Adversarial tactics and techniques

T1074

Data Staged

Data Staged (T1074) is a MITRE ATT&CK technique associated with Collection . Adversaries may stage collected data in a central location or directory prior to Exfiltration.

Collection

T1074.001

Previous151–180 of 697Next

Local Data Staging

Local Data Staging (T1074.001) is a MITRE ATT&CK technique associated with Collection . Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration.

Collection

4 platforms

T1074.002

Remote Data Staging

Remote Data Staging (T1074.002) is a MITRE ATT&CK technique associated with Collection . Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration.

Collection

StealthPersistencePrivilege EscalationInitial Access

T1078

Valid Accounts

Valid Accounts (T1078) is a MITRE ATT&CK technique associated with Stealth, Persistence, Privilege Escalation, Initial Access . Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense…

10 platforms

T1078.001

Default Accounts

Default Accounts (T1078.001) is a MITRE ATT&CK technique associated with Stealth, Persistence, Privilege Escalation, Initial Access . Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or D…

StealthPersistencePrivilege EscalationInitial Access

10 platforms

T1078.002

Domain Accounts

Domain Accounts (T1078.002) is a MITRE ATT&CK technique associated with Stealth, Persistence, Privilege Escalation, Initial Access . Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Def…

StealthPersistencePrivilege EscalationInitial Access

StealthPersistencePrivilege EscalationInitial Access

T1078.003

Local Accounts

Local Accounts (T1078.003) is a MITRE ATT&CK technique associated with Stealth, Persistence, Privilege Escalation, Initial Access . Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defen…

6 platforms

T1078.004

Cloud Accounts

Cloud Accounts (T1078.004) is a MITRE ATT&CK technique associated with Stealth, Persistence, Privilege Escalation, Initial Access . Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or De…

StealthPersistencePrivilege EscalationInitial Access

T1080

Taint Shared Content

Taint Shared Content (T1080) is a MITRE ATT&CK technique associated with Lateral Movement . Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories.

Lateral Movement

T1082

System Information Discovery

System Information Discovery (T1082) is a MITRE ATT&CK technique associated with Discovery . An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

6 platforms

T1083

File and Directory Discovery

File and Directory Discovery (T1083) is a MITRE ATT&CK technique associated with Discovery . Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

T1087

Account Discovery

Account Discovery (T1087) is a MITRE ATT&CK technique associated with Discovery . Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment.

8 platforms

T1087.001

Local Account

Local Account (T1087.001) is a MITRE ATT&CK technique associated with Discovery . Adversaries may attempt to get a listing of local system accounts.

T1087.002

Domain Account

Domain Account (T1087.002) is a MITRE ATT&CK technique associated with Discovery . Adversaries may attempt to get a listing of domain accounts.

3 platforms

T1087.003

Email Account

Email Account (T1087.003) is a MITRE ATT&CK technique associated with Discovery . Adversaries may attempt to get a listing of email addresses and accounts.

2 platforms

T1087.004

Cloud Account

Cloud Account (T1087.004) is a MITRE ATT&CK technique associated with Discovery . Adversaries may attempt to get a listing of cloud accounts.

T1090

Proxy

Proxy (T1090) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to…

T1090.001

Internal Proxy

Internal Proxy (T1090.001) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment.

T1090.002

External Proxy

External Proxy (T1090.002) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.

T1090.003

Multi-hop Proxy

Multi hop Proxy (T1090.003) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may chain together multiple proxies to disguise the source of malicious traffic.

T1090.004

Domain Fronting

Domain Fronting (T1090.004) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS tra…

Lateral MovementInitial Access

T1091

Replication Through Removable Media

Replication Through Removable Media (T1091) is a MITRE ATT&CK technique associated with Lateral Movement, Initial Access . Adversaries may move onto systems, possibly those on disconnected or air gapped networks, by copying malware to removable media and taking advantage of Au…

1 platform

T1092

Communication Through Removable Media

Communication Through Removable Media (T1092) is a MITRE ATT&CK technique associated with Command and Control . Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to…

3 platforms

T1095

Non-Application Layer Protocol

Non Application Layer Protocol (T1095) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may use an OSI non application layer protocol for communication between host and C2 server or among infected hosts within a network.

T1098

Account Manipulation

Account Manipulation (T1098) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.

10 platforms

T1098.001

Additional Cloud Credentials

Additional Cloud Credentials (T1098.001) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may add adversary controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

3 platforms

T1098.002

Additional Email Delegate Permissions

Additional Email Delegate Permissions (T1098.002) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may grant additional permission levels to maintain persistent access to an adversary controlled email account.

2 platforms

T1098.003

Additional Cloud Roles

Additional Cloud Roles (T1098.003) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . An adversary may add additional roles or permissions to an adversary controlled cloud account to maintain persistent access to a tenant.

T1098.004

SSH Authorized Keys

SSH Authorized Keys (T1098.004) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . Adversaries may modify the SSH <code authorized keys</code file to maintain persistence on a victim host.