Adversarial tactics and techniques

T1127.003

JamPlus

JamPlus (T1127.003) is a MITRE ATT&CK technique associated with Stealth, Execution . Adversaries may use JamPlus to proxy the execution of a malicious script.

StealthExecution

Previous211–240 of 697Next

T1129

Shared Modules

Shared Modules (T1129) is a MITRE ATT&CK technique associated with Execution . Adversaries may execute malicious payloads via loading shared modules.

Execution

3 platforms

T1132

Data Encoding

Data Encoding (T1132) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may encode data to make the content of command and control traffic more difficult to detect.

Command and Control

T1132.001

Standard Encoding

Standard Encoding (T1132.001) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect.

Command and Control

T1132.002

Non-Standard Encoding

Non Standard Encoding (T1132.002) is a MITRE ATT&CK technique associated with Command and Control . Adversaries may encode data with a non standard data encoding system to make the content of command and control traffic more difficult to detect.

Command and Control

PersistenceInitial Access

T1133

External Remote Services

External Remote Services (T1133) is a MITRE ATT&CK technique associated with Persistence, Initial Access . Adversaries may leverage external facing remote services to initially access and/or persist within a network.

T1134

Access Token Manipulation

Access Token Manipulation (T1134) is a MITRE ATT&CK technique associated with Stealth, Privilege Escalation . Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls.

T1134.001

Token Impersonation/Theft

Token Impersonation/Theft (T1134.001) is a MITRE ATT&CK technique associated with Stealth, Privilege Escalation . Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls.

T1134.002

Create Process with Token

Create Process with Token (T1134.002) is a MITRE ATT&CK technique associated with Stealth, Privilege Escalation . Adversaries may create a new process with an existing token to escalate privileges and bypass access controls.

T1134.003

Make and Impersonate Token

Make and Impersonate Token (T1134.003) is a MITRE ATT&CK technique associated with Stealth, Privilege Escalation . Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls.

T1134.004

Parent PID Spoofing

Parent PID Spoofing (T1134.004) is a MITRE ATT&CK technique associated with Stealth, Privilege Escalation . Adversaries may spoof the parent process identifier (PPID) of a new process to evade process monitoring defenses or to elevate privileges.

T1134.005

SID-History Injection

SID History Injection (T1134.005) is a MITRE ATT&CK technique associated with Stealth, Privilege Escalation . Adversaries may use SID History Injection to escalate privileges and bypass access controls.

T1135

Network Share Discovery

Network Share Discovery (T1135) is a MITRE ATT&CK technique associated with Discovery . Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential syste…

Discovery

T1136

Create Account

Create Account (T1136) is a MITRE ATT&CK technique associated with Persistence . Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not…

10 platforms

T1136.001

Local Account

Local Account (T1136.001) is a MITRE ATT&CK technique associated with Persistence . Adversaries may create a local account to maintain access to victim systems.

6 platforms

T1136.002

Domain Account

Domain Account (T1136.002) is a MITRE ATT&CK technique associated with Persistence . Adversaries may create a domain account to maintain access to victim systems.

T1136.003

Cloud Account

Cloud Account (T1136.003) is a MITRE ATT&CK technique associated with Persistence . Adversaries may create a cloud account to maintain access to victim systems.

T1137

Office Application Startup

Office Application Startup (T1137) is a MITRE ATT&CK technique associated with Persistence . Adversaries may leverage Microsoft Office based applications for persistence between startups.

T1137.001

Office Template Macros

Office Template Macros (T1137.001) is a MITRE ATT&CK technique associated with Persistence . Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system.

T1137.002

Office Test

Office Test (T1137.002) is a MITRE ATT&CK technique associated with Persistence . Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system.

T1137.003

Outlook Forms

Outlook Forms (T1137.003) is a MITRE ATT&CK technique associated with Persistence . Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system.

T1137.004

Outlook Home Page

Outlook Home Page (T1137.004) is a MITRE ATT&CK technique associated with Persistence . Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system.

T1137.005

Outlook Rules

Outlook Rules (T1137.005) is a MITRE ATT&CK technique associated with Persistence . Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system.

T1137.006

Add-ins

Add ins (T1137.006) is a MITRE ATT&CK technique associated with Persistence . Adversaries may abuse Microsoft Office add ins to obtain persistence on a compromised system.

T1140

Deobfuscate/Decode Files or Information

Deobfuscate/Decode Files or Information (T1140) is a MITRE ATT&CK technique associated with Stealth . Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis.

Stealth

T1176

Software Extensions

Software Extensions (T1176) is a MITRE ATT&CK technique associated with Persistence . Adversaries may abuse software extensions to establish persistent access to victim systems.

T1176.001

Browser Extensions

Browser Extensions (T1176.001) is a MITRE ATT&CK technique associated with Persistence . Adversaries may abuse internet browser extensions to establish persistent access to victim systems.

T1176.002

IDE Extensions

IDE Extensions (T1176.002) is a MITRE ATT&CK technique associated with Persistence . Adversaries may abuse an integrated development environment (IDE) extension to establish persistent access to victim systems. IDEs such as Visual Studio Code, IntelliJ IDEA, and Eclipse suppor…

T1185

Browser Session Hijacking

Browser Session Hijacking (T1185) is a MITRE ATT&CK technique associated with Collection . A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as…

Collection