002) is a MITRE ATT&CK technique associated with Discovery . Adversaries may attempt to find domain level groups and permission settings.

Discovery

3 platforms

T1069.003

Cloud Groups

Cloud Groups (T1069.003) is a MITRE ATT&CK technique associated with Discovery . Adversaries may attempt to find cloud groups and permission settings.

Discovery

4 platforms

T1070

Indicator Removal

Indicator Removal (T1070) is a MITRE ATT&CK technique associated with Stealth . Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity.

Stealth

7 platforms

T1070.003

Clear Command History

Clear Command History (T1070.003) is a MITRE ATT&CK technique associated with Stealth . In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.

Stealth

5 platforms

T1070.004

File Deletion

File Deletion (T1070.004) is a MITRE ATT&CK technique associated with Stealth . Adversaries may delete files left behind by the actions of their intrusion activity.

Stealth

4 platforms

T1070.005

Network Share Connection Removal

Network Share Connection Removal (T1070.005) is a MITRE ATT&CK technique associated with Stealth . Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

Stealth

1 platform

T1070.006

Timestomp

Timestomp (T1070.006) is a MITRE ATT&CK technique associated with Stealth . Adversaries may modify file time attributes to hide new files or changes to existing files.

Stealth

4 platforms

T1070.007

Clear Network Connection History and Configurations

Clear Network Connection History and Configurations (T1070.007) is a MITRE ATT&CK technique associated with Stealth . Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations.

Stealth

4 platforms

T1070.008

Clear Mailbox Data

Clear Mailbox Data (T1070.008) is a MITRE ATT&CK technique associated with Stealth . Adversaries may modify mail and mail application data to remove evidence of their activity.

Stealth

4 platforms

T1070.009

Clear Persistence

Clear Persistence (T1070.009) is a MITRE ATT&CK technique associated with Stealth . Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity.

Stealth

4 platforms

T1070.010

Relocate Malware

Relocate Malware (T1070.010) is a MITRE ATT&CK technique associated with Stealth . Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove evidence of their presence and/or avoid defenses.

Stealth

4 platforms

T1071

Application Layer Protocol

Application Layer Protocol (T1071) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic.

Command and Control

5 platforms

T1071.001

Web Protocols

Web Protocols (T1071.001) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.

Command and Control

5 platforms

T1071.002

File Transfer Protocols

File Transfer Protocols (T1071.002) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic.

Command and Control

5 platforms

T1071.003

Mail Protocols

Mail Protocols (T1071.003) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic.

Command and Control

4 platforms

T1071.004

DNS

DNS (T1071.004) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic.

Command and Control

5 platforms

T1071.005

Publish/Subscribe Protocols

Publish/Subscribe Protocols (T1071.005) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic.

Command and Control

4 platforms