Adversarial tactics and techniques

Previous181–210 of 697Next

T1098.007

Additional Local or Domain Groups

Additional Local or Domain Groups (T1098.007) is a MITRE ATT&CK technique associated with Persistence, Privilege Escalation . An adversary may add additional local or domain groups to an adversary controlled account to maintain persistent access to a system or domain.

PersistencePrivilege Escalation

3 platforms

T1102

Web Service

Web Service (T1102) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system.

T1102.001

Dead Drop Resolver

Dead Drop Resolver (T1102.001) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure.

T1102.002

Bidirectional Communication

Bidirectional Communication (T1102.002) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service cha…

T1102.003

One-Way Communication

One Way Communication (T1102.003) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service cha…

T1104

Multi-Stage Channels

Multi Stage Channels (T1104) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions.

T1105

Ingress Tool Transfer

Ingress Tool Transfer (T1105) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may transfer tools or other files from an external system into a compromised environment.

5 platforms

T1106

Native API

Native API (T1106) is a MITRE ATT&CK technique associated with Execution . Adversaries may interact with the native OS application programming interface (API) to execute behaviors.

Execution

T1110

Brute Force

Brute Force (T1110) is a MITRE ATT&CK technique associated with Credential Access . Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of…

T1110.001

Password Guessing

Password Guessing (T1110.001) is a MITRE ATT&CK technique associated with Credential Access . Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts.

T1110.002

Password Cracking

Password Cracking (T1110.002) is a MITRE ATT&CK technique associated with Credential Access . Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained.

6 platforms

T1110.003

Password Spraying

Password Spraying (T1110.003) is a MITRE ATT&CK technique associated with Credential Access . Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials.

T1110.004

Credential Stuffing

Credential Stuffing (T1110.004) is a MITRE ATT&CK technique associated with Credential Access . Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap.

T1111

Multi-Factor Authentication Interception

Multi Factor Authentication Interception (T1111) is a MITRE ATT&CK technique associated with Credential Access . Adversaries may target multi factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to a…

Defense ImpairmentPersistence

T1112

Modify Registry

Modify Registry (T1112) is a MITRE ATT&CK technique associated with Defense Impairment, Persistence . Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

T1113

Screen Capture

Screen Capture (T1113) is a MITRE ATT&CK technique associated with Collection . Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation.

T1114

Email Collection

Email Collection (T1114) is a MITRE ATT&CK technique associated with Collection . Adversaries may target user email to collect sensitive information.

T1114.001

Local Email Collection

Local Email Collection (T1114.001) is a MITRE ATT&CK technique associated with Collection . Adversaries may target user email on local systems to collect sensitive information.

T1114.002

Remote Email Collection

Remote Email Collection (T1114.002) is a MITRE ATT&CK technique associated with Collection . Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information.

2 platforms

T1114.003

Email Forwarding Rule

Email Forwarding Rule (T1114.003) is a MITRE ATT&CK technique associated with Collection . Adversaries may setup email forwarding rules to collect sensitive information.

T1115

Clipboard Data

Clipboard Data (T1115) is a MITRE ATT&CK technique associated with Collection . Adversaries may collect data stored in the clipboard from users copying information within or between applications.

T1119

Automated Collection

Automated Collection (T1119) is a MITRE ATT&CK technique associated with Collection . Once established within a system or network, an adversary may use automated techniques for collecting internal data.

6 platforms

T1120

Peripheral Device Discovery

Peripheral Device Discovery (T1120) is a MITRE ATT&CK technique associated with Discovery . Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that…

Discovery

T1123

Audio Capture

Audio Capture (T1123) is a MITRE ATT&CK technique associated with Collection . Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture audio.

T1124

System Time Discovery

System Time Discovery (T1124) is a MITRE ATT&CK technique associated with Discovery . An adversary may gather the system time and/or time zone settings from a local or remote system.

Discovery

5 platforms

T1125

Video Capture

Video Capture (T1125) is a MITRE ATT&CK technique associated with Collection . An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering i…

T1127

Trusted Developer Utilities Proxy Execution

Trusted Developer Utilities Proxy Execution (T1127) is a MITRE ATT&CK technique associated with Stealth, Execution . Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads.

StealthExecution

T1127.001

MSBuild

MSBuild (T1127.001) is a MITRE ATT&CK technique associated with Stealth, Execution . Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility.

StealthExecution