mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
HTML tables inside Markdown
This commit is contained in:
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0036**|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0036</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Capture Evasion
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0001**|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0001</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Debugger Detection
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0002**|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
|
||||
|**Related ATT&CK Technique**|[Debugger Evasion (T1622)](https://attack.mitre.org/techniques/T1622/)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0002</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1622/">Debugger Evasion (T1622)</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Debugger Evasion
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0003**|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
|
||||
|**Related ATT&CK Technique**|Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/))|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0003</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1497/">T1497</a>, <a href="https://attack.mitre.org/techniques/T1633/">T1633</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Dynamic Analysis Evasion
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0004**|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0004</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Emulator Detection
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0005**|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0005</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Emulator Evasion
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0006**|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0006</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Memory Dump Evasion
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0009**|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
|
||||
|**Related ATT&CK Technique**|Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/))|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0009</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1497/">T1497</a>, <a href="https://attack.mitre.org/techniques/T1633/">T1633</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Virtual Machine Detection
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0010**|
|
||||
|**Objective(s)**|[Anti-Static Analysis](../anti-static-analysis)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0010</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../anti-static-analysis">Anti-Static Analysis</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Call Graph Generation Evasion
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0045**|
|
||||
|**Objective(s)**|[Anti-Static Analysis](../anti-static-analysis)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0045</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../anti-static-analysis">Anti-Static Analysis</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Data Flow Analysis Evasion
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0012**|
|
||||
|**Objective(s)**|[Anti-Static Analysis](../anti-static-analysis)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0012</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../anti-static-analysis">Anti-Static Analysis</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Disassembler Evasion
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0032**|
|
||||
|**Objective(s)**|[Anti-Static Analysis](../anti-static-analysis)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0032</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../anti-static-analysis">Anti-Static Analysis</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Executable Code Obfuscation
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0034**|
|
||||
|**Objective(s)**|[Anti-Static Analysis](../anti-static-analysis)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0034</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../anti-static-analysis">Anti-Static Analysis</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Executable Code Optimization
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0008**|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis), [Anti-Static Analysis](../anti-static-analysis)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0008</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a>, <a href="../anti-static-analysis">Anti-Static Analysis</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Executable Code Virtualization
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**F0001**|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis), [Anti-Static Analysis](../anti-static-analysis), [Defense Evasion](../defense-evasion)|
|
||||
|**Related ATT&CK Sub-Technique**|Obfuscated Files or Information: Software Packing ([T1027.002](https://attack.mitre.org/techniques/T1027/002/), [T1406.002](https://attack.mitre.org/techniques/T1406/002/))|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>F0001</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a>, <a href="../anti-static-analysis">Anti-Static Analysis</a>, <a href="../defense-evasion">Defense Evasion</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1027/002/">T1027.002</a>, <a href="https://attack.mitre.org/techniques/T1406/002/">T1406.002</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
Software Packing
|
||||
================
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0028**|
|
||||
|**Objective(s)**|[Collection](../collection), [Credential Access](../credential-access)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0028</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../collection">Collection</a>, <a href="../credential-access">Credential Access</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Cryptocurrency
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**E1056**|
|
||||
|**Objective(s)**|[Collection](../collection), [Credential Access](../credential-access)|
|
||||
|**Related ATT&CK Technique**|Input Capture ([T1056](https://attack.mitre.org/techniques/T1056), [T1417](https://attack.mitre.org/techniques/T1417/))|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>E1056</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../collection">Collection</a>, <a href="../credential-access">Credential Access</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1056">T1056</a>, <a href="https://attack.mitre.org/techniques/T1417/">T1417</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Input Capture
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**F0002**|
|
||||
|**Objective(s)**|[Collection](../collection), [Credential Access](../credential-access)|
|
||||
|**Related ATT&CK Sub-Technique**|Input Capture: Keylogging ([T1056.001](https://attack.mitre.org/techniques/T1056/001), [T1417.001](https://attack.mitre.org/techniques/T1417/001/))|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>F0002</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../collection">Collection</a>, <a href="../credential-access">Credential Access</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1056/001">T1056.001</a>, <a href="https://attack.mitre.org/techniques/T1417/001/">T1417.001</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Keylogging
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**E1113**|
|
||||
|**Objective(s)**|[Collection](../collection), [Credential Access](../credential-access)|
|
||||
|**Related ATT&CK Technique**|[Screen Capture](https://attack.mitre.org/techniques/T1113/)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>E1113</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../collection">Collection</a>, <a href="../credential-access">Credential Access</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1113/">Screen Capture</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Screen Capture
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0030**|
|
||||
|**Objective(s)**|[Command and Control](../command-and-control)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0030</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../command-and-control">Command and Control</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
C2 Communication
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0031**|
|
||||
|**Objective(s)**|[Command and Control](../command-and-control)|
|
||||
|**Related ATT&CK Sub-Technique**|[Dynamic Resolution: Domain Generation Algorithms (T1568.002)](https://attack.mitre.org/techniques/T1568/002/)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0031</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../command-and-control">Command and Control</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1568/002/">Dynamic Resolution: Domain Generation Algorithms (T1568.002)</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Domain Name Generation
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**E1105**|
|
||||
|**Objective(s)**|[Command and Control](../command-and-control), [Lateral Movement](../lateral-movement), [Persistence](../persistence)|
|
||||
|**Related ATT&CK Technique**|[Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105/)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>E1105</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../command-and-control">Command and Control</a>, <a href="../lateral-movement">Lateral Movement</a>, <a href="../persistence">Persistence</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1105/">Ingress Tool Transfer</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Ingress Tool Transfer
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0027**|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0027</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../defense-evasion">Defense Evasion</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Alternative Installation Location
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**F0013**|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion), [Persistence](../persistence)|
|
||||
|**Related ATT&CK Sub-Technique**|[Pre-OS Boot: Bootkit](https://attack.mitre.org/techniques/T1542/003)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>F0013</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../defense-evasion">Defense Evasion</a>, <a href="../persistence">Persistence</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1542/003">Pre-OS Boot: Bootkit</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Bootkit
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0037**|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0037</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../defense-evasion">Defense Evasion</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Bypass Data Execution Prevention
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0040**|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0040</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../defense-evasion">Defense Evasion</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Covert Location
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**F0004**|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion)|
|
||||
|**Related ATT&CK Sub-Techniques**|Impair Defenses: Disable or Modify Tools ([T1562.001](https://attack.mitre.org/techniques/T1562/001), [T1629.003](https://attack.mitre.org/techniques/T1629/003/))|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>F0004</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../defense-evasion">Defense Evasion</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1562/001">T1562.001</a>, <a href="https://attack.mitre.org/techniques/T1629/003/">T1629.003</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Disable or Evade Security Tools
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**F0005**|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion), [Persistence](../persistence)|
|
||||
|**Related ATT&CK Sub-Technique**|[Hide Artifacts: Hidden Files and Directories](https://attack.mitre.org/techniques/T1564/001/)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>F0005</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../defense-evasion">Defense Evasion</a>, <a href="../persistence">Persistence</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1564/001/">Hide Artifacts: Hidden Files and Directories</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Hidden Files and Directories
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**E1564**|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion), [Persistence](../persistence)|
|
||||
|**Related ATT&CK Technique**|Hide Artifacts ([T1564](https://attack.mitre.org/techniques/T1564/), [T1628](https://attack.mitre.org/techniques/T1628/))|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>E1564</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../defense-evasion">Defense Evasion</a>, <a href="../persistence">Persistence</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1564/">T1564</a>, <a href="https://attack.mitre.org/techniques/T1628/">T1628</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Hide Artifacts
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**F0015**|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis), [Collection](../collection), [Credential Access](../credential-access), [Defense Evasion](../defense-evasion), [Persistence](../persistence), [Privilege Escalation](../privilege-escalation)|
|
||||
|**Related ATT&CK Technique**|Hijack Execution Flow ([T1574](https://attack.mitre.org/techniques/T1574), [T1625](https://attack.mitre.org/techniques/T1625))|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>F0015</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a>, <a href="../collection">Collection</a>, <a href="../credential-access">Credential Access</a>, <a href="../defense-evasion">Defense Evasion</a>, <a href="../persistence">Persistence</a>, <a href="../privilege-escalation">Privilege Escalation</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1574">T1574</a>, <a href="https://attack.mitre.org/techniques/T1625">T1625</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Hijack Execution Flow
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**F0006**|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion)|
|
||||
|**Related ATT&CK Sub-Technique**|[Impair Defenses: Indicator Blocking](https://attack.mitre.org/techniques/T1562/006/)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>F0006</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../defense-evasion">Defense Evasion</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1562/006/">Impair Defenses: Indicator Blocking</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Indicator Blocking
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0047**|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion), [Persistence](../persistence)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0047</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../defense-evasion">Defense Evasion</a>, <a href="../persistence">Persistence</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Install Insecure or Malicious Configuration
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**E1112**|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion), [Persistence](../persistence)|
|
||||
|**Related ATT&CK Technique**|[Modify Registry](https://attack.mitre.org/techniques/T1112)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>E1112</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../defense-evasion">Defense Evasion</a>, <a href="../persistence">Persistence</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1112">Modify Registry</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Modify Registry
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**E1027**|
|
||||
|**Objective(s)**|[Anti-Static Analysis](../anti-static-analysis), [Defense Evasion](../defense-evasion)|
|
||||
|**Related ATT&CK Technique**|Obfuscated Files or Information ([T1027](https://attack.mitre.org/techniques/T1027/), [T1406](https://attack.mitre.org/techniques/T1406/))|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>E1027</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../anti-static-analysis">Anti-Static Analysis</a>, <a href="../defense-evasion">Defense Evasion</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1027/">T1027</a>, <a href="https://attack.mitre.org/techniques/T1406/">T1406</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Obfuscated Files or Information
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0029**|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0029</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../defense-evasion">Defense Evasion</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Polymorphic Code
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**E1055**|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion), [Privilege Escalation](../privilege-escalation)|
|
||||
|**Related ATT&CK Technique**|Process Injection ([T1055](https://attack.mitre.org/techniques/T1055), [T1631](https://attack.mitre.org/techniques/T1631/))|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>E1055</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../defense-evasion">Defense Evasion</a>, <a href="../privilege-escalation">Privilege Escalation</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1055">T1055</a>, <a href="https://attack.mitre.org/techniques/T1631/">T1631</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Process Injection
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**E1014**|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion)|
|
||||
|**Related ATT&CK Technique**|[Rootkit](https://attack.mitre.org/techniques/T1014)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>E1014</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../defense-evasion">Defense Evasion</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1014">Rootkit</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Rootkit
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**F0007**|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion)|
|
||||
|**Related ATT&CK Sub-Technique**|Indicator Removal on Host: Uninstall Malicious Application ([T1630.001](https://attack.mitre.org/techniques/T1630/001/)), Indicator Removal on Host: File Deletion ([T1070.004](https://attack.mitre.org/techniques/T1070/004/))|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>F0007</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../defense-evasion">Defense Evasion</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1630/001/">T1630.001</a>, <a href="https://attack.mitre.org/techniques/T1070/004/">T1070.004</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Self Deletion
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0013**|
|
||||
|**Objective(s)**|[Discovery](../discovery)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0013</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../discovery">Discovery</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Analysis Tool Discovery
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**E1010**|
|
||||
|**Objective(s)**|[Discovery](../discovery)|
|
||||
|**Related ATT&CK Technique**|[Application Window Discovery](https://attack.mitre.org/techniques/T1010/) |
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>E1010</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../discovery">Discovery</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1010/">Application Window Discovery</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Application Window Discovery
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0046**|
|
||||
|**Objective(s)**|[Discovery](../discovery)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0046</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../discovery">Discovery</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Code Discovery
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**E1083**|
|
||||
|**Objective(s)**|[Discovery](../discovery)|
|
||||
|**Related ATT&CK Technique**|[File and Directory Discovery](https://attack.mitre.org/techniques/T1083/) |
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>E1083</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../discovery">Discovery</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1083/">File and Directory Discovery</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
File and Directory Discovery
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0038**|
|
||||
|**Objective(s)**|[Discovery](../discovery)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0038</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../discovery">Discovery</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Self Discovery
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0014**|
|
||||
|**Objective(s)**|[Discovery](../discovery)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0014</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../discovery">Discovery</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
SMTP Connection Discovery
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**E1082**|
|
||||
|**Objective(s)**|[Discovery](../discovery)|
|
||||
|**Related ATT&CK Technique**|[System Information Discovery](https://attack.mitre.org/techniques/T1082)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>E1082</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../discovery">Discovery</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1082">System Information Discovery</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
System Information Discovery
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0043**|
|
||||
|**Objective(s)**|[Discovery](../discovery)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0043</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../discovery">Discovery</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Taskbar Discovery
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**E1059**|
|
||||
|**Objective(s)**|[Execution](../execution)|
|
||||
|**Related ATT&CK Technique**|Command and Scripting Interpreter ([T1059](https://attack.mitre.org/techniques/T1059), [T1623](https://attack.mitre.org/techniques/T1623))|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>E1059</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../execution">Execution</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1059">T1059</a>, <a href="https://attack.mitre.org/techniques/T1623">T1623</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Command and Scripting Interpreter
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0025**|
|
||||
|**Objective(s)**|[Execution](../execution), [Anti-Behavioral Analysis](../anti-behavioral-analysis), [Defense Evasion](../defense-evasion)|
|
||||
|**Related ATT&CK Technique**|[Execution Guardrails (T1480)](https://attack.mitre.org/techniques/T1480)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0025</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../execution">Execution</a>, <a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a>, <a href="../defense-evasion">Defense Evasion</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1480">Execution Guardrails (T1480)</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Conditional Execution
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0044**|
|
||||
|**Objective(s)**|[Execution](../execution)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0044</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../execution">Execution</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Execution Dependency
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**E1203**|
|
||||
|**Objective(s)**|[Execution](../execution), [Impact](../impact)|
|
||||
|**Related ATT&CK Technique**|[Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>E1203</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../execution">Execution</a>, <a href="../impact">Impact</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1203">Exploitation for Client Execution</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Exploitation for Client Execution
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0023**|
|
||||
|**Objective(s)**|[Execution](../execution)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0023</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../execution">Execution</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Install Additional Program
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0024**|
|
||||
|**Objective(s)**|[Execution](../execution)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0024</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../execution">Execution</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Prevent Concurrent Execution
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0011**|
|
||||
|**Objective(s)**|[Execution](../execution)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0011</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../execution">Execution</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Remote Commands
|
||||
|
||||
+15
-5
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0020**|
|
||||
|**Objective(s)**|[Execution](../execution), [Lateral Movement](../lateral-movement)|
|
||||
|**Related ATT&CK Technique**|[Phishing (T1566)](https://attack.mitre.org/techniques/T1566/)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0020</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../execution">Execution</a>, <a href="../lateral-movement">Lateral Movement</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1566/">Phishing (T1566)</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Send Email
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0021**|
|
||||
|**Objective(s)**|[Execution](../execution), [Lateral Movement](../lateral-movement)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0021</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../execution">Execution</a>, <a href="../lateral-movement">Lateral Movement</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Send Poisoned Text Message
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**E1569**|
|
||||
|**Objective(s)**|[Execution](../execution)|
|
||||
|**Related ATT&CK Technique**|[System Services](https://attack.mitre.org/techniques/T1569/)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>E1569</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../execution">Execution</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1569/">System Services</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
System Services
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**E1204**|
|
||||
|**Objective(s)**|[Execution](../execution)|
|
||||
|**Related ATT&CK Technique**|[User Execution](https://attack.mitre.org/techniques/T1204)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>E1204</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../execution">Execution</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1204">User Execution</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
User Execution
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**E1560**|
|
||||
|**Objective(s)**|[Exfiltration](../exfiltration)|
|
||||
|**Related ATT&CK Technique**|[Archive Collected Data](https://attack.mitre.org/techniques/T1560/)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>E1560</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../exfiltration">Exfiltration</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1560/">Archive Collected Data</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Archive Collected Data
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**E1020**|
|
||||
|**Objective(s)**|[Exfiltration](../exfiltration)|
|
||||
|**Related ATT&CK Technique**|[Automated Exfiltration](https://attack.mitre.org/techniques/T1020/)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>E1020</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../exfiltration">Exfiltration</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1020/">Automated Exfiltration</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Automated Exfiltration
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**E1510**|
|
||||
|**Objective(s)**|[Impact](../impact)|
|
||||
|**Related ATT&CK Technique**|[Clipboard Modification](https://attack.mitre.org/techniques/T1510/)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>E1510</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../impact">Impact</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1510/">Clipboard Modification</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Clipboard Modification
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0016**|
|
||||
|**Objective(s)**|[Impact](../impact)|
|
||||
|**Related ATT&CK Sub-Technique**|[Data Manipulation: Stored Data Manipulation (T1565.001)](https://attack.mitre.org/techniques/T1565/001/)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0016</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../impact">Impact</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1565/001/">Data Manipulation: Stored Data Manipulation (T1565.001)</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Compromise Data Integrity
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**E1485**|
|
||||
|**Objective(s)**|[Impact](../impact)|
|
||||
|**Related ATT&CK Technique**|[Data Destruction](https://attack.mitre.org/techniques/T1485/)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>E1485</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../impact">Impact</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1485/">Data Destruction</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Data Destruction
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0033**|
|
||||
|**Objective(s)**|[Impact](../impact)|
|
||||
|**Related ATT&CK Technique**|[Network Denial of Service (T1498)](https://attack.mitre.org/techniques/T1498/)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0033</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../impact">Impact</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1498/">Network Denial of Service (T1498)</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Denial of Service
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0017**|
|
||||
|**Objective(s)**|[Impact](../impact)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0017</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../impact">Impact</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Destroy Hardware
|
||||
|
||||
+15
-5
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**F0014**|
|
||||
|**Objective(s)**|[Impact](../impact)|
|
||||
|**Related ATT&CK Sub-Technique**|[Disk Wipe](https://attack.mitre.org/techniques/T1561/)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>F0014</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../impact">Impact</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1561/">Disk Wipe</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
Disk Wipe
|
||||
=========
|
||||
|
||||
+15
-5
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**E1190**|
|
||||
|**Objective(s)**|[Impact](../impact)|
|
||||
|**Related ATT&CK Technique**|[Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>E1190</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../impact">Impact</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1190">Exploit Public-Facing Application</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Exploit Kit
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**E1643**|
|
||||
|**Objective(s)**|[Impact](../impact)|
|
||||
|**Related ATT&CK Technique**|[Generate Traffic from Victim](https://attack.mitre.org/techniques/T1643/)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>E1643</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../impact">Impact</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1643/">Generate Traffic from Victim</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Generate Traffic from Victim
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0019**|
|
||||
|**Objective(s)**|[Impact](../impact)|
|
||||
|**Related ATT&CK Sub-Technique**|[Data Manipulation: Transmitted Data Manipulation (T1565.002)](https://attack.mitre.org/techniques/T1565/002/)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0019</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../impact">Impact</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1565/002/">Data Manipulation: Transmitted Data Manipulation (T1565.002)</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Manipulate Network Traffic
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0042**|
|
||||
|**Objective(s)**|[Impact](../impact)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0042</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../impact">Impact</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Modify Hardware
|
||||
|
||||
+15
-5
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0022**|
|
||||
|**Objective(s)**|[Impact](../impact), [Persistence](../persistence)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0022</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../impact">Impact</a>, <a href="../persistence">Persistence</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Remote Access
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0018**|
|
||||
|**Objective(s)**|[Impact](../impact)|
|
||||
|**Related ATT&CK Technique**|[Resource Hijacking (T1496)](https://attack.mitre.org/techniques/T1496/)|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0018</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../impact">Impact</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1496/">Resource Hijacking (T1496)</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Resource Hijacking
|
||||
|
||||
+15
-5
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0039**|
|
||||
|**Objective(s)**|[Impact](../impact)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>B0039</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../impact">Impact</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Spamming
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**E1195**|
|
||||
|**Objective(s)**|[Lateral Movement](../lateral-movement)|
|
||||
|**Related ATT&CK Technique**|Supply Chain Compromise ([T1195](https://attack.mitre.org/techniques/T1195/), [T1474](https://attack.mitre.org/techniques/T1474/))|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>E1195</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../lateral-movement">Lateral Movement</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b><a href="https://attack.mitre.org/techniques/T1195/">T1195</a>, <a href="https://attack.mitre.org/techniques/T1474/">T1474</a></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Supply Chain Compromise
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0011**|
|
||||
|**Objective(s)**|[Communication](../communication)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0011</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../communication">Communication</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
DNS Communication
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0004**|
|
||||
|**Objective(s)**|[Communication](../communication)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0004</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../communication">Communication</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
FTP Communication
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0002**|
|
||||
|**Objective(s)**|[Communication](../communication)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0002</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../communication">Communication</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
HTTP Communication
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0014**|
|
||||
|**Objective(s)**|[Communication](../communication)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0014</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../communication">Communication</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
ICMP Communication
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0003**|
|
||||
|**Objective(s)**|[Communication](../communication)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0003</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../communication">Communication</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Interprocess Communication
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0012**|
|
||||
|**Objective(s)**|[Communication](../communication)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0012</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../communication">Communication</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
SMTP Communication
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0001**|
|
||||
|**Objective(s)**|[Communication](../communication)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0001</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../communication">Communication</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Socket Communication
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0005**|
|
||||
|**Objective(s)**|[Communication](../communication)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0005</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../communication">Communication</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
WinINet
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0059**|
|
||||
|**Objective(s)**|[Cryptography](../cryptography)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0059</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../cryptography">Cryptography</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Crypto Library
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0029**|
|
||||
|**Objective(s)**|[Cryptography](../cryptography)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0029</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../cryptography">Cryptography</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Cryptographic Hash
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0031**|
|
||||
|**Objective(s)**|[Cryptography](../cryptography)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0031</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../cryptography">Cryptography</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Decrypt Data
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0027**|
|
||||
|**Objective(s)**|[Cryptography](../cryptography)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0027</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../cryptography">Cryptography</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Encrypt Data
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0028**|
|
||||
|**Objective(s)**|[Cryptography](../cryptography)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0028</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../cryptography">Cryptography</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Encryption Key
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0021**|
|
||||
|**Objective(s)**|[Cryptography](../cryptography)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0021</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../cryptography">Cryptography</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Generate Pseudo-random Sequence
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0061**|
|
||||
|**Objective(s)**|[Cryptography](../cryptography)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0061</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../cryptography">Cryptography</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Hashed Message Authentication Code
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0019**|
|
||||
|**Objective(s)**|[Data](../data)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0019</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../data">Data</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Check String
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0032**|
|
||||
|**Objective(s)**|[Data](../data)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0032</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../data">Data</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Checksum
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0024**|
|
||||
|**Objective(s)**|[Data](../data)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0024</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../data">Data</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Compress Data
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0060**|
|
||||
|**Objective(s)**|[Data](../data)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0060</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../data">Data</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Compression Library
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0053**|
|
||||
|**Objective(s)**|[Data](../data)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0053</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../data">Data</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Decode Data
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0025**|
|
||||
|**Objective(s)**|[Data](../data)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0025</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../data">Data</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Decompress Data
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0026**|
|
||||
|**Objective(s)**|[Data](../data)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0026</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../data">Data</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Encode Data
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0058**|
|
||||
|**Objective(s)**|[Data](../data)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0058</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../data">Data</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Modulo
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0030**|
|
||||
|**Objective(s)**|[Data](../data)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0030</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../data">Data</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Non-Cryptographic Hash
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0020**|
|
||||
|**Objective(s)**|[Data](../data)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0020</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../data">Data</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Use Constant
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0015**|
|
||||
|**Objective(s)**|[File System](../file-system)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0015</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../file-system">File System</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Alter File Extension
|
||||
|
||||
@@ -1,8 +1,18 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**C0045**|
|
||||
|**Objective(s)**|[File System](../file-system)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<td><b>ID</b></td>
|
||||
<td><b>C0045</b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Objective(s)</b></td>
|
||||
<td><b><a href="../file-system">File System</a></b></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>Related ATT&CK Techniques</b></td>
|
||||
<td><b>None</b></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
|
||||
Copy File
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user