admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'develop' into Risky

Browse Source
This commit is contained in:
Michael Haag
2021-07-14 07:49:31 -06:00
committed by GitHub
parent 8d4fd205a7 3e21f4616b
commit 1430b38fb8
54 changed files with 59120 additions and 43779 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.circleci/config.yml
+17 -8
View File
@@ -496,14 +496,12 @@ workflows:
filters:
tags:
only: /.*/
- run-appinspect:
# build always
requires:
- validate-content
- build-sources
- build-package
filters:
tags:
only: /^v.*/
@@ -514,7 +512,6 @@ workflows:
- validate-content
- build-sources
- build-package
- run-appinspect
filters:
tags:
@@ -527,7 +524,6 @@ workflows:
- validate-content
- build-sources
- build-package
- run-appinspect
- create-report
filters:
@@ -541,7 +537,6 @@ workflows:
- validate-content
- build-sources
- build-package
- run-appinspect
- create-report
- update-sources-github
@@ -556,7 +551,6 @@ workflows:
- validate-content
- build-sources
- build-package
- run-appinspect
- create-report
- update-sources-github
@@ -571,7 +565,7 @@ workflows:
requires:
- validate-content
- build-sources
- build-package
- build-package
- run-appinspect
- create-report
- update-sources-github
@@ -581,4 +575,19 @@ workflows:
tags:
only: /^v.*/
branches:
ignore: /.*/
ignore: /.*/
detection-testing:
jobs:
- hold:
type: approval
filters:
tags:
only: /^v.*/
- detection-testing:
# build always
requires:
- hold
filters:
tags:
only: /^v.*/
automated_detection_testing/ci/detection_testing_batch/modules/testing_service.py
+6 -1
View File
@@ -51,7 +51,12 @@ def test_detections(ssh_key_name, private_key, splunk_ip, splunk_password, test_
def test_detection(ssh_key_name, private_key, splunk_ip, splunk_password, test_file, test_index, uuid_test, uuid_var):
test_file_obj = load_file("security_content/" + test_file[2:])
try:
test_file_obj = load_file("security_content/" + test_file[2:])
except Exception as e:
print('Error: ' + str(e))
return
if not test_file_obj:
return
#print(test_file_obj)
detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
+3 -3
View File
@@ -28,6 +28,9 @@ references:
tags:
analytic_story:
- Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -47,6 +50,3 @@ tags:
- Processes.parent_process_id
- Processes.parent_process_name
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
detections/endpoint/allow_network_discovery_in_firewall.yml
+8 -8
View File
@@ -12,11 +12,11 @@ description: This search is to detect a suspicious modification to the firewall
more files.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe
Processes.process= "*firewall*" Processes.process= "*group=\"Network Discovery\"*" Processes.process="*enable*" Processes.process="*Yes*"
by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `allow_network_discovery_in_firewall_filter`'
Processes.process= "*firewall*" Processes.process= "*group=\"Network Discovery\"*" Processes.process="*enable*"
Processes.process="*Yes*" by Processes.dest Processes.user Processes.parent_process
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `allow_network_discovery_in_firewall_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
@@ -30,6 +30,9 @@ tags:
analytic_story:
- Ransomware
- Revil Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -48,6 +51,3 @@ tags:
- Processes.parent_process_id
- Processes.parent_process_name
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
+1 -1
View File
@@ -80,4 +80,4 @@ tags:
- name: process_name
type: Process
role:
- Child Process
- Child Process
detections/endpoint/delete_shadowcopy_with_powershell.yml
+3 -3
View File
@@ -11,9 +11,9 @@ description: This following analytic detects PowerShell command to delete shadow
to deploy DarkSide Ransomware where it executed a child process of PowerShell to
execute a hex encoded command to delete shadow copy. This hex encoded command was
able to be decrypted by PowerShell log.
search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" (Message = "*Delete*" OR Message = "*Remove*")
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" (Message = "*Delete*"
OR Message = "*Remove*") | stats count min(_time) as firstTime max(_time) as lastTime
by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `delete_shadowcopy_with_powershell_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the powershell logs from your endpoints. make sure you enable needed
detections/endpoint/detect_wmi_event_subscription_persistence.yml
+1 -1
View File
@@ -20,7 +20,7 @@ description: 'The following analytic identifies the use of WMI Event Subscriptio
1. Consumer - An action to take upon triggering the filter. EventID equals 20 \
1. Binding - Registers a filter to a consumer. EventID equals 21 \
Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding.
It may be pertinent to review all 3 to identify the flow of execution. In addition,
EventCode 4104 may assist with any other PowerShell script usage that registered
detections/endpoint/disable_amsi_through_registry.yml
+3 -3
View File
@@ -28,6 +28,9 @@ references:
tags:
analytic_story:
- Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -44,6 +47,3 @@ tags:
- Registry.dest
- Registry.registry_value_name
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
detections/endpoint/disable_etw_through_registry.yml
+3 -3
View File
@@ -26,6 +26,9 @@ references:
tags:
analytic_story:
- Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -42,6 +45,3 @@ tags:
- Registry.dest
- Registry.registry_value_name
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
detections/endpoint/disable_windows_behavior_monitoring.yml
+9 -9
View File
@@ -10,15 +10,15 @@ description: This search is to identifies a modification in registry to disable
windows denfender real time behavior monitoring. This event or technique is commonly
seen in RAT, bot, or Trojan to disable AV to evade detections.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where
Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR
Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR
Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" OR
Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring" OR
Registry.registry_path= "*\\Real-Time Protection\\DisableIntrusionPreventionSystem" OR
Registry.registry_path= "*\\Real-Time Protection\\DisableIOAVProtection" OR
Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning"
Registry.registry_value_name = "DWORD (0x00000001)"
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows
Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path=
"*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection"
OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time
Protection\\DisableScanOnRealtimeEnable" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows
Defender\\Real-Time Protection\\DisableRealtimeMonitoring" OR Registry.registry_path=
"*\\Real-Time Protection\\DisableIntrusionPreventionSystem" OR Registry.registry_path=
"*\\Real-Time Protection\\DisableIOAVProtection" OR Registry.registry_path= "*\\Real-Time
Protection\\DisableScriptScanning" Registry.registry_value_name = "DWORD (0x00000001)"
by Registry.registry_path Registry.registry_key_name Registry.registry_value_name
Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
|`security_content_ctime(lastTime)` | `disable_windows_behavior_monitoring_filter`'
detections/endpoint/disabling_cmd_application.yml
-1
View File
@@ -46,4 +46,3 @@ tags:
- Registry.dest
- Registry.registry_value_name
security_domain: endpoint
detections/endpoint/excessive_usage_of_sc_service_utility.yml
+3 -3
View File
@@ -27,6 +27,9 @@ references:
tags:
analytic_story:
- Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -41,6 +44,3 @@ tags:
- process_name
- process
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
detections/endpoint/execute_javascript_with_jscript_com_clsid.yml
+3 -3
View File
@@ -25,6 +25,9 @@ references:
tags:
analytic_story:
- Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -43,6 +46,3 @@ tags:
- Processes.dest
- Processes.user
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
detections/endpoint/msmpeng_application_dll_side_loading.yml
+3 -3
View File
@@ -27,6 +27,9 @@ tags:
analytic_story:
- Ransomware
- Revil Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets//malware/revil/msmpeng_side/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -43,6 +46,3 @@ tags:
- Filesystem.user
- Filesystem.file_path
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets//malware/revil/msmpeng_side/windows-sysmon.log
detections/endpoint/powershell_disable_security_monitoring.yml
+3 -3
View File
@@ -27,6 +27,9 @@ tags:
analytic_story:
- Ransomware
- Revil Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -45,6 +48,3 @@ tags:
- Processes.process_id
- Processes.parent_process_id
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon.log
detections/endpoint/powershell_enable_smb1protocol_feature.yml
+3 -3
View File
@@ -24,6 +24,9 @@ tags:
analytic_story:
- Malicious PowerShell
- Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-powershell.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -39,6 +42,3 @@ tags:
- ComputerName
- User
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-powershell.log
detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml
+3 -3
View File
@@ -27,6 +27,9 @@ references:
tags:
analytic_story:
- Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -45,6 +48,3 @@ tags:
- Processes.dest
- Processes.user
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
detections/endpoint/revil_registry_entry.yml
+5 -4
View File
@@ -13,10 +13,11 @@ description: This analytic identifies suspicious modification in registry entry
notes file name in the compromised host.
search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
as registry_key_name values(Registry.registry_path) as registry_path min(_time)
as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*")
AND (Registry.registry_value_name = "\.*" OR Registry.registry_value_name = "Binary
Data") by Registry.registry_value_name Registry.dest Registry.user | `security_content_ctime(lastTime)`
| `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `revil_registry_entry_filter`'
as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*"
OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") AND (Registry.registry_value_name
= "\.*" OR Registry.registry_value_name = "Binary Data") by Registry.registry_value_name
Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
| `drop_dm_object_name(Registry)` | `revil_registry_entry_filter`'
how_to_implement: to successfully implement this search, you need to be ingesting
logs with the Image, TargetObject registry key, registry Details from your endpoints.
If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
detections/endpoint/ssa___attempt_to_delete_services.yml
+12 -10
View File
@@ -10,15 +10,17 @@ description: This analytic identifies suspicious series of attempt to kill multi
services on a system using either `net.exe` or `sc.exe`. This technique is use by
adversaries to terminate security services or other related services to continue
there objective and evade detections.
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)),
process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null),
parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null)
| where cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name = "sc.exe"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null),
ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null) | where cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name
= "sc.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -46,4 +48,4 @@ tags:
- process_path
- dest_user_id
- process
security_domain: endpoint
security_domain: endpoint
detections/endpoint/ssa___attempt_to_disable_services.yml
+12 -10
View File
@@ -10,15 +10,17 @@ description: This analytic will identify suspicious series of command-line to di
several services. This technique is seen where the adversary attempts to disable
security app services or other malware services to complete the objective on the
compromised system.
search: '| from read_ssa_enriched_events()
| eval _datamodels=ucast(map_get(input_event, "_datamodels"), "collection<string>", []), body={}
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)),
process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null),
parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null)
| where cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line, "%config%") AND process_name="sc.exe"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null),
ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path])
search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event,
"_datamodels"), "collection<string>", []), body={} | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null) | where cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line,
"%config%") AND process_name="sc.exe" | eval start_time=timestamp, end_time=timestamp,
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
"dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
@@ -48,4 +50,4 @@ tags:
- process_path
- dest_user_id
- process
security_domain: endpoint
security_domain: endpoint
detections/endpoint/ssa___delete_a_net_user.yml
+16 -12
View File
@@ -12,17 +12,21 @@ description: This analytic will detect a suspicious net.exe/net1.exe command-lin
user or deleting adversaries tracks created during its lateral movement additional
systems. During triage, review parallel processes for additional behavior. Identify
any other user accounts created before or after.
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null)
| where cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe" OR process_name="net.exe")
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: o successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed net.exe may be used.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe"
OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: o successfully implement this search, you need to be ingesting logs
with the process name, parent process, and command-line executions from your endpoints.
If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
Tune and filter known instances where renamed net.exe may be used.
known_false_positives: System administrators or scripts may delete user accounts via
this technique. Filter as needed.
references:
@@ -47,4 +51,4 @@ tags:
- process_path
- dest_user_id
- process
security_domain: endpoint
security_domain: endpoint
detections/endpoint/ssa___disable_net_user_account.yml
+14 -9
View File
@@ -10,19 +10,24 @@ description: This analytic will identify a suspicious command-line that disables
user account using the `net.exe` utility native to Windows. This technique may used
by the adversaries to interrupt availability of such users to do their malicious
act.
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null)
| where cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe" OR process_name="net.exe")
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe"
OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be
used.
known_false_positives: network operator may use this approach to quickly disable an account but not a common practice.
known_false_positives: network operator may use this approach to quickly disable an
account but not a common practice.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
tags:
@@ -45,4 +50,4 @@ tags:
- process_path
- dest_user_id
- process
security_domain: endpoint
security_domain: endpoint
detections/endpoint/ssa___resize_shadowstorage_volume.yml
+13 -8
View File
@@ -12,13 +12,18 @@ description: The following analytics identifies the resizing of shadowstorage by
team. one example of ransomware that use this technique is CLOP ransomware where
it drops a .bat file that will resize the shadowstorage to minimum size as much
as possible
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)),
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null)
| where cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line, "%shadowstorage%") AND like(cmd_line, "%maxsize%") AND process_name="vssadmin.exe"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null) | where cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line,
"%shadowstorage%") AND like(cmd_line, "%maxsize%") AND process_name="vssadmin.exe"
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -47,4 +52,4 @@ tags:
- process_path
- dest_user_id
- process
security_domain: endpoint
security_domain: endpoint
dist/escu/app.manifest
Vendored
+1 -1
View File
@@ -5,7 +5,7 @@
"id": {
"group": null,
"name": "DA-ESS-ContentUpdate",
"version": "3.25.0"
"version": "3.25.1"
},
"author": [
{
dist/escu/default/analytic_stories.conf
Vendored
+2 -4
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-07-13T07:57:29 UTC
# On Date: 2021-07-13T23:06:08 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -1487,9 +1487,7 @@ support_searches = []
data_models = ["Endpoint"]
providing_technologies = none
description = Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred.
narrative = WMI is a Microsoft infrastructure for management data and operations on Windows operating systems. It includes of a set of utilities that can be leveraged to manage both local and remote Windows systems. Attackers are increasingly turning to WMI abuse in their efforts to conduct nefarious tasks, such as reconnaissance, detection of antivirus and virtual machines, code execution, lateral movement, persistence, and data exfiltration. \
The detection searches included in this Analytic Story are used to look for suspicious use of WMI commands that attackers may leverage to interact with remote systems. The searches specifically look for the use of WMI to run processes on remote systems.\
In the event that unauthorized WMI execution occurs, it will be important for analysts and investigators to determine the context of the event. These details may provide insights related to how WMI was used and to what end.
narrative = WMI is a Microsoft infrastructure for management data and operations on Windows operating systems. It includes of a set of utilities that can be leveraged to manage both local and remote Windows systems. Attackers are increasingly turning to WMI abuse in their efforts to conduct nefarious tasks, such as reconnaissance, detection of antivirus and virtual machines, code execution, lateral movement, persistence, and data exfiltration. The detection searches included in this Analytic Story are used to look for suspicious use of WMI commands that attackers may leverage to interact with remote systems. The searches specifically look for the use of WMI to run processes on remote systems. In the event that unauthorized WMI execution occurs, it will be important for analysts and investigators to determine the context of the event. These details may provide insights related to how WMI was used and to what end.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Suspicious Windows Registry Activities]
dist/escu/default/analyticstories.conf
Vendored
+110 -12
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-07-02T15:44:59 UTC
# On Date: 2021-07-13T23:06:08 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -546,7 +546,7 @@ version = 5
references = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"]
maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
spec_version = 3
searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Empire with PowerShell Script Block Logging - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - PowerShell Domain Enumeration - Rule", "ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unloading AMSI via Reflection - Rule", "ESCU - WMI Recon Running Process Or Services - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Empire with PowerShell Script Block Logging - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - PowerShell Domain Enumeration - Rule", "ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unloading AMSI via Reflection - Rule", "ESCU - WMI Recon Running Process Or Services - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent.
narrative = The searches in this Analytic Story monitor for parameters often used for malicious purposes. It is helpful to understand how often the notable events generated by this story occur, as well as the commonalities between some of these events. These factors may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. Likewise, it is important to determine whether the issue is restricted to a single user/system or is broader in scope. \
The following factors may assist you in determining whether the event is malicious: \
@@ -720,7 +720,7 @@ version = 1
references = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"]
maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
spec_version = 3
searches = ["ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"]
searches = ["ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"]
description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others.
narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware.
@@ -742,7 +742,7 @@ version = 1
references = ["https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/", "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}]
spec_version = 3
searches = ["ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Wbemprox COM Object Execution - Rule"]
searches = ["ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Wbemprox COM Object Execution - Rule"]
description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the Revil ransomware, including looking for file writes associated with Revil, encrypting network shares, deleting shadow volume storage, registry key modification, deleting of security logs, and more.
narrative = Revil ransomware is a RaaS,that a single group may operates and manges the development of this ransomware. It involve the use of ransomware payloads along with exfiltration of data. Malicious actors demand payment for ransome of data and threaten deletion and exposure of exfiltrated data.
@@ -1026,9 +1026,7 @@ maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}]
spec_version = 3
searches = ["ESCU - Detect WMI Event Subscription Persistence - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"]
description = Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred.
narrative = WMI is a Microsoft infrastructure for management data and operations on Windows operating systems. It includes of a set of utilities that can be leveraged to manage both local and remote Windows systems. Attackers are increasingly turning to WMI abuse in their efforts to conduct nefarious tasks, such as reconnaissance, detection of antivirus and virtual machines, code execution, lateral movement, persistence, and data exfiltration. \
The detection searches included in this Analytic Story are used to look for suspicious use of WMI commands that attackers may leverage to interact with remote systems. The searches specifically look for the use of WMI to run processes on remote systems.\
In the event that unauthorized WMI execution occurs, it will be important for analysts and investigators to determine the context of the event. These details may provide insights related to how WMI was used and to what end.
narrative = WMI is a Microsoft infrastructure for management data and operations on Windows operating systems. It includes of a set of utilities that can be leveraged to manage both local and remote Windows systems. Attackers are increasingly turning to WMI abuse in their efforts to conduct nefarious tasks, such as reconnaissance, detection of antivirus and virtual machines, code execution, lateral movement, persistence, and data exfiltration. The detection searches included in this Analytic Story are used to look for suspicious use of WMI commands that attackers may leverage to interact with remote systems. The searches specifically look for the use of WMI to run processes on remote systems. In the event that unauthorized WMI execution occurs, it will be important for analysts and investigators to determine the context of the event. These details may provide insights related to how WMI was used and to what end.
[analytic_story://Suspicious Windows Registry Activities]
category = Adversary Tactics
@@ -1557,6 +1555,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087.00
known_false_positives = admin or power user may used this series of command.
providing_technologies = []
[savedsearch://ESCU - Allow File And Printing Sharing In Firewall - Rule]
type = detection
asset_type =
confidence = medium
explanation = This search is to detect a suspicious modification of firewall to allow file and printer sharing. This technique was seen in ransomware to be able to discover more machine connected to the compromised host to encrypt more files
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.007"]}
known_false_positives = network admin may modify this firewall feature that may cause this rule to be triggered.
providing_technologies = []
[savedsearch://ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule]
type = detection
asset_type =
@@ -1577,6 +1585,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.00
known_false_positives = administrator may allow inbound traffic in certain network or machine.
providing_technologies = []
[savedsearch://ESCU - Allow Network Discovery In Firewall - Rule]
type = detection
asset_type =
confidence = medium
explanation = This search is to detect a suspicious modification to the firewall to allow network discovery on a machine. This technique was seen in couple of ransomware (revil, reddot) to discover other machine connected to the compromised host to encrypt more files.
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.007"]}
known_false_positives = network admin may modify this firewall feature that may cause this rule to be triggered.
providing_technologies = []
[savedsearch://ESCU - Allow Operation with Consent Admin - Rule]
type = detection
asset_type =
@@ -3008,11 +3026,11 @@ providing_technologies = []
type = detection
asset_type =
confidence = medium
explanation = The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.
explanation = The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\
All event subscriptions have three components \
1. Filter - WQL Query for the events we want. EventID = 19 \
1. Consumer - An action to take upon triggering the filter. EventID = 20 \
1. Binding - Registers a filter to a consumer. EventID = 21 \
1. Filter - WQL Query for the events we want. EventID equals 19 \
1. Consumer - An action to take upon triggering the filter. EventID equals 20 \
1. Binding - Registers a filter to a consumer. EventID equals 21 \
Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription.
how_to_implement = To successfully implement this search, you need to be ingesting logs with that provide WMI Event Subscription from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA and have enabled EventID 19, 20 and 21. Tune and filter known good to limit the volume.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.003"]}
@@ -3167,6 +3185,26 @@ annotations = {"cis20": ["CIS 3"], "kill_chain_phases": ["Installation", "Action
known_false_positives = While legitimate, these NirSoft tools are prone to abuse. You should verfiy that the tool was used for a legitimate purpose.
providing_technologies = []
[savedsearch://ESCU - Disable AMSI Through Registry - Rule]
type = detection
asset_type =
confidence = medium
explanation = this search is to identify modification in registry to disable AMSI windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible.
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]}
known_false_positives = network operator may disable this feature of windows but not so common.
providing_technologies = []
[savedsearch://ESCU - Disable ETW Through Registry - Rule]
type = detection
asset_type =
confidence = medium
explanation = this search is to identify modification in registry to disable ETW windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible.
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]}
known_false_positives = network operator may disable this feature of windows but not so common.
providing_technologies = []
[savedsearch://ESCU - Disable Logs Using WevtUtil - Rule]
type = detection
asset_type =
@@ -3541,6 +3579,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"]}
known_false_positives = unknown. Filter as needed. Modify the time span as needed.
providing_technologies = []
[savedsearch://ESCU - Excessive Usage Of SC Service Utility - Rule]
type = detection
asset_type =
confidence = medium
explanation = This search is to detect a suspicious excessive usage of sc.exe in a host machine. This technique was seen in several ransomware , xmrig and other malware to create, modify, delete or disable a service may related to security application or to gain privilege escalation.
how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1569.002"]}
known_false_positives = excessive execution of sc.exe is quite suspicious since it can modify or execute app in high privilege permission.
providing_technologies = []
[savedsearch://ESCU - Excessive Usage Of Taskkill - Rule]
type = detection
asset_type =
@@ -3601,6 +3649,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036"]}
known_false_positives = Administrators may allow creation of script or exe in the paths specified. Filter as needed.
providing_technologies = []
[savedsearch://ESCU - Execute Javascript With Jscript COM CLSID - Rule]
type = detection
asset_type =
confidence = medium
explanation = This analytic will identify suspicious process of cscript.exe where it tries to execute javascript using jscript.encode CLSID (COM OBJ). This technique was seen in ransomware (reddot ransomware) where it execute javascript with this com object with combination of amsi disabling technique.
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.005"]}
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - Execution of File With Spaces Before Extension - Rule]
type = detection
asset_type = Endpoint
@@ -4215,6 +4273,16 @@ annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["
known_false_positives = None at this time
providing_technologies = []
[savedsearch://ESCU - Msmpeng Application DLL Side Loading - Rule]
type = detection
asset_type =
confidence = medium
explanation = This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in non default windows defender folder. This technique was seen couple days ago with revil ransomware in Kaseya Supply chain. The approach is to drop an old version of msmpeng.exe to load the actual payload name as mspvc.dll which will load the revil ransomware to the compromise machine
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.002"]}
known_false_positives = quite minimal false positive expected.
providing_technologies = []
[savedsearch://ESCU - Multiple Archive Files Http Post Traffic - Rule]
type = detection
asset_type =
@@ -4715,6 +4783,26 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027.00
known_false_positives = powershell developer may used this function in their script for instance checking too.
providing_technologies = []
[savedsearch://ESCU - Powershell Disable Security Monitoring - Rule]
type = detection
asset_type =
confidence = medium
explanation = This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections.
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]}
known_false_positives = Limited false positives. However, tune based on scripts that may perform this action.
providing_technologies = []
[savedsearch://ESCU - Powershell Enable SMB1Protocol Feature - Rule]
type = detection
asset_type =
confidence = medium
explanation = This search is to detect a suspicious enabling of smb1protocol through "powershell.exe". This technique was seen in some ransomware (like reddot) where it enable smb share to do the lateral movement and encrypt other files within the compromise network system.
how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027.005"]}
known_false_positives = network operator may enable or disable this windows feature.
providing_technologies = []
[savedsearch://ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule]
type = detection
asset_type =
@@ -4946,6 +5034,16 @@ annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"
known_false_positives = network administrator may used this command for checking purposes
providing_technologies = []
[savedsearch://ESCU - Recursive Delete of Directory In Batch CMD - Rule]
type = detection
asset_type =
confidence = medium
explanation = This search is to detect a suspicious commandline designed to delete files or directory recursive using batch command. This technique was seen in ransomware (reddot) where it it tries to delete the files in recycle bin to impaire user from recovering deleted files.
how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004"]}
known_false_positives = network operator may use this batch command to delete recursively a directory or files within directory
providing_technologies = []
[savedsearch://ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule]
type = detection
asset_type = Endpoint
@@ -5983,7 +6081,7 @@ providing_technologies = []
type = detection
asset_type = Endpoint
confidence = medium
explanation = This analytic looks for the creation of WMI permanent event subscriptions. The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.
explanation = This analytic looks for the creation of WMI permanent event subscriptions. The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\
All event subscriptions have three components \
1. Filter - WQL Query for the events we want. EventID = 19 \
1. Consumer - An action to take upon triggering the filter. EventID = 20 \
dist/escu/default/app.conf
Vendored
+2 -2
View File
@@ -4,7 +4,7 @@
is_configured = false
state = enabled
state_change_requires_restart = false
build = 32560
build = 34075
[triggers]
reload.analytic_stories = simple
@@ -19,7 +19,7 @@ reload.content-version = simple
[launcher]
author = Splunk
version = 3.25.0
version = 3.25.1
description = Explore the Analytic Stories included with ES Content Updates.
[ui]
dist/escu/default/collections.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-07-13T07:57:29 UTC
# On Date: 2021-07-13T23:06:08 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/content-version.conf
Vendored
+1 -1
View File
@@ -1,2 +1,2 @@
[content-version]
version = 3.25.0
version = 3.25.1
dist/escu/default/macros.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-07-13T07:57:29 UTC
# On Date: 2021-07-13T23:06:08 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/savedsearches.conf
Vendored
+22 -7
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-07-13T07:57:29 UTC
# On Date: 2021-07-13T23:06:08 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -7323,10 +7323,20 @@ search = | tstats `security_content_summariesonly` count values(Processes.proces
[ESCU - Detect WMI Event Subscription Persistence - Rule]
action.escu = 0
action.escu.enabled = 1
description = The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions. All event subscriptions have three components 1. Filter - WQL Query for the events we want. EventID = 19 1. Consumer - An action to take upon triggering the filter. EventID = 20 1. Binding - Registers a filter to a consumer. EventID = 21 Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription.
description = The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\
All event subscriptions have three components \
1. Filter - WQL Query for the events we want. EventID equals 19 \
1. Consumer - An action to take upon triggering the filter. EventID equals 20 \
1. Binding - Registers a filter to a consumer. EventID equals 21 \
Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription.
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.003"]}
action.escu.data_models = []
action.escu.eli5 = The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions. All event subscriptions have three components 1. Filter - WQL Query for the events we want. EventID = 19 1. Consumer - An action to take upon triggering the filter. EventID = 20 1. Binding - Registers a filter to a consumer. EventID = 21 Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription.
action.escu.eli5 = The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\
All event subscriptions have three components \
1. Filter - WQL Query for the events we want. EventID equals 19 \
1. Consumer - An action to take upon triggering the filter. EventID equals 20 \
1. Binding - Registers a filter to a consumer. EventID equals 21 \
Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription.
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with that provide WMI Event Subscription from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA and have enabled EventID 19, 20 and 21. Tune and filter known good to limit the volume.
action.escu.known_false_positives = It is possible some applications will create a consumer and may be required to be filtered. For tuning, add any additional LOLBin's for further depth of coverage.
action.escu.creation_date = 2021-06-16
@@ -7345,7 +7355,12 @@ action.correlationsearch.label = ESCU - Detect WMI Event Subscription Persistenc
action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.003"]}
schedule_window = auto
action.notable = 1
action.notable.param.rule_description = The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions. All event subscriptions have three components 1. Filter - WQL Query for the events we want. EventID = 19 1. Consumer - An action to take upon triggering the filter. EventID = 20 1. Binding - Registers a filter to a consumer. EventID = 21 Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription.
action.notable.param.rule_description = The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\
All event subscriptions have three components \
1. Filter - WQL Query for the events we want. EventID equals 19 \
1. Consumer - An action to take upon triggering the filter. EventID equals 20 \
1. Binding - Registers a filter to a consumer. EventID equals 21 \
Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription.
action.notable.param.rule_title = Detect WMI Event Subscription Persistence
action.notable.param.security_domain = endpoint
action.notable.param.severity = high
@@ -19707,7 +19722,7 @@ search = `wmi` EventCode=5861 Binding | rex field=Message "Consumer =\s+(?<consu
[ESCU - WMI Permanent Event Subscription - Sysmon - Rule]
action.escu = 0
action.escu.enabled = 1
description = This analytic looks for the creation of WMI permanent event subscriptions. The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.
description = This analytic looks for the creation of WMI permanent event subscriptions. The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\
All event subscriptions have three components \
1. Filter - WQL Query for the events we want. EventID = 19 \
1. Consumer - An action to take upon triggering the filter. EventID = 20 \
@@ -19715,7 +19730,7 @@ All event subscriptions have three components \
Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription.
action.escu.mappings = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.003"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]}
action.escu.data_models = []
action.escu.eli5 = This analytic looks for the creation of WMI permanent event subscriptions. The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.
action.escu.eli5 = This analytic looks for the creation of WMI permanent event subscriptions. The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\
All event subscriptions have three components \
1. Filter - WQL Query for the events we want. EventID = 19 \
1. Consumer - An action to take upon triggering the filter. EventID = 20 \
@@ -19740,7 +19755,7 @@ action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"]
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['dest']
action.notable.param.rule_description = This analytic looks for the creation of WMI permanent event subscriptions. The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.
action.notable.param.rule_description = This analytic looks for the creation of WMI permanent event subscriptions. The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\
All event subscriptions have three components \
1. Filter - WQL Query for the events we want. EventID = 19 \
1. Consumer - An action to take upon triggering the filter. EventID = 20 \
dist/escu/default/transforms.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-07-13T07:57:29 UTC
# On Date: 2021-07-13T23:06:08 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/use_case_library.conf
Vendored
+9 -6
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-07-13T07:57:29 UTC
# On Date: 2021-07-13T23:06:08 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -1026,9 +1026,7 @@ maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}]
spec_version = 3
searches = ["ESCU - Detect WMI Event Subscription Persistence - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"]
description = Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred.
narrative = WMI is a Microsoft infrastructure for management data and operations on Windows operating systems. It includes of a set of utilities that can be leveraged to manage both local and remote Windows systems. Attackers are increasingly turning to WMI abuse in their efforts to conduct nefarious tasks, such as reconnaissance, detection of antivirus and virtual machines, code execution, lateral movement, persistence, and data exfiltration. \
The detection searches included in this Analytic Story are used to look for suspicious use of WMI commands that attackers may leverage to interact with remote systems. The searches specifically look for the use of WMI to run processes on remote systems.\
In the event that unauthorized WMI execution occurs, it will be important for analysts and investigators to determine the context of the event. These details may provide insights related to how WMI was used and to what end.
narrative = WMI is a Microsoft infrastructure for management data and operations on Windows operating systems. It includes of a set of utilities that can be leveraged to manage both local and remote Windows systems. Attackers are increasingly turning to WMI abuse in their efforts to conduct nefarious tasks, such as reconnaissance, detection of antivirus and virtual machines, code execution, lateral movement, persistence, and data exfiltration. The detection searches included in this Analytic Story are used to look for suspicious use of WMI commands that attackers may leverage to interact with remote systems. The searches specifically look for the use of WMI to run processes on remote systems. In the event that unauthorized WMI execution occurs, it will be important for analysts and investigators to determine the context of the event. These details may provide insights related to how WMI was used and to what end.
[analytic_story://Suspicious Windows Registry Activities]
category = Adversary Tactics
@@ -3028,7 +3026,12 @@ providing_technologies = []
type = detection
asset_type =
confidence = medium
explanation = The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions. All event subscriptions have three components 1. Filter - WQL Query for the events we want. EventID = 19 1. Consumer - An action to take upon triggering the filter. EventID = 20 1. Binding - Registers a filter to a consumer. EventID = 21 Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription.
explanation = The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\
All event subscriptions have three components \
1. Filter - WQL Query for the events we want. EventID equals 19 \
1. Consumer - An action to take upon triggering the filter. EventID equals 20 \
1. Binding - Registers a filter to a consumer. EventID equals 21 \
Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription.
how_to_implement = To successfully implement this search, you need to be ingesting logs with that provide WMI Event Subscription from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA and have enabled EventID 19, 20 and 21. Tune and filter known good to limit the volume.
annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.003"]}
known_false_positives = It is possible some applications will create a consumer and may be required to be filtered. For tuning, add any additional LOLBin's for further depth of coverage.
@@ -6078,7 +6081,7 @@ providing_technologies = []
type = detection
asset_type = Endpoint
confidence = medium
explanation = This analytic looks for the creation of WMI permanent event subscriptions. The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.
explanation = This analytic looks for the creation of WMI permanent event subscriptions. The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\
All event subscriptions have three components \
1. Filter - WQL Query for the events we want. EventID = 19 \
1. Consumer - An action to take upon triggering the filter. EventID = 20 \
dist/escu/lookups/mitre_enrichment.csv
Vendored
+208 -332
View File
@@ -1,182 +1,59 @@
mitre_id,technique,tactics,groups
T1553.006,Code Signing Policy Modification,Defense Evasion,Turla|APT39
T1614,System Location Discovery,Discovery,no
T1613,Container and Resource Discovery,Discovery,no
T1552.007,Container API,Credential Access,no
T1612,Build Image on Host,Defense Evasion,no
T1611,Escape to Host,Privilege Escalation,no
T1204.003,Malicious Image,Execution,no
T1053.007,Container Orchestration Job,Execution|Persistence|Privilege Escalation,no
T1610,Deploy Container,Defense Evasion|Execution,no
T1609,Container Administration Command,Execution,no
T1608.005,Link Target,Resource Development,Silent Librarian
T1608.004,Drive-by Target,Resource Development,APT32|Threat Group-3390
T1608.003,Install Digital Certificate,Resource Development,no
T1608.002,Upload Tool,Resource Development,Threat Group-3390
T1608.001,Upload Malware,Resource Development,APT32
T1608,Stage Capabilities,Resource Development,no
T1016.001,Internet Connection Discovery,Discovery,APT29|UNC2452|Turla
T1553.005,Mark-of-the-Web Bypass,Defense Evasion,TA505
T1555.005,Password Managers,Credential Access,Fox Kitten|Operation Wocao
T1484.002,Domain Trust Modification,Defense Evasion|Privilege Escalation,APT29|UNC2452
T1484.001,Group Policy Modification,Defense Evasion|Privilege Escalation,Indrik Spider
T1547.014,Active Setup,Persistence|Privilege Escalation,no
T1606.002,SAML Tokens,Credential Access,APT29|UNC2452
T1606.001,Web Cookies,Credential Access,APT29|UNC2452
T1606,Forge Web Credentials,Credential Access,no
T1555.004,Windows Credential Manager,Credential Access,Stealth Falcon|OilRig|Turla
T1059.008,Network Device CLI,Execution,no
T1602.002,Network Device Configuration Dump,Collection,no
T1542.005,TFTP Boot,Defense Evasion|Persistence,no
T1542.004,ROMMONkit,Defense Evasion|Persistence,no
T1602.001,SNMP (MIB Dump),Collection,no
T1602,Data from Configuration Repository,Collection,no
T1601.002,Downgrade System Image,Defense Evasion,no
T1601.001,Patch System Image,Defense Evasion,no
T1601,Modify System Image,Defense Evasion,no
T1600.002,Disable Crypto Hardware,Defense Evasion,no
T1600.001,Reduce Key Space,Defense Evasion,no
T1600,Weaken Encryption,Defense Evasion,no
T1556.004,Network Device Authentication,Credential Access|Defense Evasion|Persistence,no
T1599.001,Network Address Translation Traversal,Defense Evasion,no
T1599,Network Boundary Bridging,Defense Evasion,no
T1020.001,Traffic Duplication,Exfiltration,no
T1557.002,ARP Cache Poisoning,Credential Access|Collection,Cleaver
T1588.006,Vulnerabilities,Resource Development,Sandworm Team
T1053.006,Systemd Timers,Execution|Persistence|Privilege Escalation,no
T1562.008,Disable Cloud Logs,Defense Evasion,no
T1547.012,Print Processors,Persistence|Privilege Escalation,no
T1598.003,Spearphishing Link,Reconnaissance,Silent Librarian|Sidewinder|Sandworm Team|APT32|Kimsuky
T1598.002,Spearphishing Attachment,Reconnaissance,Sidewinder
T1598.001,Spearphishing Service,Reconnaissance,no
T1598,Phishing for Information,Reconnaissance,ZIRCONIUM|APT28
T1597.002,Purchase Technical Data,Reconnaissance,no
T1597.001,Threat Intel Vendors,Reconnaissance,no
T1597,Search Closed Sources,Reconnaissance,no
T1596.005,Scan Databases,Reconnaissance,no
T1596.004,CDNs,Reconnaissance,no
T1596.003,Digital Certificates,Reconnaissance,no
T1596.001,DNS/Passive DNS,Reconnaissance,no
T1596.002,WHOIS,Reconnaissance,no
T1596,Search Open Technical Databases,Reconnaissance,no
T1595.002,Vulnerability Scanning,Reconnaissance,Volatile Cedar|APT28|Sandworm Team
T1595.001,Scanning IP Blocks,Reconnaissance,no
T1595,Active Scanning,Reconnaissance,no
T1594,Search Victim-Owned Websites,Reconnaissance,Silent Librarian|Sandworm Team
T1593.002,Search Engines,Reconnaissance,no
T1593.001,Social Media,Reconnaissance,no
T1593,Search Open Websites/Domains,Reconnaissance,Sandworm Team
T1592.004,Client Configurations,Reconnaissance,HAFNIUM
T1592.003,Firmware,Reconnaissance,no
T1592.002,Software,Reconnaissance,Sandworm Team
T1592.001,Hardware,Reconnaissance,no
T1592,Gather Victim Host Information,Reconnaissance,no
T1591.004,Identify Roles,Reconnaissance,no
T1591.003,Identify Business Tempo,Reconnaissance,no
T1591.001,Determine Physical Locations,Reconnaissance,no
T1591.002,Business Relationships,Reconnaissance,Sandworm Team
T1591,Gather Victim Org Information,Reconnaissance,no
T1590.006,Network Security Appliances,Reconnaissance,no
T1590.005,IP Addresses,Reconnaissance,HAFNIUM
T1590.004,Network Topology,Reconnaissance,no
T1590.003,Network Trust Dependencies,Reconnaissance,no
T1590.002,DNS,Reconnaissance,no
T1590.001,Domain Properties,Reconnaissance,Sandworm Team
T1590,Gather Victim Network Information,Reconnaissance,HAFNIUM
T1589.003,Employee Names,Reconnaissance,Silent Librarian|Sandworm Team
T1589.002,Email Addresses,Reconnaissance,TA551|MuddyWater|HAFNIUM|APT32|Silent Librarian|Sandworm Team
T1589.001,Credentials,Reconnaissance,APT28|Magic Hound|Chimera
T1589,Gather Victim Identity Information,Reconnaissance,APT32
T1588.005,Exploits,Resource Development,no
T1588.004,Digital Certificates,Resource Development,Lazarus Group|Silent Librarian
T1588.003,Code Signing Certificates,Resource Development,Wizard Spider
T1588.002,Tool,Resource Development,MuddyWater|Silent Librarian|GALLIUM|Sandworm Team
T1588.001,Malware,Resource Development,Turla|APT1
T1588,Obtain Capabilities,Resource Development,no
T1587.004,Exploits,Resource Development,no
T1587.003,Digital Certificates,Resource Development,APT29|PROMETHIUM
T1587.002,Code Signing Certificates,Resource Development,PROMETHIUM|Patchwork
T1587.001,Malware,Resource Development,APT29|Lazarus Group|UNC2452|Sandworm Team|Turla|FIN7|Night Dragon|Cleaver
T1587,Develop Capabilities,Resource Development,Kimsuky
T1586.002,Email Accounts,Resource Development,Magic Hound|Kimsuky
T1586.001,Social Media Accounts,Resource Development,no
T1586,Compromise Accounts,Resource Development,no
T1585.002,Email Accounts,Resource Development,Magic Hound|Silent Librarian|Sandworm Team|APT1
T1585.001,Social Media Accounts,Resource Development,Fox Kitten|Sandworm Team|APT32|Cleaver
T1585,Establish Accounts,Resource Development,Fox Kitten|APT17
T1584.006,Web Services,Resource Development,Turla
T1584.005,Botnet,Resource Development,no
T1584.004,Server,Resource Development,Indrik Spider|Turla|APT16
T1584.003,Virtual Private Server,Resource Development,Turla
T1584.002,DNS Server,Resource Development,no
T1584.001,Domains,Resource Development,APT29|UNC2452|APT1
T1583.006,Web Services,Resource Development,ZIRCONIUM|MuddyWater|HAFNIUM|Lazarus Group|Turla|APT32|APT17|APT29
T1583.005,Botnet,Resource Development,no
T1583.004,Server,Resource Development,GALLIUM|Sandworm Team
T1583.003,Virtual Private Server,Resource Development,HAFNIUM|TEMP.Veles
T1583.002,DNS Server,Resource Development,no
T1584,Compromise Infrastructure,Resource Development,no
T1583.001,Domains,Resource Development,APT29|Mustang Panda|ZIRCONIUM|UNC2452|Lazarus Group|Silent Librarian|menuPass|Sandworm Team|APT32|Kimsuky|APT1|APT28
T1583,Acquire Infrastructure,Resource Development,no
T1564.007,VBA Stomping,Defense Evasion,no
T1558.004,AS-REP Roasting,Credential Access,no
T1580,Cloud Infrastructure Discovery,Discovery,no
T1218.012,Verclsid,Defense Evasion,no
T1205.001,Port Knocking,Defense Evasion|Persistence|Command And Control,PROMETHIUM
T1205.001,Port Knocking,Defense Evasion|Persistence|Command And Control,no
T1564.006,Run Virtual Instance,Defense Evasion,no
T1564.005,Hidden File System,Defense Evasion,Strider|Equation
T1556.003,Pluggable Authentication Modules,Credential Access|Defense Evasion|Persistence,no
T1556.003,Pluggable Authentication Modules,Credential Access|Defense Evasion,no
T1574.012,COR_PROFILER,Persistence|Privilege Escalation|Defense Evasion,Blue Mockingbird
T1562.007,Disable or Modify Cloud Firewall,Defense Evasion,no
T1098.004,SSH Authorized Keys,Persistence,no
T1480.001,Environmental Keying,Defense Evasion,APT41|Equation
T1059.007,JavaScript,Execution,MuddyWater|Turla|Higaisa|Sidewinder|Evilnum|Kimsuky|FIN6|APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer
T1059.007,JavaScript/JScript,Execution,APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer
T1578.004,Revert Cloud Instance,Defense Evasion,no
T1578.003,Delete Cloud Instance,Defense Evasion,no
T1578.001,Create Snapshot,Defense Evasion,no
T1578.002,Create Cloud Instance,Defense Evasion,no
T1127.001,MSBuild,Defense Evasion,Frankenstein
T1027.005,Indicator Removal from Tools,Defense Evasion,Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda
T1027.005,Indicator Removal from Tools,Defense Evasion,Soft Cell|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda
T1562.006,Indicator Blocking,Defense Evasion,no
T1573.002,Asymmetric Cryptography,Command And Control,Operation Wocao|Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6
T1573.001,Symmetric Cryptography,Command And Control,Mustang Panda|Darkhotel|ZIRCONIUM|Higaisa|Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group
T1573.002,Asymmetric Cryptography,Command And Control,Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6
T1573.001,Symmetric Cryptography,Command And Control,Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group
T1573,Encrypted Channel,Command And Control,Tropic Trooper
T1027.004,Compile After Delivery,Defense Evasion,Gamaredon Group|Rocke|MuddyWater
T1574.004,Dylib Hijacking,Persistence|Privilege Escalation|Defense Evasion,no
T1546.015,Component Object Model Hijacking,Privilege Escalation|Persistence,APT28
T1071.004,DNS,Command And Control,Chimera|APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7
T1071.003,Mail Protocols,Command And Control,Turla|Kimsuky|APT32|SilverTerrier|APT28
T1071.002,File Transfer Protocols,Command And Control,Kimsuky|APT41|SilverTerrier|Honeybee
T1071.001,Web Protocols,Command And Control,APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|UNC2452|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|APT19|Cobalt Group|Rancor|Orangeworm|Threat Group-3390|Ke3chang|Turla|APT37|Dark Caracal|Lazarus Group|BRONZE BUTLER|APT32|Magic Hound|OilRig|Gamaredon Group|Stealth Falcon
T1572,Protocol Tunneling,Command And Control,Chimera|Fox Kitten|OilRig|Cobalt Group|FIN6
T1048.003,Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol,Exfiltration,Wizard Spider|FIN6|APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group
T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,APT29|UNC2452
T1071.004,DNS,Command And Control,APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7
T1071.003,Mail Protocols,Command And Control,APT32|SilverTerrier|APT28
T1071.002,File Transfer Protocols,Command And Control,APT41|SilverTerrier|Machete|Honeybee
T1071.001,Web Protocols,Command And Control,Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|Machete|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Cobalt Group|APT19|Threat Group-3390|Rancor|Orangeworm|APT37|Ke3chang|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|APT32|OilRig|Magic Hound|Gamaredon Group|Stealth Falcon
T1572,Protocol Tunneling,Command And Control,OilRig|Cobalt Group|FIN6
T1048.003,Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol,Exfiltration,APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group
T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,no
T1048.001,Exfiltration Over Symmetric Encrypted Non-C2 Protocol,Exfiltration,no
T1001.003,Protocol Impersonation,Command And Control,Higaisa|Lazarus Group
T1001.002,Steganography,Command And Control,APT29|Axiom
T1001.003,Protocol Impersonation,Command And Control,Lazarus Group
T1001.002,Steganography,Command And Control,Axiom
T1001.001,Junk Data,Command And Control,APT28
T1132.002,Non-Standard Encoding,Command And Control,no
T1132.001,Standard Encoding,Command And Control,HAFNIUM|TA551|Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork
T1132.001,Standard Encoding,Command And Control,Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork
T1090.004,Domain Fronting,Command And Control,APT29
T1090.003,Multi-hop Proxy,Command And Control,APT28|Operation Wocao|Inception|FIN4|APT29
T1090.002,External Proxy,Command And Control,APT39|Silence|GALLIUM|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28
T1090.001,Internal Proxy,Command And Control,APT29|Higaisa|UNC2452|Operation Wocao|APT39|Strider
T1090.003,Multi-hop Proxy,Command And Control,Inception|FIN4|APT29
T1090.002,External Proxy,Command And Control,APT39|Silence|Soft Cell|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28
T1090.001,Internal Proxy,Command And Control,APT39|Strider
T1102.003,One-Way Communication,Command And Control,Leviathan
T1102.002,Bidirectional Communication,Command And Control,ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|FIN7|Turla|APT37|Magic Hound|Carbanak
T1102.002,Bidirectional Communication,Command And Control,Sandworm Team|APT39|APT12|Turla|FIN7|APT37|Magic Hound|Carbanak
T1102.001,Dead Drop Resolver,Command And Control,Rocke|APT41|BRONZE BUTLER|RTM|Patchwork
T1571,Non-Standard Port,Command And Control,Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7
T1074.002,Remote Data Staging,Collection,APT29|Chimera|UNC2452|Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8
T1074.001,Local Data Staging,Collection,Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Honeybee|Patchwork|Dragonfly 2.0|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28
T1074.002,Remote Data Staging,Collection,Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8
T1074.001,Local Data Staging,Collection,Machete|Soft Cell|TEMP.Veles|Patchwork|Dragonfly 2.0|Honeybee|Leviathan|APT3|FIN5|menuPass|FIN6|Lazarus Group|Threat Group-3390|APT28
T1078.004,Cloud Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT33
T1564.004,NTFS File Attributes,Defense Evasion,APT32
T1564.003,Hidden Window,Defense Evasion,Higaisa|Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound
T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,HAFNIUM|Turla|Operation Wocao|PROMETHIUM|Tropic Trooper|FIN10|Stolen Pencil|APT32
T1078.002,Domain Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Indrik Spider|Chimera|Operation Wocao|Sandworm Team|Wizard Spider|APT29|TA505|APT3|Threat Group-1314
T1564.003,Hidden Window,Defense Evasion,Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound
T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Tropic Trooper|FIN10|Stolen Pencil|APT32
T1078.002,Domain Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,TA505|APT3|Threat Group-1314
T1078.001,Default Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,no
T1564.002,Hidden Users,Defense Evasion,no
T1574.006,Dynamic Linker Hijacking,Persistence|Privilege Escalation|Defense Evasion,APT41|Rocke
T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,Mustang Panda|Higaisa|BlackTech|Sidewinder|Chimera|BRONZE BUTLER|Naikon|APT41|GALLIUM|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390
T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,Evilnum|APT41|Whitefly|RTM|Threat Group-3390|menuPass
T1574.006,LD_PRELOAD,Persistence|Privilege Escalation|Defense Evasion,Rocke
T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,BRONZE BUTLER|Naikon|APT41|Soft Cell|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390
T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,Whitefly|RTM|Threat Group-3390|menuPass
T1574.008,Path Interception by Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,no
T1574.007,Path Interception by PATH Environment Variable,Persistence|Privilege Escalation|Defense Evasion,no
T1574.009,Path Interception by Unquoted Path,Persistence|Privilege Escalation|Defense Evasion,no
@@ -184,174 +61,174 @@ T1574.011,Services Registry Permissions Weakness,Persistence|Privilege Escalatio
T1574.005,Executable Installer File Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no
T1574.010,Services File Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no
T1574,Hijack Execution Flow,Persistence|Privilege Escalation|Defense Evasion,no
T1069.001,Local Groups,Discovery,Chimera|Operation Wocao|Turla|OilRig|admin@338
T1570,Lateral Tool Transfer,Lateral Movement,Chimera|GALLIUM|Operation Wocao|APT32|Wizard Spider|Turla|FIN10
T1069.001,Local Groups,Discovery,Turla|OilRig|admin@338
T1570,Lateral Tool Transfer,Lateral Movement,APT32|Wizard Spider|Turla|FIN10
T1568.003,DNS Calculation,Command And Control,APT12
T1204.002,Malicious File,Execution,Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|BRONZE BUTLER|FIN7|Dragonfly 2.0|APT19|Dark Caracal|Cobalt Group|Gorgon Group|Patchwork|MuddyWater|DarkHydrus|OilRig|APT32|Rancor|Lazarus Group|APT29|APT28|APT37|FIN8|Elderwood|menuPass|PLATINUM|TA459|Leviathan
T1204.001,Malicious Link,Execution,APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla
T1204.002,Malicious File,Execution,Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|APT19|Dragonfly 2.0|BRONZE BUTLER|Cobalt Group|DarkHydrus|Gorgon Group|Patchwork|OilRig|Dark Caracal|MuddyWater|Lazarus Group|FIN7|APT32|Rancor|APT37|FIN8|APT28|Elderwood|TA459|APT29|Leviathan|menuPass|PLATINUM
T1204.001,Malicious Link,Execution,Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla
T1195.003,Compromise Hardware Supply Chain,Initial Access,no
T1195.002,Compromise Software Supply Chain,Initial Access,APT29|UNC2452|Cobalt Group|GOLD SOUTHFIELD|Dragonfly|Sandworm Team|APT41
T1195.002,Compromise Software Supply Chain,Initial Access,Sandworm Team|APT41
T1195.001,Compromise Software Dependencies and Development Tools,Initial Access,no
T1568.001,Fast Flux DNS,Command And Control,menuPass|TA505
T1052.001,Exfiltration over USB,Exfiltration,Mustang Panda|Tropic Trooper
T1569.002,Service Execution,Execution,Chimera|Operation Wocao|Wizard Spider|Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang
T1568.001,Fast Flux DNS,Command And Control,TA505
T1052.001,Exfiltration over USB,Exfiltration,Tropic Trooper
T1569.002,Service Execution,Execution,Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang
T1569.001,Launchctl,Execution,no
T1569,System Services,Execution,no
T1568.002,Domain Generation Algorithms,Command And Control,TA551|APT41
T1568,Dynamic Resolution,Command And Control,APT29|UNC2452
T1568.002,Domain Generation Algorithms,Command And Control,APT41
T1568,Dynamic Resolution,Command And Control,no
T1011.001,Exfiltration Over Bluetooth,Exfiltration,no
T1567.002,Exfiltration to Cloud Storage,Exfiltration,ZIRCONIUM|HAFNIUM|Chimera|Leviathan|Turla
T1567.002,Exfiltration to Cloud Storage,Exfiltration,Leviathan|Turla
T1567.001,Exfiltration to Code Repository,Exfiltration,no
T1059.006,Python,Execution,ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete
T1059.005,Visual Basic,Execution,Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|Lazarus Group|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound
T1059.006,Python,Execution,Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete
T1059.005,Visual Basic,Execution,APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound
T1059.004,Unix Shell,Execution,Rocke|APT41
T1059.003,Windows Command Shell,Execution,APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|UNC2452|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Gorgon Group|Dark Caracal|Rancor|Ke3chang|Dragonfly 2.0|Leviathan|APT37|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|menuPass|Threat Group-3390|Gamaredon Group|Patchwork|Suckfly|Threat Group-1314|APT3|admin@338|APT1
T1059.003,Windows Command Shell,Execution,TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|Soft Cell|Turla|Silence|APT32|APT39|Darkhotel|MuddyWater|APT18|APT38|Dark Caracal|Gorgon Group|Dragonfly 2.0|Rancor|Ke3chang|APT37|Leviathan|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|Threat Group-3390|menuPass|Gamaredon Group|Suckfly|Patchwork|Threat Group-1314|APT3|admin@338|APT1
T1059.002,AppleScript,Execution,no
T1059.001,PowerShell,Execution,Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Lazarus Group|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|Dragonfly 2.0|APT28|Thrip|Cobalt Group|DarkHydrus|Gorgon Group|Leviathan|TA459|MuddyWater|FIN8|Magic Hound|CopyKittens|OilRig|BRONZE BUTLER|FIN10|Threat Group-3390|APT32|FIN7|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda
T1567,Exfiltration Over Web Service,Exfiltration,APT28
T1059.001,PowerShell,Execution,Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|Soft Cell|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|DarkHydrus|APT28|Thrip|Gorgon Group|Cobalt Group|Dragonfly 2.0|Leviathan|TA459|FIN8|MuddyWater|Magic Hound|OilRig|BRONZE BUTLER|CopyKittens|APT32|FIN7|FIN10|Threat Group-3390|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda
T1567,Exfiltration Over Web Service,Exfiltration,no
T1497.003,Time Based Evasion,Defense Evasion|Discovery,no
T1497.002,User Activity Based Checks,Defense Evasion|Discovery,Darkhotel|FIN7
T1497.001,System Checks,Defense Evasion|Discovery,Darkhotel|Evilnum|Frankenstein
T1497.002,User Activity Based Checks,Defense Evasion|Discovery,FIN7
T1497.001,System Checks,Defense Evasion|Discovery,Frankenstein
T1498.002,Reflection Amplification,Impact,no
T1498.001,Direct Network Flood,Impact,no
T1566.003,Spearphishing via Service,Initial Access,Ajax Security Team|Lazarus Group|Magic Hound|Windshift|FIN6|OilRig|Dark Caracal
T1566.002,Spearphishing Link,Initial Access,Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Cobalt Group|Turla|APT28|Dragonfly 2.0|OilRig|APT33|APT29|Leviathan|Elderwood|FIN8|Patchwork|Magic Hound
T1566.001,Spearphishing Attachment,Initial Access,Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|APT19|Lazarus Group|OilRig|APT32|BRONZE BUTLER|Dragonfly 2.0|MuddyWater|APT28|FIN8|TA459|Elderwood|APT29|Leviathan|Patchwork|APT37|menuPass|PLATINUM
T1566,Phishing,Initial Access,GOLD SOUTHFIELD|Dragonfly
T1566.003,Spearphishing via Service,Initial Access,Magic Hound|Windshift|FIN6|OilRig|Dark Caracal
T1566.002,Spearphishing Link,Initial Access,Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Turla|APT28|Cobalt Group|Dragonfly 2.0|OilRig|APT33|Elderwood|Leviathan|Magic Hound|Patchwork|APT29|FIN8
T1566.001,Spearphishing Attachment,Initial Access,Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Turla|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|OilRig|Lazarus Group|APT19|Dragonfly 2.0|BRONZE BUTLER|APT32|FIN8|MuddyWater|APT28|TA459|Leviathan|Patchwork|PLATINUM|Elderwood|APT29|APT37|menuPass
T1566,Phishing,Initial Access,no
T1565.003,Runtime Data Manipulation,Impact,APT38
T1565.002,Transmitted Data Manipulation,Impact,APT38
T1565.001,Stored Data Manipulation,Impact,FIN4|APT38
T1565,Data Manipulation,Impact,no
T1564.001,Hidden Files and Directories,Defense Evasion,Mustang Panda|Rocke|APT32|Tropic Trooper|Lazarus Group|APT28
T1564.001,Hidden Files and Directories,Defense Evasion,Rocke|APT32|Tropic Trooper|APT28|Lazarus Group
T1564,Hide Artifacts,Defense Evasion,no
T1563.002,RDP Hijacking,Lateral Movement,no
T1563.001,SSH Hijacking,Lateral Movement,no
T1563,Remote Service Session Hijacking,Lateral Movement,no
T1518.001,Security Software Discovery,Discovery,Windshift|Sidewinder|Operation Wocao|Wizard Spider|Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon
T1518.001,Security Software Discovery,Discovery,Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon
T1069.003,Cloud Groups,Discovery,no
T1069.002,Domain Groups,Discovery,Turla|Inception|OilRig|Dragonfly 2.0|Ke3chang
T1069.002,Domain Groups,Discovery,Turla|Wizard Spider|Inception|OilRig|FIN6|Dragonfly 2.0|Ke3chang
T1087.004,Cloud Account,Discovery,no
T1087.003,Email Account,Discovery,Sandworm Team|TA505
T1087.002,Domain Account,Discovery,MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|Dragonfly 2.0|BRONZE BUTLER|OilRig|menuPass|FIN6|Poseidon Group|Ke3chang
T1087.001,Local Account,Discovery,Chimera|Fox Kitten|Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338
T1087.002,Domain Account,Discovery,Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang
T1087.001,Local Account,Discovery,Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338
T1553.004,Install Root Certificate,Defense Evasion,no
T1562.004,Disable or Modify System Firewall,Defense Evasion,APT29|UNC2452|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak
T1562.003,Impair Command History Logging,Defense Evasion,no
T1562.002,Disable Windows Event Logging,Defense Evasion,APT29|UNC2452|Threat Group-3390
T1562.001,Disable or Modify Tools,Defense Evasion,APT29|MuddyWater|UNC2452|Wizard Spider|FIN6|Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda
T1562.004,Disable or Modify System Firewall,Defense Evasion,Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak
T1562.003,HISTCONTROL,Defense Evasion,no
T1562.002,Disable Windows Event Logging,Defense Evasion,Threat Group-3390
T1562.001,Disable or Modify Tools,Defense Evasion,Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda
T1562,Impair Defenses,Defense Evasion,no
T1003.004,LSA Secrets,Credential Access,OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390
T1003.005,Cached Domain Credentials,Credential Access,OilRig|MuddyWater|Leafminer|APT33
T1561.002,Disk Structure Wipe,Impact,Sandworm Team|Lazarus Group|APT38|APT37
T1561.001,Disk Content Wipe,Impact,Lazarus Group
T1561,Disk Wipe,Impact,no
T1560.003,Archive via Custom Method,Collection,Mustang Panda|Lazarus Group|Kimsuky|CopyKittens|FIN6
T1560.003,Archive via Custom Method,Collection,Lazarus Group|Kimsuky|CopyKittens|FIN6
T1560.002,Archive via Library,Collection,Lazarus Group|Threat Group-3390
T1560.001,Archive via Utility,Collection,APT29|Mustang Panda|HAFNIUM|UNC2452|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|APT1|Ke3chang
T1560.001,Archive via Utility,Collection,APT41|Soft Cell|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|APT3|Sowbug|menuPass|APT1|Ke3chang
T1560,Archive Collected Data,Collection,menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang
T1499.004,Application or System Exploitation,Impact,no
T1499.003,Application Exhaustion Flood,Impact,no
T1499.002,Service Exhaustion Flood,Impact,no
T1499.001,OS Exhaustion Flood,Impact,no
T1491.002,External Defacement,Impact,Sandworm Team
T1491.002,External Defacement,Impact,no
T1491.001,Internal Defacement,Impact,Lazarus Group
T1114.003,Email Forwarding Rule,Collection,Silent Librarian|Kimsuky
T1114.002,Remote Email Collection,Collection,APT29|HAFNIUM|Chimera|UNC2452|APT1|FIN4|Dragonfly 2.0|APT28|Leafminer|Ke3chang
T1114.001,Local Email Collection,Collection,Chimera|Magic Hound|APT1
T1114.003,Email Forwarding Rule,Collection,no
T1114.002,Remote Email Collection,Collection,APT1|FIN4|APT28|Dragonfly 2.0|Ke3chang|Leafminer
T1114.001,Local Email Collection,Collection,Magic Hound|APT1
T1134.005,SID-History Injection,Defense Evasion|Privilege Escalation,no
T1134.004,Parent PID Spoofing,Defense Evasion|Privilege Escalation,no
T1134.003,Make and Impersonate Token,Defense Evasion|Privilege Escalation,no
T1134.002,Create Process with Token,Defense Evasion|Privilege Escalation,Turla|Lazarus Group
T1134.001,Token Impersonation/Theft,Defense Evasion|Privilege Escalation,APT28
T1213.002,Sharepoint,Collection,Chimera|Ke3chang|APT28
T1213.002,Sharepoint,Collection,Ke3chang|APT28
T1213.001,Confluence,Collection,no
T1555.003,Credentials from Web Browsers,Credential Access,Ajax Security Team|ZIRCONIUM|FIN6|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats
T1555.003,Credentials from Web Browsers,Credential Access,Magic Hound|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats
T1555.002,Securityd Memory,Credential Access,no
T1555.001,Keychain,Credential Access,no
T1559.002,Dynamic Data Exchange,Execution,Sidewinder|Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7
T1559.002,Dynamic Data Exchange,Execution,Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7
T1559.001,Component Object Model,Execution,Gamaredon Group|MuddyWater
T1559,Inter-Process Communication,Execution,no
T1558.002,Silver Ticket,Credential Access,no
T1558.001,Golden Ticket,Credential Access,Ke3chang
T1558,Steal or Forge Kerberos Tickets,Credential Access,no
T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,Wizard Spider
T1557,Man-in-the-Middle,Credential Access|Collection,Kimsuky
T1556.002,Password Filter DLL,Credential Access|Defense Evasion|Persistence,Strider
T1556.001,Domain Controller Authentication,Credential Access|Defense Evasion|Persistence,Chimera
T1556,Modify Authentication Process,Credential Access|Defense Evasion|Persistence,no
T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,no
T1557,Man-in-the-Middle,Credential Access|Collection,no
T1556.002,Password Filter DLL,Credential Access|Defense Evasion,Strider
T1556.001,Domain Controller Authentication,Credential Access|Defense Evasion,no
T1556,Modify Authentication Process,Credential Access|Defense Evasion,no
T1056.004,Credential API Hooking,Collection|Credential Access,PLATINUM
T1056.003,Web Portal Capture,Collection|Credential Access,no
T1056.002,GUI Input Capture,Collection|Credential Access,FIN4
T1056.001,Keylogging,Collection|Credential Access,Ajax Security Team|Operation Wocao|APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28
T1555,Credentials from Password Stores,Credential Access,APT29|Evilnum|UNC2452|FIN6|APT39|OilRig|MuddyWater|Leafminer|APT33|Stealth Falcon
T1056.001,Keylogging,Collection|Credential Access,APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|Ke3chang|OilRig|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28
T1555,Credentials from Password Stores,Credential Access,APT39|OilRig|MuddyWater|Leafminer|APT33|Turla|Stealth Falcon
T1552.005,Cloud Instance Metadata API,Credential Access,no
T1003.008,/etc/passwd and /etc/shadow,Credential Access,no
T1003.007,Proc Filesystem,Credential Access,no
T1003.006,DCSync,Credential Access,APT29|UNC2452|Operation Wocao
T1558.003,Kerberoasting,Credential Access,APT29|UNC2452|Operation Wocao|Wizard Spider
T1003.006,DCSync,Credential Access,no
T1558.003,Kerberoasting,Credential Access,no
T1552.006,Group Policy Preferences,Credential Access,APT33
T1003.003,NTDS,Credential Access,Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6|Dragonfly 2.0
T1003.002,Security Account Manager,Credential Access,Wizard Spider|Threat Group-3390|Ke3chang|GALLIUM|Night Dragon|Dragonfly 2.0|menuPass
T1003.001,LSASS Memory,Credential Access,HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Leafminer|Magic Hound|Lazarus Group|MuddyWater|PLATINUM|FIN8|OilRig|BRONZE BUTLER|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver
T1110.004,Credential Stuffing,Credential Access,Chimera
T1110.003,Password Spraying,Credential Access,Silent Librarian|Chimera|APT28|APT33|Leafminer|Lazarus Group
T1110.002,Password Cracking,Credential Access,FIN6|APT41|Dragonfly 2.0|APT3
T1110.001,Password Guessing,Credential Access,APT28
T1021.006,Windows Remote Management,Lateral Movement,APT29|UNC2452|Chimera|Wizard Spider|Threat Group-3390
T1021.005,VNC,Lateral Movement,Fox Kitten|GCMAN
T1021.004,SSH,Lateral Movement,Fox Kitten|Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN
T1003.003,NTDS,Credential Access,FIN6|Dragonfly 2.0
T1003.002,Security Account Manager,Credential Access,Threat Group-3390|Ke3chang|Soft Cell|Night Dragon|Dragonfly 2.0|menuPass
T1003.001,LSASS Memory,Credential Access,Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|Soft Cell|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Lazarus Group|Leafminer|Magic Hound|MuddyWater|PLATINUM|FIN8|BRONZE BUTLER|OilRig|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver
T1110.004,Credential Stuffing,Credential Access,no
T1110.003,Password Spraying,Credential Access,APT33|Leafminer|Lazarus Group
T1110.002,Password Cracking,Credential Access,APT41|Dragonfly 2.0|APT3
T1110.001,Password Guessing,Credential Access,no
T1021.006,Windows Remote Management,Lateral Movement,Threat Group-3390
T1021.005,VNC,Lateral Movement,GCMAN
T1021.004,SSH,Lateral Movement,Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN
T1021.003,Distributed Component Object Model,Lateral Movement,no
T1021.002,SMB/Windows Admin Shares,Lateral Movement,Fox Kitten|APT41|Operation Wocao|Wizard Spider|Chimera|Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang
T1021.001,Remote Desktop Protocol,Lateral Movement,Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|FIN10|menuPass|Patchwork|FIN6|Lazarus Group|APT1|Axiom
T1021.002,SMB/Windows Admin Shares,Lateral Movement,Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang
T1021.001,Remote Desktop Protocol,Lateral Movement,Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|menuPass|FIN10|Patchwork|FIN6|Lazarus Group|APT1|Axiom
T1554,Compromise Client Software Binary,Persistence,no
T1036.006,Space after Filename,Defense Evasion,no
T1036.005,Match Legitimate Name or Location,Defense Evasion,APT29|Mustang Panda|Sidewinder|Darkhotel|Lazarus Group|Indrik Spider|UNC2452|Fox Kitten|Machete|Chimera|PROMETHIUM|Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1
T1036.004,Masquerade Task or Service,Defense Evasion,ZIRCONIUM|APT29|Higaisa|UNC2452|Fox Kitten|Kimsuky|Lazarus Group|PROMETHIUM|Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7
T1036.003,Rename System Utilities,Defense Evasion,menuPass|APT32|GALLIUM
T1036.005,Match Legitimate Name or Location,Defense Evasion,Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1
T1036.004,Masquerade Task or Service,Defense Evasion,Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7
T1036.003,Rename System Utilities,Defense Evasion,menuPass|APT32|Soft Cell|PLATINUM
T1036.002,Right-to-Left Override,Defense Evasion,BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic
T1036.001,Invalid Code Signature,Defense Evasion,Windshift|APT37
T1036.001,Invalid Code Signature,Defense Evasion,Windshift
T1553.003,SIP and Trust Provider Hijacking,Defense Evasion,no
T1553.002,Code Signing,Defense Evasion,APT29|GALLIUM|UNC2452|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel
T1553.002,Code Signing,Defense Evasion,Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|APT37|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel
T1553.001,Gatekeeper Bypass,Defense Evasion,no
T1553,Subvert Trust Controls,Defense Evasion,no
T1027.003,Steganography,Defense Evasion,TA551|BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37
T1027.002,Software Packing,Defense Evasion,ZIRCONIUM|Lazarus Group|TA505|Rocke|GALLIUM|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon
T1027.001,Binary Padding,Defense Evasion,Mustang Panda|Higaisa|Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee
T1027.003,Steganography,Defense Evasion,BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37
T1027.002,Software Packing,Defense Evasion,TA505|Rocke|Soft Cell|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon
T1027.001,Binary Padding,Defense Evasion,Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee
T1222.002,Linux and Mac File and Directory Permissions Modification,Defense Evasion,Rocke|APT32
T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,Wizard Spider
T1552.004,Private Keys,Credential Access,APT29|UNC2452|Operation Wocao|Rocke
T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,no
T1552.004,Private Keys,Credential Access,Rocke
T1552.003,Bash History,Credential Access,no
T1552.002,Credentials in Registry,Credential Access,APT32
T1552.001,Credentials In Files,Credential Access,Fox Kitten|Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3
T1552.001,Credentials In Files,Credential Access,Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3
T1552,Unsecured Credentials,Credential Access,no
T1216.001,PubPrn,Defense Evasion,APT32
T1070.006,Timestomp,Defense Evasion,APT29|UNC2452|Chimera|Kimsuky|Rocke|TEMP.Veles|APT32|Lazarus Group|APT28
T1070.006,Timestomp,Defense Evasion,Rocke|TEMP.Veles|APT32|Lazarus Group|APT28
T1070.005,Network Share Connection Removal,Defense Evasion,Threat Group-3390
T1070.004,File Deletion,Defense Evasion,APT39|Mustang Panda|Chimera|Evilnum|UNC2452|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|Threat Group-3390|FIN10|APT28|Group5|Lazarus Group|APT18|APT29
T1070.004,File Deletion,Defense Evasion,Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|FIN10|APT28|Threat Group-3390|Group5|Lazarus Group|APT18|APT29
T1070.003,Clear Command History,Defense Evasion,APT41
T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,APT29|UNC2452
T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,no
T1550.001,Application Access Token,Defense Evasion|Lateral Movement,APT28
T1550.003,Pass the Ticket,Defense Evasion|Lateral Movement,APT32|BRONZE BUTLER|APT29
T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,Chimera|Kimsuky|GALLIUM|APT32|Night Dragon|APT28|APT1
T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,APT29|UNC2452
T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,Soft Cell|APT32|Night Dragon|APT28|APT1
T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,no
T1548.004,Elevated Execution with Prompt,Privilege Escalation|Defense Evasion,no
T1548.003,Sudo and Sudo Caching,Privilege Escalation|Defense Evasion,no
T1548.002,Bypass User Account Control,Privilege Escalation|Defense Evasion,Evilnum|APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29
T1548.002,Bypass User Access Control,Privilege Escalation|Defense Evasion,APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29
T1548.001,Setuid and Setgid,Privilege Escalation|Defense Evasion,no
T1548,Abuse Elevation Control Mechanism,Privilege Escalation|Defense Evasion,no
T1136.003,Cloud Account,Persistence,no
T1070.002,Clear Linux or Mac System Logs,Defense Evasion,Rocke
T1070.001,Clear Windows Event Logs,Defense Evasion,Chimera|Operation Wocao|APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28
T1136.002,Domain Account,Persistence,HAFNIUM|GALLIUM
T1136.001,Local Account,Persistence,Fox Kitten|APT39|APT41|Dragonfly 2.0|Leafminer|APT3
T1070.001,Clear Windows Event Logs,Defense Evasion,APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28
T1136.002,Domain Account,Persistence,Soft Cell
T1136.001,Local Account,Persistence,APT39|APT41|Dragonfly 2.0|Leafminer|APT3
T1547.011,Plist Modification,Persistence|Privilege Escalation,no
T1547.010,Port Monitors,Persistence|Privilege Escalation,no
T1547.009,Shortcut Modification,Persistence|Privilege Escalation,APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Lazarus Group|Leviathan
T1547.009,Shortcut Modification,Persistence|Privilege Escalation,APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Leviathan|Lazarus Group
T1547.008,LSASS Driver,Persistence|Privilege Escalation,no
T1547.007,Re-opened Applications,Persistence|Privilege Escalation,no
T1547.006,Kernel Modules and Extensions,Persistence|Privilege Escalation,no
T1547.005,Security Support Provider,Persistence|Privilege Escalation,Lazarus Group
T1547.004,Winlogon Helper DLL,Persistence|Privilege Escalation,Wizard Spider|Tropic Trooper|Turla
T1547.005,Security Support Provider,Persistence|Privilege Escalation,no
T1547.004,Winlogon Helper DLL,Persistence|Privilege Escalation,Tropic Trooper|Turla
T1547.003,Time Providers,Persistence|Privilege Escalation,no
T1546.014,Emond,Privilege Escalation|Persistence,no
T1546.013,PowerShell Profile,Privilege Escalation|Persistence,Turla
@@ -359,38 +236,38 @@ T1546.012,Image File Execution Options Injection,Privilege Escalation|Persistenc
T1218.008,Odbcconf,Defense Evasion,Cobalt Group
T1546.011,Application Shimming,Privilege Escalation|Persistence,FIN7
T1547.002,Authentication Package,Persistence|Privilege Escalation,no
T1546.010,AppInit DLLs,Privilege Escalation|Persistence,APT39
T1546.010,AppInit DLLs,Privilege Escalation|Persistence,no
T1546.009,AppCert DLLs,Privilege Escalation|Persistence,Honeybee
T1218.007,Msiexec,Defense Evasion,ZIRCONIUM|Molerats|Machete|TA505|Rancor
T1546.008,Accessibility Features,Privilege Escalation|Persistence,Fox Kitten|APT41|APT3|APT29|Deep Panda|Axiom
T1218.007,Msiexec,Defense Evasion,TA505|Rancor
T1546.008,Accessibility Features,Privilege Escalation|Persistence,APT41|APT3|APT29|Deep Panda|Axiom
T1546.007,Netsh Helper DLL,Privilege Escalation|Persistence,no
T1546.006,LC_LOAD_DYLIB Addition,Privilege Escalation|Persistence,no
T1546.005,Trap,Privilege Escalation|Persistence,no
T1546.004,Unix Shell Configuration Modification,Privilege Escalation|Persistence,no
T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,Mustang Panda|UNC2452|APT33|Blue Mockingbird|Turla|Leviathan|APT29
T1546.004,.bash_profile and .bashrc,Privilege Escalation|Persistence,no
T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,APT33|Blue Mockingbird|Turla|Leviathan|APT29
T1546.002,Screensaver,Privilege Escalation|Persistence,no
T1546.001,Change Default File Association,Privilege Escalation|Persistence,Kimsuky
T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Turla|APT19|Honeybee|Dark Caracal|Threat Group-3390|Cobalt Group|Ke3chang|Gorgon Group|Dragonfly 2.0|APT37|MuddyWater|Leviathan|APT3|BRONZE BUTLER|Magic Hound|FIN7|FIN10|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel
T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Machete|Kimsuky|APT33|APT39|APT32|APT18|Turla|Dark Caracal|Cobalt Group|Honeybee|Threat Group-3390|Dragonfly 2.0|Gorgon Group|Ke3chang|APT19|Leviathan|MuddyWater|APT37|BRONZE BUTLER|Magic Hound|APT3|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel
T1218.002,Control Panel,Defense Evasion,no
T1218.010,Regsvr32,Defense Evasion,TA551|Blue Mockingbird|Inception|WIRTE|APT19|Cobalt Group|Leviathan|APT32|Deep Panda
T1218.010,Regsvr32,Defense Evasion,Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda
T1218.009,Regsvcs/Regasm,Defense Evasion,no
T1218.005,Mshta,Defense Evasion,Mustang Panda|TA551|Sidewinder|Lazarus Group|Inception|Kimsuky|APT32|MuddyWater|FIN7
T1218.004,InstallUtil,Defense Evasion,Mustang Panda|menuPass
T1218.005,Mshta,Defense Evasion,Inception|Kimsuky|APT32|MuddyWater|FIN7
T1218.004,InstallUtil,Defense Evasion,no
T1218.001,Compiled HTML File,Defense Evasion,APT41|Silence|Lazarus Group|Dark Caracal|OilRig
T1218.003,CMSTP,Defense Evasion,Cobalt Group|MuddyWater
T1218.011,Rundll32,Defense Evasion,HAFNIUM|TA551|UNC2452|APT41|Gamaredon Group|APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28
T1218.011,Rundll32,Defense Evasion,APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28
T1547,Boot or Logon Autostart Execution,Persistence|Privilege Escalation,no
T1546,Event Triggered Execution,Privilege Escalation|Persistence,no
T1098.003,Add Office 365 Global Administrator Role,Persistence,no
T1098.002,Exchange Email Delegate Permissions,Persistence,APT29|UNC2452|Magic Hound
T1098.001,Additional Cloud Credentials,Persistence,APT29|UNC2452
T1098.002,Exchange Email Delegate Permissions,Persistence,Magic Hound
T1098.001,Additional Azure Service Principal Credentials,Persistence,no
T1543.004,Launch Daemon,Persistence|Privilege Escalation,no
T1543.003,Windows Service,Persistence|Privilege Escalation,PROMETHIUM|Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|FIN7|APT19|Honeybee|Threat Group-3390|APT3|Lazarus Group|Carbanak
T1543.003,Windows Service,Persistence|Privilege Escalation,Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|Honeybee|FIN7|Threat Group-3390|APT19|APT3|Lazarus Group|Carbanak
T1543.002,Systemd Service,Persistence|Privilege Escalation,Rocke
T1543.001,Launch Agent,Persistence|Privilege Escalation,no
T1037.005,Startup Items,Persistence|Privilege Escalation,no
T1037.004,RC Scripts,Persistence|Privilege Escalation,no
T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Threat Group-3390|Gorgon Group|menuPass|Patchwork
T1037.004,Rc.common,Persistence|Privilege Escalation,no
T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Threat Group-3390|menuPass|Gorgon Group|Patchwork
T1055.013,Process Doppelgänging,Defense Evasion|Privilege Escalation,Leafminer
T1055.011,Extra Window Memory Injection,Defense Evasion|Privilege Escalation,no
T1055.014,VDSO Hijacking,Defense Evasion|Privilege Escalation,no
@@ -400,7 +277,7 @@ T1055.005,Thread Local Storage,Defense Evasion|Privilege Escalation,no
T1055.004,Asynchronous Procedure Call,Defense Evasion|Privilege Escalation,no
T1055.003,Thread Execution Hijacking,Defense Evasion|Privilege Escalation,no
T1055.002,Portable Executable Injection,Defense Evasion|Privilege Escalation,Rocke|Gorgon Group
T1055.001,Dynamic-link Library Injection,Defense Evasion|Privilege Escalation,Wizard Spider|TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda
T1055.001,Dynamic-link Library Injection,Defense Evasion|Privilege Escalation,TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda
T1037.003,Network Logon Script,Persistence|Privilege Escalation,no
T1543,Create or Modify System Process,Persistence|Privilege Escalation,no
T1037.002,Logon Script (Mac),Persistence|Privilege Escalation,no
@@ -408,13 +285,13 @@ T1037.001,Logon Script (Windows),Persistence|Privilege Escalation,Cobalt Group|A
T1542.003,Bootkit,Persistence|Defense Evasion,APT41|Lazarus Group|APT28
T1542.002,Component Firmware,Persistence|Defense Evasion,Equation
T1542.001,System Firmware,Persistence|Defense Evasion,no
T1505.003,Web Shell,Persistence,Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda
T1505.003,Web Shell,Persistence,Tropic Trooper|Soft Cell|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda
T1505.002,Transport Agent,Persistence,no
T1505.001,SQL Stored Procedures,Persistence,no
T1053.003,Cron,Execution|Persistence|Privilege Escalation,Rocke
T1053.004,Launchd,Execution|Persistence|Privilege Escalation,no
T1053.001,At (Linux),Execution|Persistence|Privilege Escalation,no
T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,Mustang Panda|Higaisa|UNC2452|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|Cobalt Group|Rancor|Dragonfly 2.0|OilRig|Patchwork|FIN8|menuPass|FIN10|FIN7|APT32|Stealth Falcon|FIN6|APT3|APT29
T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|Machete|Soft Cell|Silence|TEMP.Veles|APT33|APT39|Dragonfly 2.0|Patchwork|OilRig|Rancor|Cobalt Group|FIN8|menuPass|FIN10|APT32|FIN7|Stealth Falcon|FIN6|APT3|APT29
T1053.002,At (Windows),Execution|Persistence|Privilege Escalation,BRONZE BUTLER|Threat Group-3390|APT18
T1542,Pre-OS Boot,Defense Evasion|Persistence,no
T1137.001,Office Template Macros,Persistence,MuddyWater
@@ -424,141 +301,140 @@ T1137.005,Outlook Rules,Persistence,no
T1137.006,Add-ins,Persistence,Naikon
T1137.002,Office Test,Persistence,APT28
T1531,Account Access Removal,Impact,no
T1539,Steal Web Session Cookie,Credential Access,Evilnum
T1539,Steal Web Session Cookie,Credential Access,no
T1529,System Shutdown/Reboot,Impact,Lazarus Group|APT38|APT37
T1518,Software Discovery,Discovery,Mustang Panda|Windshift|MuddyWater|Windigo|Sidewinder|Operation Wocao|BRONZE BUTLER|Tropic Trooper|Inception
T1547.013,XDG Autostart Entries,Persistence|Privilege Escalation,no
T1518,Software Discovery,Discovery,BRONZE BUTLER|Tropic Trooper|Inception
T1534,Internal Spearphishing,Lateral Movement,Gamaredon Group
T1528,Steal Application Access Token,Credential Access,APT28
T1535,Unused/Unsupported Cloud Regions,Defense Evasion,no
T1525,Implant Internal Image,Persistence,no
T1525,Implant Container Image,Persistence,no
T1538,Cloud Service Dashboard,Discovery,no
T1530,Data from Cloud Storage Object,Collection,Fox Kitten
T1530,Data from Cloud Storage Object,Collection,no
T1578,Modify Cloud Compute Infrastructure,Defense Evasion,no
T1537,Transfer Data to Cloud Account,Exfiltration,no
T1526,Cloud Service Discovery,Discovery,no
T1505,Server Software Component,Persistence,no
T1499,Endpoint Denial of Service,Impact,Sandworm Team
T1497,Virtualization/Sandbox Evasion,Defense Evasion|Discovery,Darkhotel
T1498,Network Denial of Service,Impact,APT28
T1499,Endpoint Denial of Service,Impact,no
T1497,Virtualization/Sandbox Evasion,Defense Evasion|Discovery,no
T1498,Network Denial of Service,Impact,no
T1496,Resource Hijacking,Impact,Blue Mockingbird|Rocke|APT41|Lazarus Group
T1495,Firmware Corruption,Impact,no
T1491,Defacement,Impact,no
T1490,Inhibit System Recovery,Impact,no
T1489,Service Stop,Impact,Wizard Spider|Lazarus Group
T1486,Data Encrypted for Impact,Impact,Indrik Spider|APT41|TA505|APT38
T1489,Service Stop,Impact,Lazarus Group
T1486,Data Encrypted for Impact,Impact,APT41|TA505|APT38
T1485,Data Destruction,Impact,Sandworm Team|Lazarus Group|APT38
T1484,Domain Policy Modification,Defense Evasion|Privilege Escalation,no
T1482,Domain Trust Discovery,Discovery,APT29|Chimera|UNC2452
T1484,Group Policy Modification,Defense Evasion|Privilege Escalation,no
T1482,Domain Trust Discovery,Discovery,Wizard Spider
T1480,Execution Guardrails,Defense Evasion,no
T1222,File and Directory Permissions Modification,Defense Evasion,no
T1220,XSL Script Processing,Defense Evasion,Higaisa|Cobalt Group
T1221,Template Injection,Defense Evasion,Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus
T1189,Drive-by Compromise,Initial Access,Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|Leafminer|Lazarus Group|BRONZE BUTLER|APT19|APT32|Threat Group-3390|Dark Caracal|Elderwood|APT37|Patchwork|PLATINUM
T1190,Exploit Public-Facing Application,Initial Access,Volatile Cedar|UNC2452|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom
T1210,Exploitation of Remote Services,Lateral Movement,Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28
T1217,Browser Bookmark Discovery,Discovery,Chimera|Fox Kitten
T1213,Data from Information Repositories,Collection,Fox Kitten|FIN6|Turla
T1197,BITS Jobs,Defense Evasion|Persistence,APT39|Patchwork|APT41|Leviathan
T1219,Remote Access Software,Command And Control,Mustang Panda|MuddyWater|Evilnum|GOLD SOUTHFIELD|Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak
T1195,Supply Chain Compromise,Initial Access,no
T1204,User Execution,Execution,no
T1220,XSL Script Processing,Defense Evasion,Cobalt Group
T1197,BITS Jobs,Defense Evasion|Persistence,Patchwork|APT41|Leviathan
T1217,Browser Bookmark Discovery,Discovery,no
T1213,Data from Information Repositories,Collection,Turla
T1189,Drive-by Compromise,Initial Access,Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|BRONZE BUTLER|Leafminer|Dark Caracal|APT19|APT32|Lazarus Group|Threat Group-3390|Elderwood|APT37|Patchwork|PLATINUM
T1203,Exploitation for Client Execution,Execution,Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|Lazarus Group|BRONZE BUTLER|Cobalt Group|APT37|Patchwork|Leviathan|Elderwood|TA459|APT29
T1212,Exploitation for Credential Access,Credential Access,no
T1211,Exploitation for Defense Evasion,Defense Evasion,APT28
T1200,Hardware Additions,Initial Access,DarkVishnya
T1190,Exploit Public-Facing Application,Initial Access,Blue Mockingbird|Rocke|APT39|BlackTech|APT41|Soft Cell|Night Dragon|Axiom
T1210,Exploitation of Remote Services,Lateral Movement,Threat Group-3390|APT28
T1202,Indirect Command Execution,Defense Evasion,no
T1201,Password Policy Discovery,Discovery,Chimera|Turla|OilRig
T1200,Hardware Additions,Initial Access,DarkVishnya
T1201,Password Policy Discovery,Discovery,Turla|OilRig
T1219,Remote Access Software,Command And Control,Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak
T1207,Rogue Domain Controller,Defense Evasion,no
T1203,Exploitation for Client Execution,Execution,Mustang Panda|Darkhotel|Higaisa|HAFNIUM|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Lazarus Group|Cobalt Group|APT37|Patchwork|APT29|TA459|Leviathan|Elderwood
T1216,Signed Script Proxy Execution,Defense Evasion,no
T1199,Trusted Relationship,Initial Access,Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass
T1199,Trusted Relationship,Initial Access,APT28|menuPass
T1218,Signed Binary Proxy Execution,Defense Evasion,no
T1204,User Execution,Execution,no
T1216,Signed Script Proxy Execution,Defense Evasion,no
T1195,Supply Chain Compromise,Initial Access,Elderwood
T1205,Traffic Signaling,Defense Evasion|Persistence|Command And Control,no
T1176,Browser Extensions,Persistence,Kimsuky|Stolen Pencil
T1175,Component Object Model and Distributed COM,Lateral Movement|Execution,no
T1187,Forced Authentication,Credential Access,DarkHydrus|Dragonfly 2.0
T1185,Man in the Browser,Collection,no
T1149,LC_MAIN Hijacking,Defense Evasion,no
T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,FIN6|Blue Mockingbird
T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,Blue Mockingbird
T1136,Create Account,Persistence,no
T1140,Deobfuscate/Decode Files or Information,Defense Evasion,Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|menuPass|Honeybee|Threat Group-3390|APT19|Gorgon Group|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER
T1149,LC_MAIN Hijacking,Defense Evasion,no
T1135,Network Share Discovery,Discovery,APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug
T1137,Office Application Startup,Persistence,Gamaredon Group|APT32
T1140,Deobfuscate/Decode Files or Information,Defense Evasion,APT39|APT29|ZIRCONIUM|Higaisa|UNC2452|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|Gorgon Group|menuPass|Honeybee|Threat Group-3390|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER
T1135,Network Share Discovery,Discovery,Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug
T1153,Source,Execution,no
T1133,External Remote Services,Persistence|Initial Access,APT29|UNC2452|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18
T1133,External Remote Services,Persistence|Initial Access,Sandworm Team|APT41|Soft Cell|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18
T1132,Data Encoding,Command And Control,no
T1129,Shared Modules,Execution,no
T1127,Trusted Developer Utilities Proxy Execution,Defense Evasion,no
T1125,Video Capture,Collection,Silence|FIN7
T1124,System Time Discovery,Discovery,Darkhotel|ZIRCONIUM|Higaisa|Sidewinder|Chimera|Operation Wocao|The White Company|Lazarus Group|BRONZE BUTLER|Turla
T1124,System Time Discovery,Discovery,The White Company|Lazarus Group|BRONZE BUTLER|Turla
T1123,Audio Capture,Collection,APT37
T1120,Peripheral Device Discovery,Discovery,Operation Wocao|Turla|APT37|Gamaredon Group|Equation|APT28
T1119,Automated Collection,Collection,Mustang Panda|Sidewinder|Chimera|menuPass|Operation Wocao|Gamaredon Group|Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6
T1115,Clipboard Data,Collection,Operation Wocao|APT39|APT38
T1114,Email Collection,Collection,Silent Librarian
T1113,Screen Capture,Collection,GOLD SOUTHFIELD|Gamaredon Group|APT39|Silence|MuddyWater|OilRig|Dragonfly 2.0|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28
T1112,Modify Registry,Defense Evasion,Operation Wocao|Kimsuky|Lazarus Group|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Patchwork|Gorgon Group|Honeybee|FIN8
T1111,Two-Factor Authentication Interception,Credential Access,Chimera|Operation Wocao
T1110,Brute Force,Credential Access,APT28|Fox Kitten|DarkVishnya|APT39|OilRig|FIN5|Turla
T1120,Peripheral Device Discovery,Discovery,Turla|APT37|Gamaredon Group|Equation|APT28
T1119,Automated Collection,Collection,Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6
T1115,Clipboard Data,Collection,APT39|APT38
T1114,Email Collection,Collection,no
T1113,Screen Capture,Collection,Gamaredon Group|APT39|Silence|MuddyWater|Dragonfly 2.0|OilRig|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28
T1112,Modify Registry,Defense Evasion,Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Honeybee|Patchwork|Gorgon Group|FIN8
T1111,Two-Factor Authentication Interception,Credential Access,no
T1110,Brute Force,Credential Access,DarkVishnya|APT39|OilRig|FIN5|Turla
T1108,Redundant Access,Defense Evasion|Persistence,no
T1106,Native API,Execution,Higaisa|menuPass|Operation Wocao|Chimera|Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|APT37|Gorgon Group
T1105,Ingress Tool Transfer,Command And Control,HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|UNC2452|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Gorgon Group|Turla|OilRig|Dragonfly 2.0|APT37|Leviathan|FIN8|PLATINUM|Elderwood|APT3|Magic Hound|APT32|BRONZE BUTLER|FIN7|menuPass|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28
T1106,Native API,Execution,Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|Gorgon Group|APT37
T1105,Ingress Tool Transfer,Command And Control,Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|Soft Cell|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Turla|Gorgon Group|OilRig|Dragonfly 2.0|APT37|FIN8|PLATINUM|Leviathan|Elderwood|Magic Hound|APT3|APT32|BRONZE BUTLER|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28
T1104,Multi-Stage Channels,Command And Control,APT41|MuddyWater|APT3
T1102,Web Service,Command And Control,Fox Kitten|Turla|APT32|Gamaredon Group|Rocke|Inception|FIN6
T1102,Web Service,Command And Control,Gamaredon Group|Rocke|Inception|FIN6
T1098,Account Manipulation,Persistence,APT3|Dragonfly 2.0|Lazarus Group
T1095,Non-Application Layer Protocol,Command And Control,HAFNIUM|Operation Wocao|FIN6|APT29|PLATINUM|APT3
T1095,Non-Application Layer Protocol,Command And Control,APT29|PLATINUM|APT3
T1092,Communication Through Removable Media,Command And Control,APT28
T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Mustang Panda|Tropic Trooper|Darkhotel|APT28
T1090,Proxy,Command And Control,Windigo|Fox Kitten|Operation Wocao|Sandworm Team|Blue Mockingbird|APT41|Turla
T1087,Account Discovery,Discovery,APT29|UNC2452
T1083,File and Directory Discovery,Discovery,APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|UNC2452|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Dragonfly 2.0|Leafminer|Honeybee|Dark Caracal|Magic Hound|APT3|BRONZE BUTLER|Sowbug|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang
T1082,System Information Discovery,Discovery,APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|UNC2452|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT37|APT19|Honeybee|APT32|Magic Hound|Sowbug|OilRig|APT3|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang
T1080,Taint Shared Content,Lateral Movement,Gamaredon Group|BRONZE BUTLER|Darkhotel
T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT29|Silent Librarian|UNC2452|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|APT33|Leviathan|OilRig|FIN5|menuPass|FIN10|APT28|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak
T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Tropic Trooper|Darkhotel|APT28
T1090,Proxy,Command And Control,Sandworm Team|Blue Mockingbird|Wizard Spider|APT41|Turla
T1087,Account Discovery,Discovery,no
T1083,File and Directory Discovery,Discovery,Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dark Caracal|Dragonfly 2.0|Magic Hound|Sowbug|BRONZE BUTLER|APT3|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang
T1082,System Information Discovery,Discovery,Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|Honeybee|APT19|APT37|APT32|Magic Hound|OilRig|APT3|Sowbug|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang
T1080,Taint Shared Content,Lateral Movement,BRONZE BUTLER|Darkhotel
T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Sandworm Team|Wizard Spider|Silence|APT41|Soft Cell|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|Leviathan|APT33|OilRig|FIN5|menuPass|APT28|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak
T1074,Data Staged,Collection,Wizard Spider
T1072,Software Deployment Tools,Execution|Lateral Movement,Silence|APT32|Threat Group-1314
T1071,Application Layer Protocol,Command And Control,Rocke|Magic Hound|Dragonfly 2.0
T1070,Indicator Removal on Host,Defense Evasion,APT29|UNC2452
T1069,Permission Groups Discovery,Discovery,APT29|UNC2452|TA505|APT3
T1068,Exploitation for Privilege Escalation,Privilege Escalation,ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28
T1070,Indicator Removal on Host,Defense Evasion,no
T1069,Permission Groups Discovery,Discovery,TA505|APT3
T1068,Exploitation for Privilege Escalation,Privilege Escalation,Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28
T1064,Scripting,Defense Evasion|Execution,no
T1062,Hypervisor,Persistence,no
T1061,Graphical User Interface,Execution,no
T1059,Command and Scripting Interpreter,Execution,Windigo|Fox Kitten|APT32|Whitefly|APT39|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang
T1057,Process Discovery,Discovery,APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|UNC2452|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang
T1056,Input Capture,Collection|Credential Access,APT39
T1055,Process Injection,Defense Evasion|Privilege Escalation,Operation Wocao|APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM
T1059,Command and Scripting Interpreter,Execution,APT32|Molerats|Whitefly|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang
T1057,Process Discovery,Discovery,Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang
T1056,Input Capture,Collection|Credential Access,no
T1055,Process Injection,Defense Evasion|Privilege Escalation,APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM
T1053,Scheduled Task/Job,Execution|Persistence|Privilege Escalation,no
T1052,Exfiltration Over Physical Medium,Exfiltration,no
T1051,Shared Webroot,Lateral Movement,no
T1049,System Network Connections Discovery,Discovery,Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|APT3|OilRig|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang
T1049,System Network Connections Discovery,Discovery,Tropic Trooper|APT41|APT38|Soft Cell|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang
T1048,Exfiltration Over Alternative Protocol,Exfiltration,no
T1047,Windows Management Instrumentation,Execution,Mustang Panda|Windshift|UNC2452|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|OilRig|Threat Group-3390|Leviathan|FIN8|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda
T1046,Network Service Scanning,Discovery,Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|OilRig|Leafminer|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390
T1043,Commonly Used Port,Command And Control,OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|FIN7|Dragonfly 2.0|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390
T1041,Exfiltration Over C2 Channel,Exfiltration,ZIRCONIUM|Higaisa|Chimera|APT39|Operation Wocao|Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|GALLIUM|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang
T1040,Network Sniffing,Credential Access|Discovery,Kimsuky|Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28
T1039,Data from Network Shared Drive,Collection,Chimera|Fox Kitten|Gamaredon Group|Sowbug|BRONZE BUTLER|menuPass
T1047,Windows Management Instrumentation,Execution,Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|Soft Cell|APT32|MuddyWater|OilRig|Threat Group-3390|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda
T1046,Network Service Scanning,Discovery,Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|Leafminer|OilRig|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390
T1043,Commonly Used Port,Command And Control,Machete|OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|Dragonfly 2.0|FIN7|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390
T1041,Exfiltration Over C2 Channel,Exfiltration,Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|Soft Cell|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang
T1040,Network Sniffing,Credential Access|Discovery,Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28
T1039,Data from Network Shared Drive,Collection,Sowbug|BRONZE BUTLER|menuPass
T1037,Boot or Logon Initialization Scripts,Persistence|Privilege Escalation,Rocke
T1036,Masquerading,Defense Evasion,APT29|Mustang Panda|ZIRCONIUM|TA551|UNC2452|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM|Dragonfly 2.0
T1036,Masquerading,Defense Evasion,Windshift|APT32|BRONZE BUTLER|menuPass|Dragonfly 2.0
T1034,Path Interception,Persistence|Privilege Escalation,no
T1033,System Owner/User Discovery,Discovery,Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3
T1033,System Owner/User Discovery,Discovery,Frankenstein|APT41|Soft Cell|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3
T1030,Data Transfer Size Limits,Exfiltration,Threat Group-3390
T1029,Scheduled Transfer,Exfiltration,Higaisa
T1027,Obfuscated Files or Information,Defense Evasion,APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Patchwork|APT37|Honeybee|menuPass|Leafminer|Cobalt Group|Threat Group-3390|Dark Caracal|APT19|FIN8|BlackOasis|MuddyWater|Elderwood|Leviathan|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28
T1029,Scheduled Transfer,Exfiltration,no
T1027,Obfuscated Files or Information,Defense Evasion,Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|Machete|Soft Cell|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Cobalt Group|Patchwork|Leafminer|APT37|Threat Group-3390|Honeybee|Dark Caracal|menuPass|APT19|BlackOasis|FIN8|Leviathan|Elderwood|MuddyWater|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28
T1026,Multiband Communication,Command And Control,Lazarus Group
T1025,Data from Removable Media,Collection,Turla|Gamaredon Group|APT28
T1025,Data from Removable Media,Collection,Machete|Turla|Gamaredon Group|APT28
T1021,Remote Services,Lateral Movement,no
T1020,Automated Exfiltration,Exfiltration,Sidewinder|Gamaredon Group|Tropic Trooper|Frankenstein|Honeybee
T1018,Remote System Discovery,Discovery,APT29|UNC2452|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Dragonfly 2.0|Deep Panda|Threat Group-3390|Leafminer|Ke3chang|FIN8|FIN5|APT3|BRONZE BUTLER|menuPass|FIN6|Turla
T1016,System Network Configuration Discovery,Discovery,ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|OilRig|Magic Hound|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang
T1020,Automated Exfiltration,Exfiltration,Tropic Trooper|Frankenstein|Honeybee
T1018,Remote System Discovery,Discovery,Sandworm Team|Rocke|Wizard Spider|Silence|Soft Cell|APT39|APT32|Deep Panda|Threat Group-3390|Dragonfly 2.0|Leafminer|Ke3chang|FIN8|APT3|FIN5|BRONZE BUTLER|menuPass|FIN6|Turla
T1016,System Network Configuration Discovery,Discovery,Sandworm Team|Tropic Trooper|Frankenstein|APT41|Soft Cell|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang
T1014,Rootkit,Defense Evasion,Rocke|APT41|APT28|Winnti Group
T1012,Query Registry,Discovery,ZIRCONIUM|Chimera|Fox Kitten|APT39|Operation Wocao|APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla
T1012,Query Registry,Discovery,APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla
T1011,Exfiltration Over Other Network Medium,Exfiltration,no
T1010,Application Window Discovery,Discovery,Lazarus Group
T1008,Fallback Channels,Command And Control,Carbanak|APT41|OilRig|Lazarus Group
T1007,System Service Discovery,Discovery,Chimera|Operation Wocao|BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang
T1008,Fallback Channels,Command And Control,APT41|OilRig|Lazarus Group
T1007,System Service Discovery,Discovery,BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang
T1006,Direct Volume Access,Defense Evasion,no
T1005,Data from Local System,Collection,APT29|Windigo|UNC2452|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Dragonfly 2.0|Dark Caracal|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang
T1005,Data from Local System,Collection,Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|Soft Cell|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang
T1003,OS Credential Dumping,Credential Access,APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom
T1001,Data Obfuscation,Command And Control,Operation Wocao|Axiom
T1001,Data Obfuscation,Command And Control,Axiom
1 mitre_id technique tactics groups
2 T1553.006 T1205.001 Code Signing Policy Modification Port Knocking Defense Evasion Defense Evasion|Persistence|Command And Control Turla|APT39 no
T1614 System Location Discovery Discovery no
T1613 Container and Resource Discovery Discovery no
T1552.007 Container API Credential Access no
T1612 Build Image on Host Defense Evasion no
T1611 Escape to Host Privilege Escalation no
T1204.003 Malicious Image Execution no
T1053.007 Container Orchestration Job Execution|Persistence|Privilege Escalation no
T1610 Deploy Container Defense Evasion|Execution no
T1609 Container Administration Command Execution no
T1608.005 Link Target Resource Development Silent Librarian
T1608.004 Drive-by Target Resource Development APT32|Threat Group-3390
T1608.003 Install Digital Certificate Resource Development no
T1608.002 Upload Tool Resource Development Threat Group-3390
T1608.001 Upload Malware Resource Development APT32
T1608 Stage Capabilities Resource Development no
T1016.001 Internet Connection Discovery Discovery APT29|UNC2452|Turla
T1553.005 Mark-of-the-Web Bypass Defense Evasion TA505
T1555.005 Password Managers Credential Access Fox Kitten|Operation Wocao
T1484.002 Domain Trust Modification Defense Evasion|Privilege Escalation APT29|UNC2452
T1484.001 Group Policy Modification Defense Evasion|Privilege Escalation Indrik Spider
T1547.014 Active Setup Persistence|Privilege Escalation no
T1606.002 SAML Tokens Credential Access APT29|UNC2452
T1606.001 Web Cookies Credential Access APT29|UNC2452
T1606 Forge Web Credentials Credential Access no
T1555.004 Windows Credential Manager Credential Access Stealth Falcon|OilRig|Turla
T1059.008 Network Device CLI Execution no
T1602.002 Network Device Configuration Dump Collection no
T1542.005 TFTP Boot Defense Evasion|Persistence no
T1542.004 ROMMONkit Defense Evasion|Persistence no
T1602.001 SNMP (MIB Dump) Collection no
T1602 Data from Configuration Repository Collection no
T1601.002 Downgrade System Image Defense Evasion no
T1601.001 Patch System Image Defense Evasion no
T1601 Modify System Image Defense Evasion no
T1600.002 Disable Crypto Hardware Defense Evasion no
T1600.001 Reduce Key Space Defense Evasion no
T1600 Weaken Encryption Defense Evasion no
T1556.004 Network Device Authentication Credential Access|Defense Evasion|Persistence no
T1599.001 Network Address Translation Traversal Defense Evasion no
T1599 Network Boundary Bridging Defense Evasion no
T1020.001 Traffic Duplication Exfiltration no
T1557.002 ARP Cache Poisoning Credential Access|Collection Cleaver
T1588.006 Vulnerabilities Resource Development Sandworm Team
T1053.006 Systemd Timers Execution|Persistence|Privilege Escalation no
T1562.008 Disable Cloud Logs Defense Evasion no
T1547.012 Print Processors Persistence|Privilege Escalation no
T1598.003 Spearphishing Link Reconnaissance Silent Librarian|Sidewinder|Sandworm Team|APT32|Kimsuky
T1598.002 Spearphishing Attachment Reconnaissance Sidewinder
T1598.001 Spearphishing Service Reconnaissance no
T1598 Phishing for Information Reconnaissance ZIRCONIUM|APT28
T1597.002 Purchase Technical Data Reconnaissance no
T1597.001 Threat Intel Vendors Reconnaissance no
T1597 Search Closed Sources Reconnaissance no
T1596.005 Scan Databases Reconnaissance no
T1596.004 CDNs Reconnaissance no
T1596.003 Digital Certificates Reconnaissance no
T1596.001 DNS/Passive DNS Reconnaissance no
T1596.002 WHOIS Reconnaissance no
T1596 Search Open Technical Databases Reconnaissance no
T1595.002 Vulnerability Scanning Reconnaissance Volatile Cedar|APT28|Sandworm Team
T1595.001 Scanning IP Blocks Reconnaissance no
T1595 Active Scanning Reconnaissance no
T1594 Search Victim-Owned Websites Reconnaissance Silent Librarian|Sandworm Team
T1593.002 Search Engines Reconnaissance no
T1593.001 Social Media Reconnaissance no
T1593 Search Open Websites/Domains Reconnaissance Sandworm Team
T1592.004 Client Configurations Reconnaissance HAFNIUM
T1592.003 Firmware Reconnaissance no
T1592.002 Software Reconnaissance Sandworm Team
T1592.001 Hardware Reconnaissance no
T1592 Gather Victim Host Information Reconnaissance no
T1591.004 Identify Roles Reconnaissance no
T1591.003 Identify Business Tempo Reconnaissance no
T1591.001 Determine Physical Locations Reconnaissance no
T1591.002 Business Relationships Reconnaissance Sandworm Team
T1591 Gather Victim Org Information Reconnaissance no
T1590.006 Network Security Appliances Reconnaissance no
T1590.005 IP Addresses Reconnaissance HAFNIUM
T1590.004 Network Topology Reconnaissance no
T1590.003 Network Trust Dependencies Reconnaissance no
T1590.002 DNS Reconnaissance no
T1590.001 Domain Properties Reconnaissance Sandworm Team
T1590 Gather Victim Network Information Reconnaissance HAFNIUM
T1589.003 Employee Names Reconnaissance Silent Librarian|Sandworm Team
T1589.002 Email Addresses Reconnaissance TA551|MuddyWater|HAFNIUM|APT32|Silent Librarian|Sandworm Team
T1589.001 Credentials Reconnaissance APT28|Magic Hound|Chimera
T1589 Gather Victim Identity Information Reconnaissance APT32
T1588.005 Exploits Resource Development no
T1588.004 Digital Certificates Resource Development Lazarus Group|Silent Librarian
T1588.003 Code Signing Certificates Resource Development Wizard Spider
T1588.002 Tool Resource Development MuddyWater|Silent Librarian|GALLIUM|Sandworm Team
T1588.001 Malware Resource Development Turla|APT1
T1588 Obtain Capabilities Resource Development no
T1587.004 Exploits Resource Development no
T1587.003 Digital Certificates Resource Development APT29|PROMETHIUM
T1587.002 Code Signing Certificates Resource Development PROMETHIUM|Patchwork
T1587.001 Malware Resource Development APT29|Lazarus Group|UNC2452|Sandworm Team|Turla|FIN7|Night Dragon|Cleaver
T1587 Develop Capabilities Resource Development Kimsuky
T1586.002 Email Accounts Resource Development Magic Hound|Kimsuky
T1586.001 Social Media Accounts Resource Development no
T1586 Compromise Accounts Resource Development no
T1585.002 Email Accounts Resource Development Magic Hound|Silent Librarian|Sandworm Team|APT1
T1585.001 Social Media Accounts Resource Development Fox Kitten|Sandworm Team|APT32|Cleaver
T1585 Establish Accounts Resource Development Fox Kitten|APT17
T1584.006 Web Services Resource Development Turla
T1584.005 Botnet Resource Development no
T1584.004 Server Resource Development Indrik Spider|Turla|APT16
T1584.003 Virtual Private Server Resource Development Turla
T1584.002 DNS Server Resource Development no
T1584.001 Domains Resource Development APT29|UNC2452|APT1
T1583.006 Web Services Resource Development ZIRCONIUM|MuddyWater|HAFNIUM|Lazarus Group|Turla|APT32|APT17|APT29
T1583.005 Botnet Resource Development no
T1583.004 Server Resource Development GALLIUM|Sandworm Team
T1583.003 Virtual Private Server Resource Development HAFNIUM|TEMP.Veles
T1583.002 DNS Server Resource Development no
T1584 Compromise Infrastructure Resource Development no
T1583.001 Domains Resource Development APT29|Mustang Panda|ZIRCONIUM|UNC2452|Lazarus Group|Silent Librarian|menuPass|Sandworm Team|APT32|Kimsuky|APT1|APT28
T1583 Acquire Infrastructure Resource Development no
T1564.007 VBA Stomping Defense Evasion no
T1558.004 AS-REP Roasting Credential Access no
T1580 Cloud Infrastructure Discovery Discovery no
T1218.012 Verclsid Defense Evasion no
T1205.001 Port Knocking Defense Evasion|Persistence|Command And Control PROMETHIUM
3 T1564.006 Run Virtual Instance Defense Evasion no
4 T1564.005 Hidden File System Defense Evasion Strider|Equation
5 T1556.003 Pluggable Authentication Modules Credential Access|Defense Evasion|Persistence Credential Access|Defense Evasion no
6 T1574.012 COR_PROFILER Persistence|Privilege Escalation|Defense Evasion Blue Mockingbird
7 T1562.007 Disable or Modify Cloud Firewall Defense Evasion no
8 T1098.004 SSH Authorized Keys Persistence no
9 T1480.001 Environmental Keying Defense Evasion APT41|Equation
10 T1059.007 JavaScript JavaScript/JScript Execution MuddyWater|Turla|Higaisa|Sidewinder|Evilnum|Kimsuky|FIN6|APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer
11 T1578.004 Revert Cloud Instance Defense Evasion no
12 T1578.003 Delete Cloud Instance Defense Evasion no
13 T1578.001 Create Snapshot Defense Evasion no
14 T1578.002 Create Cloud Instance Defense Evasion no
15 T1127.001 MSBuild Defense Evasion Frankenstein
16 T1027.005 Indicator Removal from Tools Defense Evasion Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda Soft Cell|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda
17 T1562.006 Indicator Blocking Defense Evasion no
18 T1573.002 Asymmetric Cryptography Command And Control Operation Wocao|Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6 Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6
19 T1573.001 Symmetric Cryptography Command And Control Mustang Panda|Darkhotel|ZIRCONIUM|Higaisa|Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group
20 T1573 Encrypted Channel Command And Control Tropic Trooper
21 T1027.004 Compile After Delivery Defense Evasion Gamaredon Group|Rocke|MuddyWater
22 T1574.004 Dylib Hijacking Persistence|Privilege Escalation|Defense Evasion no
23 T1546.015 Component Object Model Hijacking Privilege Escalation|Persistence APT28
24 T1071.004 DNS Command And Control Chimera|APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7 APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7
25 T1071.003 Mail Protocols Command And Control Turla|Kimsuky|APT32|SilverTerrier|APT28 APT32|SilverTerrier|APT28
26 T1071.002 File Transfer Protocols Command And Control Kimsuky|APT41|SilverTerrier|Honeybee APT41|SilverTerrier|Machete|Honeybee
27 T1071.001 Web Protocols Command And Control APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|UNC2452|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|APT19|Cobalt Group|Rancor|Orangeworm|Threat Group-3390|Ke3chang|Turla|APT37|Dark Caracal|Lazarus Group|BRONZE BUTLER|APT32|Magic Hound|OilRig|Gamaredon Group|Stealth Falcon Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|Machete|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Cobalt Group|APT19|Threat Group-3390|Rancor|Orangeworm|APT37|Ke3chang|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|APT32|OilRig|Magic Hound|Gamaredon Group|Stealth Falcon
28 T1572 Protocol Tunneling Command And Control Chimera|Fox Kitten|OilRig|Cobalt Group|FIN6 OilRig|Cobalt Group|FIN6
29 T1048.003 Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol Exfiltration Wizard Spider|FIN6|APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group
30 T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol Exfiltration APT29|UNC2452 no
31 T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol Exfiltration no
32 T1001.003 Protocol Impersonation Command And Control Higaisa|Lazarus Group Lazarus Group
33 T1001.002 Steganography Command And Control APT29|Axiom Axiom
34 T1001.001 Junk Data Command And Control APT28
35 T1132.002 Non-Standard Encoding Command And Control no
36 T1132.001 Standard Encoding Command And Control HAFNIUM|TA551|Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork
37 T1090.004 Domain Fronting Command And Control APT29
38 T1090.003 Multi-hop Proxy Command And Control APT28|Operation Wocao|Inception|FIN4|APT29 Inception|FIN4|APT29
39 T1090.002 External Proxy Command And Control APT39|Silence|GALLIUM|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28 APT39|Silence|Soft Cell|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28
40 T1090.001 Internal Proxy Command And Control APT29|Higaisa|UNC2452|Operation Wocao|APT39|Strider APT39|Strider
41 T1102.003 One-Way Communication Command And Control Leviathan
42 T1102.002 Bidirectional Communication Command And Control ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|FIN7|Turla|APT37|Magic Hound|Carbanak Sandworm Team|APT39|APT12|Turla|FIN7|APT37|Magic Hound|Carbanak
43 T1102.001 Dead Drop Resolver Command And Control Rocke|APT41|BRONZE BUTLER|RTM|Patchwork
44 T1571 Non-Standard Port Command And Control Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7
45 T1074.002 Remote Data Staging Collection APT29|Chimera|UNC2452|Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8 Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8
46 T1074.001 Local Data Staging Collection Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Honeybee|Patchwork|Dragonfly 2.0|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28 Machete|Soft Cell|TEMP.Veles|Patchwork|Dragonfly 2.0|Honeybee|Leviathan|APT3|FIN5|menuPass|FIN6|Lazarus Group|Threat Group-3390|APT28
47 T1078.004 Cloud Accounts Defense Evasion|Persistence|Privilege Escalation|Initial Access APT33
48 T1564.004 NTFS File Attributes Defense Evasion APT32
49 T1564.003 Hidden Window Defense Evasion Higaisa|Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound
50 T1078.003 Local Accounts Defense Evasion|Persistence|Privilege Escalation|Initial Access HAFNIUM|Turla|Operation Wocao|PROMETHIUM|Tropic Trooper|FIN10|Stolen Pencil|APT32 Tropic Trooper|FIN10|Stolen Pencil|APT32
51 T1078.002 Domain Accounts Defense Evasion|Persistence|Privilege Escalation|Initial Access Indrik Spider|Chimera|Operation Wocao|Sandworm Team|Wizard Spider|APT29|TA505|APT3|Threat Group-1314 TA505|APT3|Threat Group-1314
52 T1078.001 Default Accounts Defense Evasion|Persistence|Privilege Escalation|Initial Access no
53 T1564.002 Hidden Users Defense Evasion no
54 T1574.006 Dynamic Linker Hijacking LD_PRELOAD Persistence|Privilege Escalation|Defense Evasion APT41|Rocke Rocke
55 T1574.002 DLL Side-Loading Persistence|Privilege Escalation|Defense Evasion Mustang Panda|Higaisa|BlackTech|Sidewinder|Chimera|BRONZE BUTLER|Naikon|APT41|GALLIUM|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390 BRONZE BUTLER|Naikon|APT41|Soft Cell|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390
56 T1574.001 DLL Search Order Hijacking Persistence|Privilege Escalation|Defense Evasion Evilnum|APT41|Whitefly|RTM|Threat Group-3390|menuPass Whitefly|RTM|Threat Group-3390|menuPass
57 T1574.008 Path Interception by Search Order Hijacking Persistence|Privilege Escalation|Defense Evasion no
58 T1574.007 Path Interception by PATH Environment Variable Persistence|Privilege Escalation|Defense Evasion no
59 T1574.009 Path Interception by Unquoted Path Persistence|Privilege Escalation|Defense Evasion no
61 T1574.005 Executable Installer File Permissions Weakness Persistence|Privilege Escalation|Defense Evasion no
62 T1574.010 Services File Permissions Weakness Persistence|Privilege Escalation|Defense Evasion no
63 T1574 Hijack Execution Flow Persistence|Privilege Escalation|Defense Evasion no
64 T1069.001 Local Groups Discovery Chimera|Operation Wocao|Turla|OilRig|admin@338 Turla|OilRig|admin@338
65 T1570 Lateral Tool Transfer Lateral Movement Chimera|GALLIUM|Operation Wocao|APT32|Wizard Spider|Turla|FIN10 APT32|Wizard Spider|Turla|FIN10
66 T1568.003 DNS Calculation Command And Control APT12
67 T1204.002 Malicious File Execution Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|BRONZE BUTLER|FIN7|Dragonfly 2.0|APT19|Dark Caracal|Cobalt Group|Gorgon Group|Patchwork|MuddyWater|DarkHydrus|OilRig|APT32|Rancor|Lazarus Group|APT29|APT28|APT37|FIN8|Elderwood|menuPass|PLATINUM|TA459|Leviathan Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|APT19|Dragonfly 2.0|BRONZE BUTLER|Cobalt Group|DarkHydrus|Gorgon Group|Patchwork|OilRig|Dark Caracal|MuddyWater|Lazarus Group|FIN7|APT32|Rancor|APT37|FIN8|APT28|Elderwood|TA459|APT29|Leviathan|menuPass|PLATINUM
68 T1204.001 Malicious Link Execution APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla
69 T1195.003 Compromise Hardware Supply Chain Initial Access no
70 T1195.002 Compromise Software Supply Chain Initial Access APT29|UNC2452|Cobalt Group|GOLD SOUTHFIELD|Dragonfly|Sandworm Team|APT41 Sandworm Team|APT41
71 T1195.001 Compromise Software Dependencies and Development Tools Initial Access no
72 T1568.001 Fast Flux DNS Command And Control menuPass|TA505 TA505
73 T1052.001 Exfiltration over USB Exfiltration Mustang Panda|Tropic Trooper Tropic Trooper
74 T1569.002 Service Execution Execution Chimera|Operation Wocao|Wizard Spider|Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang
75 T1569.001 Launchctl Execution no
76 T1569 System Services Execution no
77 T1568.002 Domain Generation Algorithms Command And Control TA551|APT41 APT41
78 T1568 Dynamic Resolution Command And Control APT29|UNC2452 no
79 T1011.001 Exfiltration Over Bluetooth Exfiltration no
80 T1567.002 Exfiltration to Cloud Storage Exfiltration ZIRCONIUM|HAFNIUM|Chimera|Leviathan|Turla Leviathan|Turla
81 T1567.001 Exfiltration to Code Repository Exfiltration no
82 T1059.006 Python Execution ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete
83 T1059.005 Visual Basic Execution Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|Lazarus Group|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound
84 T1059.004 Unix Shell Execution Rocke|APT41
85 T1059.003 Windows Command Shell Execution APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|UNC2452|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Gorgon Group|Dark Caracal|Rancor|Ke3chang|Dragonfly 2.0|Leviathan|APT37|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|menuPass|Threat Group-3390|Gamaredon Group|Patchwork|Suckfly|Threat Group-1314|APT3|admin@338|APT1 TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|Soft Cell|Turla|Silence|APT32|APT39|Darkhotel|MuddyWater|APT18|APT38|Dark Caracal|Gorgon Group|Dragonfly 2.0|Rancor|Ke3chang|APT37|Leviathan|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|Threat Group-3390|menuPass|Gamaredon Group|Suckfly|Patchwork|Threat Group-1314|APT3|admin@338|APT1
86 T1059.002 AppleScript Execution no
87 T1059.001 PowerShell Execution Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Lazarus Group|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|Dragonfly 2.0|APT28|Thrip|Cobalt Group|DarkHydrus|Gorgon Group|Leviathan|TA459|MuddyWater|FIN8|Magic Hound|CopyKittens|OilRig|BRONZE BUTLER|FIN10|Threat Group-3390|APT32|FIN7|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|Soft Cell|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|DarkHydrus|APT28|Thrip|Gorgon Group|Cobalt Group|Dragonfly 2.0|Leviathan|TA459|FIN8|MuddyWater|Magic Hound|OilRig|BRONZE BUTLER|CopyKittens|APT32|FIN7|FIN10|Threat Group-3390|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda
88 T1567 Exfiltration Over Web Service Exfiltration APT28 no
89 T1497.003 Time Based Evasion Defense Evasion|Discovery no
90 T1497.002 User Activity Based Checks Defense Evasion|Discovery Darkhotel|FIN7 FIN7
91 T1497.001 System Checks Defense Evasion|Discovery Darkhotel|Evilnum|Frankenstein Frankenstein
92 T1498.002 Reflection Amplification Impact no
93 T1498.001 Direct Network Flood Impact no
94 T1566.003 Spearphishing via Service Initial Access Ajax Security Team|Lazarus Group|Magic Hound|Windshift|FIN6|OilRig|Dark Caracal Magic Hound|Windshift|FIN6|OilRig|Dark Caracal
95 T1566.002 Spearphishing Link Initial Access Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Cobalt Group|Turla|APT28|Dragonfly 2.0|OilRig|APT33|APT29|Leviathan|Elderwood|FIN8|Patchwork|Magic Hound Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Turla|APT28|Cobalt Group|Dragonfly 2.0|OilRig|APT33|Elderwood|Leviathan|Magic Hound|Patchwork|APT29|FIN8
96 T1566.001 Spearphishing Attachment Initial Access Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|APT19|Lazarus Group|OilRig|APT32|BRONZE BUTLER|Dragonfly 2.0|MuddyWater|APT28|FIN8|TA459|Elderwood|APT29|Leviathan|Patchwork|APT37|menuPass|PLATINUM Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Turla|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|OilRig|Lazarus Group|APT19|Dragonfly 2.0|BRONZE BUTLER|APT32|FIN8|MuddyWater|APT28|TA459|Leviathan|Patchwork|PLATINUM|Elderwood|APT29|APT37|menuPass
97 T1566 Phishing Initial Access GOLD SOUTHFIELD|Dragonfly no
98 T1565.003 Runtime Data Manipulation Impact APT38
99 T1565.002 Transmitted Data Manipulation Impact APT38
100 T1565.001 Stored Data Manipulation Impact FIN4|APT38
101 T1565 Data Manipulation Impact no
102 T1564.001 Hidden Files and Directories Defense Evasion Mustang Panda|Rocke|APT32|Tropic Trooper|Lazarus Group|APT28 Rocke|APT32|Tropic Trooper|APT28|Lazarus Group
103 T1564 Hide Artifacts Defense Evasion no
104 T1563.002 RDP Hijacking Lateral Movement no
105 T1563.001 SSH Hijacking Lateral Movement no
106 T1563 Remote Service Session Hijacking Lateral Movement no
107 T1518.001 Security Software Discovery Discovery Windshift|Sidewinder|Operation Wocao|Wizard Spider|Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon
108 T1069.003 Cloud Groups Discovery no
109 T1069.002 Domain Groups Discovery Turla|Inception|OilRig|Dragonfly 2.0|Ke3chang Turla|Wizard Spider|Inception|OilRig|FIN6|Dragonfly 2.0|Ke3chang
110 T1087.004 Cloud Account Discovery no
111 T1087.003 Email Account Discovery Sandworm Team|TA505
112 T1087.002 Domain Account Discovery MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|Dragonfly 2.0|BRONZE BUTLER|OilRig|menuPass|FIN6|Poseidon Group|Ke3chang Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang
113 T1087.001 Local Account Discovery Chimera|Fox Kitten|Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338 Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338
114 T1553.004 Install Root Certificate Defense Evasion no
115 T1562.004 Disable or Modify System Firewall Defense Evasion APT29|UNC2452|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak
116 T1562.003 Impair Command History Logging HISTCONTROL Defense Evasion no
117 T1562.002 Disable Windows Event Logging Defense Evasion APT29|UNC2452|Threat Group-3390 Threat Group-3390
118 T1562.001 Disable or Modify Tools Defense Evasion APT29|MuddyWater|UNC2452|Wizard Spider|FIN6|Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda
119 T1562 Impair Defenses Defense Evasion no
120 T1003.004 LSA Secrets Credential Access OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390
121 T1003.005 Cached Domain Credentials Credential Access OilRig|MuddyWater|Leafminer|APT33
122 T1561.002 Disk Structure Wipe Impact Sandworm Team|Lazarus Group|APT38|APT37
123 T1561.001 Disk Content Wipe Impact Lazarus Group
124 T1561 Disk Wipe Impact no
125 T1560.003 Archive via Custom Method Collection Mustang Panda|Lazarus Group|Kimsuky|CopyKittens|FIN6 Lazarus Group|Kimsuky|CopyKittens|FIN6
126 T1560.002 Archive via Library Collection Lazarus Group|Threat Group-3390
127 T1560.001 Archive via Utility Collection APT29|Mustang Panda|HAFNIUM|UNC2452|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|APT1|Ke3chang APT41|Soft Cell|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|APT3|Sowbug|menuPass|APT1|Ke3chang
128 T1560 Archive Collected Data Collection menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang
129 T1499.004 Application or System Exploitation Impact no
130 T1499.003 Application Exhaustion Flood Impact no
131 T1499.002 Service Exhaustion Flood Impact no
132 T1499.001 OS Exhaustion Flood Impact no
133 T1491.002 External Defacement Impact Sandworm Team no
134 T1491.001 Internal Defacement Impact Lazarus Group
135 T1114.003 Email Forwarding Rule Collection Silent Librarian|Kimsuky no
136 T1114.002 Remote Email Collection Collection APT29|HAFNIUM|Chimera|UNC2452|APT1|FIN4|Dragonfly 2.0|APT28|Leafminer|Ke3chang APT1|FIN4|APT28|Dragonfly 2.0|Ke3chang|Leafminer
137 T1114.001 Local Email Collection Collection Chimera|Magic Hound|APT1 Magic Hound|APT1
138 T1134.005 SID-History Injection Defense Evasion|Privilege Escalation no
139 T1134.004 Parent PID Spoofing Defense Evasion|Privilege Escalation no
140 T1134.003 Make and Impersonate Token Defense Evasion|Privilege Escalation no
141 T1134.002 Create Process with Token Defense Evasion|Privilege Escalation Turla|Lazarus Group
142 T1134.001 Token Impersonation/Theft Defense Evasion|Privilege Escalation APT28
143 T1213.002 Sharepoint Collection Chimera|Ke3chang|APT28 Ke3chang|APT28
144 T1213.001 Confluence Collection no
145 T1555.003 Credentials from Web Browsers Credential Access Ajax Security Team|ZIRCONIUM|FIN6|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats Magic Hound|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats
146 T1555.002 Securityd Memory Credential Access no
147 T1555.001 Keychain Credential Access no
148 T1559.002 Dynamic Data Exchange Execution Sidewinder|Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7 Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7
149 T1559.001 Component Object Model Execution Gamaredon Group|MuddyWater
150 T1559 Inter-Process Communication Execution no
151 T1558.002 Silver Ticket Credential Access no
152 T1558.001 Golden Ticket Credential Access Ke3chang
153 T1558 Steal or Forge Kerberos Tickets Credential Access no
154 T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay Credential Access|Collection Wizard Spider no
155 T1557 Man-in-the-Middle Credential Access|Collection Kimsuky no
156 T1556.002 Password Filter DLL Credential Access|Defense Evasion|Persistence Credential Access|Defense Evasion Strider
157 T1556.001 Domain Controller Authentication Credential Access|Defense Evasion|Persistence Credential Access|Defense Evasion Chimera no
158 T1556 Modify Authentication Process Credential Access|Defense Evasion|Persistence Credential Access|Defense Evasion no
159 T1056.004 Credential API Hooking Collection|Credential Access PLATINUM
160 T1056.003 Web Portal Capture Collection|Credential Access no
161 T1056.002 GUI Input Capture Collection|Credential Access FIN4
162 T1056.001 Keylogging Collection|Credential Access Ajax Security Team|Operation Wocao|APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28 APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|Ke3chang|OilRig|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28
163 T1555 Credentials from Password Stores Credential Access APT29|Evilnum|UNC2452|FIN6|APT39|OilRig|MuddyWater|Leafminer|APT33|Stealth Falcon APT39|OilRig|MuddyWater|Leafminer|APT33|Turla|Stealth Falcon
164 T1552.005 Cloud Instance Metadata API Credential Access no
165 T1003.008 /etc/passwd and /etc/shadow Credential Access no
166 T1003.007 Proc Filesystem Credential Access no
167 T1003.006 DCSync Credential Access APT29|UNC2452|Operation Wocao no
168 T1558.003 Kerberoasting Credential Access APT29|UNC2452|Operation Wocao|Wizard Spider no
169 T1552.006 Group Policy Preferences Credential Access APT33
170 T1003.003 NTDS Credential Access Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6|Dragonfly 2.0 FIN6|Dragonfly 2.0
171 T1003.002 Security Account Manager Credential Access Wizard Spider|Threat Group-3390|Ke3chang|GALLIUM|Night Dragon|Dragonfly 2.0|menuPass Threat Group-3390|Ke3chang|Soft Cell|Night Dragon|Dragonfly 2.0|menuPass
172 T1003.001 LSASS Memory Credential Access HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Leafminer|Magic Hound|Lazarus Group|MuddyWater|PLATINUM|FIN8|OilRig|BRONZE BUTLER|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|Soft Cell|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Lazarus Group|Leafminer|Magic Hound|MuddyWater|PLATINUM|FIN8|BRONZE BUTLER|OilRig|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver
173 T1110.004 Credential Stuffing Credential Access Chimera no
174 T1110.003 Password Spraying Credential Access Silent Librarian|Chimera|APT28|APT33|Leafminer|Lazarus Group APT33|Leafminer|Lazarus Group
175 T1110.002 Password Cracking Credential Access FIN6|APT41|Dragonfly 2.0|APT3 APT41|Dragonfly 2.0|APT3
176 T1110.001 Password Guessing Credential Access APT28 no
177 T1021.006 Windows Remote Management Lateral Movement APT29|UNC2452|Chimera|Wizard Spider|Threat Group-3390 Threat Group-3390
178 T1021.005 VNC Lateral Movement Fox Kitten|GCMAN GCMAN
179 T1021.004 SSH Lateral Movement Fox Kitten|Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN
180 T1021.003 Distributed Component Object Model Lateral Movement no
181 T1021.002 SMB/Windows Admin Shares Lateral Movement Fox Kitten|APT41|Operation Wocao|Wizard Spider|Chimera|Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang
182 T1021.001 Remote Desktop Protocol Lateral Movement Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|FIN10|menuPass|Patchwork|FIN6|Lazarus Group|APT1|Axiom Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|menuPass|FIN10|Patchwork|FIN6|Lazarus Group|APT1|Axiom
183 T1554 Compromise Client Software Binary Persistence no
184 T1036.006 Space after Filename Defense Evasion no
185 T1036.005 Match Legitimate Name or Location Defense Evasion APT29|Mustang Panda|Sidewinder|Darkhotel|Lazarus Group|Indrik Spider|UNC2452|Fox Kitten|Machete|Chimera|PROMETHIUM|Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1 Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1
186 T1036.004 Masquerade Task or Service Defense Evasion ZIRCONIUM|APT29|Higaisa|UNC2452|Fox Kitten|Kimsuky|Lazarus Group|PROMETHIUM|Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7 Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7
187 T1036.003 Rename System Utilities Defense Evasion menuPass|APT32|GALLIUM menuPass|APT32|Soft Cell|PLATINUM
188 T1036.002 Right-to-Left Override Defense Evasion BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic
189 T1036.001 Invalid Code Signature Defense Evasion Windshift|APT37 Windshift
190 T1553.003 SIP and Trust Provider Hijacking Defense Evasion no
191 T1553.002 Code Signing Defense Evasion APT29|GALLIUM|UNC2452|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|APT37|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel
192 T1553.001 Gatekeeper Bypass Defense Evasion no
193 T1553 Subvert Trust Controls Defense Evasion no
194 T1027.003 Steganography Defense Evasion TA551|BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37 BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37
195 T1027.002 Software Packing Defense Evasion ZIRCONIUM|Lazarus Group|TA505|Rocke|GALLIUM|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon TA505|Rocke|Soft Cell|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon
196 T1027.001 Binary Padding Defense Evasion Mustang Panda|Higaisa|Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee
197 T1222.002 Linux and Mac File and Directory Permissions Modification Defense Evasion Rocke|APT32
198 T1222.001 Windows File and Directory Permissions Modification Defense Evasion Wizard Spider no
199 T1552.004 Private Keys Credential Access APT29|UNC2452|Operation Wocao|Rocke Rocke
200 T1552.003 Bash History Credential Access no
201 T1552.002 Credentials in Registry Credential Access APT32
202 T1552.001 Credentials In Files Credential Access Fox Kitten|Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3 Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3
203 T1552 Unsecured Credentials Credential Access no
204 T1216.001 PubPrn Defense Evasion APT32
205 T1070.006 Timestomp Defense Evasion APT29|UNC2452|Chimera|Kimsuky|Rocke|TEMP.Veles|APT32|Lazarus Group|APT28 Rocke|TEMP.Veles|APT32|Lazarus Group|APT28
206 T1070.005 Network Share Connection Removal Defense Evasion Threat Group-3390
207 T1070.004 File Deletion Defense Evasion APT39|Mustang Panda|Chimera|Evilnum|UNC2452|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|Threat Group-3390|FIN10|APT28|Group5|Lazarus Group|APT18|APT29 Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|FIN10|APT28|Threat Group-3390|Group5|Lazarus Group|APT18|APT29
208 T1070.003 Clear Command History Defense Evasion APT41
209 T1550.004 Web Session Cookie Defense Evasion|Lateral Movement APT29|UNC2452 no
210 T1550.001 Application Access Token Defense Evasion|Lateral Movement APT28
211 T1550.003 Pass the Ticket Defense Evasion|Lateral Movement APT32|BRONZE BUTLER|APT29
212 T1550.002 Pass the Hash Defense Evasion|Lateral Movement Chimera|Kimsuky|GALLIUM|APT32|Night Dragon|APT28|APT1 Soft Cell|APT32|Night Dragon|APT28|APT1
213 T1550 Use Alternate Authentication Material Defense Evasion|Lateral Movement APT29|UNC2452 no
214 T1548.004 Elevated Execution with Prompt Privilege Escalation|Defense Evasion no
215 T1548.003 Sudo and Sudo Caching Privilege Escalation|Defense Evasion no
216 T1548.002 Bypass User Account Control Bypass User Access Control Privilege Escalation|Defense Evasion Evilnum|APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29 APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29
217 T1548.001 Setuid and Setgid Privilege Escalation|Defense Evasion no
218 T1548 Abuse Elevation Control Mechanism Privilege Escalation|Defense Evasion no
219 T1136.003 Cloud Account Persistence no
220 T1070.002 Clear Linux or Mac System Logs Defense Evasion Rocke
221 T1070.001 Clear Windows Event Logs Defense Evasion Chimera|Operation Wocao|APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28 APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28
222 T1136.002 Domain Account Persistence HAFNIUM|GALLIUM Soft Cell
223 T1136.001 Local Account Persistence Fox Kitten|APT39|APT41|Dragonfly 2.0|Leafminer|APT3 APT39|APT41|Dragonfly 2.0|Leafminer|APT3
224 T1547.011 Plist Modification Persistence|Privilege Escalation no
225 T1547.010 Port Monitors Persistence|Privilege Escalation no
226 T1547.009 Shortcut Modification Persistence|Privilege Escalation APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Lazarus Group|Leviathan APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Leviathan|Lazarus Group
227 T1547.008 LSASS Driver Persistence|Privilege Escalation no
228 T1547.007 Re-opened Applications Persistence|Privilege Escalation no
229 T1547.006 Kernel Modules and Extensions Persistence|Privilege Escalation no
230 T1547.005 Security Support Provider Persistence|Privilege Escalation Lazarus Group no
231 T1547.004 Winlogon Helper DLL Persistence|Privilege Escalation Wizard Spider|Tropic Trooper|Turla Tropic Trooper|Turla
232 T1547.003 Time Providers Persistence|Privilege Escalation no
233 T1546.014 Emond Privilege Escalation|Persistence no
234 T1546.013 PowerShell Profile Privilege Escalation|Persistence Turla
236 T1218.008 Odbcconf Defense Evasion Cobalt Group
237 T1546.011 Application Shimming Privilege Escalation|Persistence FIN7
238 T1547.002 Authentication Package Persistence|Privilege Escalation no
239 T1546.010 AppInit DLLs Privilege Escalation|Persistence APT39 no
240 T1546.009 AppCert DLLs Privilege Escalation|Persistence Honeybee
241 T1218.007 Msiexec Defense Evasion ZIRCONIUM|Molerats|Machete|TA505|Rancor TA505|Rancor
242 T1546.008 Accessibility Features Privilege Escalation|Persistence Fox Kitten|APT41|APT3|APT29|Deep Panda|Axiom APT41|APT3|APT29|Deep Panda|Axiom
243 T1546.007 Netsh Helper DLL Privilege Escalation|Persistence no
244 T1546.006 LC_LOAD_DYLIB Addition Privilege Escalation|Persistence no
245 T1546.005 Trap Privilege Escalation|Persistence no
246 T1546.004 Unix Shell Configuration Modification .bash_profile and .bashrc Privilege Escalation|Persistence no
247 T1546.003 Windows Management Instrumentation Event Subscription Privilege Escalation|Persistence Mustang Panda|UNC2452|APT33|Blue Mockingbird|Turla|Leviathan|APT29 APT33|Blue Mockingbird|Turla|Leviathan|APT29
248 T1546.002 Screensaver Privilege Escalation|Persistence no
249 T1546.001 Change Default File Association Privilege Escalation|Persistence Kimsuky
250 T1547.001 Registry Run Keys / Startup Folder Persistence|Privilege Escalation Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Turla|APT19|Honeybee|Dark Caracal|Threat Group-3390|Cobalt Group|Ke3chang|Gorgon Group|Dragonfly 2.0|APT37|MuddyWater|Leviathan|APT3|BRONZE BUTLER|Magic Hound|FIN7|FIN10|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Machete|Kimsuky|APT33|APT39|APT32|APT18|Turla|Dark Caracal|Cobalt Group|Honeybee|Threat Group-3390|Dragonfly 2.0|Gorgon Group|Ke3chang|APT19|Leviathan|MuddyWater|APT37|BRONZE BUTLER|Magic Hound|APT3|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel
251 T1218.002 Control Panel Defense Evasion no
252 T1218.010 Regsvr32 Defense Evasion TA551|Blue Mockingbird|Inception|WIRTE|APT19|Cobalt Group|Leviathan|APT32|Deep Panda Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda
253 T1218.009 Regsvcs/Regasm Defense Evasion no
254 T1218.005 Mshta Defense Evasion Mustang Panda|TA551|Sidewinder|Lazarus Group|Inception|Kimsuky|APT32|MuddyWater|FIN7 Inception|Kimsuky|APT32|MuddyWater|FIN7
255 T1218.004 InstallUtil Defense Evasion Mustang Panda|menuPass no
256 T1218.001 Compiled HTML File Defense Evasion APT41|Silence|Lazarus Group|Dark Caracal|OilRig
257 T1218.003 CMSTP Defense Evasion Cobalt Group|MuddyWater
258 T1218.011 Rundll32 Defense Evasion HAFNIUM|TA551|UNC2452|APT41|Gamaredon Group|APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28 APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28
259 T1547 Boot or Logon Autostart Execution Persistence|Privilege Escalation no
260 T1546 Event Triggered Execution Privilege Escalation|Persistence no
261 T1098.003 Add Office 365 Global Administrator Role Persistence no
262 T1098.002 Exchange Email Delegate Permissions Persistence APT29|UNC2452|Magic Hound Magic Hound
263 T1098.001 Additional Cloud Credentials Additional Azure Service Principal Credentials Persistence APT29|UNC2452 no
264 T1543.004 Launch Daemon Persistence|Privilege Escalation no
265 T1543.003 Windows Service Persistence|Privilege Escalation PROMETHIUM|Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|FIN7|APT19|Honeybee|Threat Group-3390|APT3|Lazarus Group|Carbanak Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|Honeybee|FIN7|Threat Group-3390|APT19|APT3|Lazarus Group|Carbanak
266 T1543.002 Systemd Service Persistence|Privilege Escalation Rocke
267 T1543.001 Launch Agent Persistence|Privilege Escalation no
268 T1037.005 Startup Items Persistence|Privilege Escalation no
269 T1037.004 RC Scripts Rc.common Persistence|Privilege Escalation no
270 T1055.012 Process Hollowing Defense Evasion|Privilege Escalation Threat Group-3390|Gorgon Group|menuPass|Patchwork Threat Group-3390|menuPass|Gorgon Group|Patchwork
271 T1055.013 Process Doppelgänging Defense Evasion|Privilege Escalation Leafminer
272 T1055.011 Extra Window Memory Injection Defense Evasion|Privilege Escalation no
273 T1055.014 VDSO Hijacking Defense Evasion|Privilege Escalation no
277 T1055.004 Asynchronous Procedure Call Defense Evasion|Privilege Escalation no
278 T1055.003 Thread Execution Hijacking Defense Evasion|Privilege Escalation no
279 T1055.002 Portable Executable Injection Defense Evasion|Privilege Escalation Rocke|Gorgon Group
280 T1055.001 Dynamic-link Library Injection Defense Evasion|Privilege Escalation Wizard Spider|TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda
281 T1037.003 Network Logon Script Persistence|Privilege Escalation no
282 T1543 Create or Modify System Process Persistence|Privilege Escalation no
283 T1037.002 Logon Script (Mac) Persistence|Privilege Escalation no
285 T1542.003 Bootkit Persistence|Defense Evasion APT41|Lazarus Group|APT28
286 T1542.002 Component Firmware Persistence|Defense Evasion Equation
287 T1542.001 System Firmware Persistence|Defense Evasion no
288 T1505.003 Web Shell Persistence Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda Tropic Trooper|Soft Cell|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda
289 T1505.002 Transport Agent Persistence no
290 T1505.001 SQL Stored Procedures Persistence no
291 T1053.003 Cron Execution|Persistence|Privilege Escalation Rocke
292 T1053.004 Launchd Execution|Persistence|Privilege Escalation no
293 T1053.001 At (Linux) Execution|Persistence|Privilege Escalation no
294 T1053.005 Scheduled Task Execution|Persistence|Privilege Escalation Mustang Panda|Higaisa|UNC2452|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|Cobalt Group|Rancor|Dragonfly 2.0|OilRig|Patchwork|FIN8|menuPass|FIN10|FIN7|APT32|Stealth Falcon|FIN6|APT3|APT29 Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|Machete|Soft Cell|Silence|TEMP.Veles|APT33|APT39|Dragonfly 2.0|Patchwork|OilRig|Rancor|Cobalt Group|FIN8|menuPass|FIN10|APT32|FIN7|Stealth Falcon|FIN6|APT3|APT29
295 T1053.002 At (Windows) Execution|Persistence|Privilege Escalation BRONZE BUTLER|Threat Group-3390|APT18
296 T1542 Pre-OS Boot Defense Evasion|Persistence no
297 T1137.001 Office Template Macros Persistence MuddyWater
301 T1137.006 Add-ins Persistence Naikon
302 T1137.002 Office Test Persistence APT28
303 T1531 Account Access Removal Impact no
304 T1539 Steal Web Session Cookie Credential Access Evilnum no
305 T1529 System Shutdown/Reboot Impact Lazarus Group|APT38|APT37
306 T1518 Software Discovery Discovery Mustang Panda|Windshift|MuddyWater|Windigo|Sidewinder|Operation Wocao|BRONZE BUTLER|Tropic Trooper|Inception BRONZE BUTLER|Tropic Trooper|Inception
T1547.013 XDG Autostart Entries Persistence|Privilege Escalation no
307 T1534 Internal Spearphishing Lateral Movement Gamaredon Group
308 T1528 Steal Application Access Token Credential Access APT28
309 T1535 Unused/Unsupported Cloud Regions Defense Evasion no
310 T1525 Implant Internal Image Implant Container Image Persistence no
311 T1538 Cloud Service Dashboard Discovery no
312 T1530 Data from Cloud Storage Object Collection Fox Kitten no
313 T1578 Modify Cloud Compute Infrastructure Defense Evasion no
314 T1537 Transfer Data to Cloud Account Exfiltration no
315 T1526 Cloud Service Discovery Discovery no
316 T1505 Server Software Component Persistence no
317 T1499 Endpoint Denial of Service Impact Sandworm Team no
318 T1497 Virtualization/Sandbox Evasion Defense Evasion|Discovery Darkhotel no
319 T1498 Network Denial of Service Impact APT28 no
320 T1496 Resource Hijacking Impact Blue Mockingbird|Rocke|APT41|Lazarus Group
321 T1495 Firmware Corruption Impact no
322 T1491 Defacement Impact no
323 T1490 Inhibit System Recovery Impact no
324 T1489 Service Stop Impact Wizard Spider|Lazarus Group Lazarus Group
325 T1486 Data Encrypted for Impact Impact Indrik Spider|APT41|TA505|APT38 APT41|TA505|APT38
326 T1485 Data Destruction Impact Sandworm Team|Lazarus Group|APT38
327 T1484 Domain Policy Modification Group Policy Modification Defense Evasion|Privilege Escalation no
328 T1482 Domain Trust Discovery Discovery APT29|Chimera|UNC2452 Wizard Spider
329 T1480 Execution Guardrails Defense Evasion no
330 T1222 File and Directory Permissions Modification Defense Evasion no
T1220 XSL Script Processing Defense Evasion Higaisa|Cobalt Group
331 T1221 Template Injection Defense Evasion Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus
332 T1189 T1220 Drive-by Compromise XSL Script Processing Initial Access Defense Evasion Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|Leafminer|Lazarus Group|BRONZE BUTLER|APT19|APT32|Threat Group-3390|Dark Caracal|Elderwood|APT37|Patchwork|PLATINUM Cobalt Group
333 T1190 T1197 Exploit Public-Facing Application BITS Jobs Initial Access Defense Evasion|Persistence Volatile Cedar|UNC2452|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom Patchwork|APT41|Leviathan
334 T1210 T1217 Exploitation of Remote Services Browser Bookmark Discovery Lateral Movement Discovery Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28 no
335 T1217 T1213 Browser Bookmark Discovery Data from Information Repositories Discovery Collection Chimera|Fox Kitten Turla
336 T1213 T1189 Data from Information Repositories Drive-by Compromise Collection Initial Access Fox Kitten|FIN6|Turla Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|BRONZE BUTLER|Leafminer|Dark Caracal|APT19|APT32|Lazarus Group|Threat Group-3390|Elderwood|APT37|Patchwork|PLATINUM
337 T1197 T1203 BITS Jobs Exploitation for Client Execution Defense Evasion|Persistence Execution APT39|Patchwork|APT41|Leviathan Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|Lazarus Group|BRONZE BUTLER|Cobalt Group|APT37|Patchwork|Leviathan|Elderwood|TA459|APT29
T1219 Remote Access Software Command And Control Mustang Panda|MuddyWater|Evilnum|GOLD SOUTHFIELD|Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak
T1195 Supply Chain Compromise Initial Access no
T1204 User Execution Execution no
338 T1212 Exploitation for Credential Access Credential Access no
339 T1211 Exploitation for Defense Evasion Defense Evasion APT28
340 T1200 T1190 Hardware Additions Exploit Public-Facing Application Initial Access DarkVishnya Blue Mockingbird|Rocke|APT39|BlackTech|APT41|Soft Cell|Night Dragon|Axiom
341 T1210 Exploitation of Remote Services Lateral Movement Threat Group-3390|APT28
342 T1202 Indirect Command Execution Defense Evasion no
343 T1201 T1200 Password Policy Discovery Hardware Additions Discovery Initial Access Chimera|Turla|OilRig DarkVishnya
344 T1201 Password Policy Discovery Discovery Turla|OilRig
345 T1219 Remote Access Software Command And Control Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak
346 T1207 Rogue Domain Controller Defense Evasion no
347 T1203 T1199 Exploitation for Client Execution Trusted Relationship Execution Initial Access Mustang Panda|Darkhotel|Higaisa|HAFNIUM|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Lazarus Group|Cobalt Group|APT37|Patchwork|APT29|TA459|Leviathan|Elderwood APT28|menuPass
T1216 Signed Script Proxy Execution Defense Evasion no
T1199 Trusted Relationship Initial Access Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass
348 T1218 Signed Binary Proxy Execution Defense Evasion no
349 T1204 User Execution Execution no
350 T1216 Signed Script Proxy Execution Defense Evasion no
351 T1195 Supply Chain Compromise Initial Access Elderwood
352 T1205 Traffic Signaling Defense Evasion|Persistence|Command And Control no
353 T1176 Browser Extensions Persistence Kimsuky|Stolen Pencil
354 T1175 Component Object Model and Distributed COM Lateral Movement|Execution no
355 T1187 Forced Authentication Credential Access DarkHydrus|Dragonfly 2.0
356 T1185 Man in the Browser Collection no
357 T1149 T1134 LC_MAIN Hijacking Access Token Manipulation Defense Evasion Defense Evasion|Privilege Escalation no Blue Mockingbird
T1134 Access Token Manipulation Defense Evasion|Privilege Escalation FIN6|Blue Mockingbird
358 T1136 Create Account Persistence no
359 T1140 Deobfuscate/Decode Files or Information Defense Evasion Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|menuPass|Honeybee|Threat Group-3390|APT19|Gorgon Group|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER
360 T1149 LC_MAIN Hijacking Defense Evasion no
361 T1135 Network Share Discovery Discovery APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug
362 T1137 Office Application Startup Persistence Gamaredon Group|APT32
T1140 Deobfuscate/Decode Files or Information Defense Evasion APT39|APT29|ZIRCONIUM|Higaisa|UNC2452|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|Gorgon Group|menuPass|Honeybee|Threat Group-3390|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER
T1135 Network Share Discovery Discovery Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug
363 T1153 Source Execution no
364 T1133 External Remote Services Persistence|Initial Access APT29|UNC2452|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18 Sandworm Team|APT41|Soft Cell|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18
365 T1132 Data Encoding Command And Control no
366 T1129 Shared Modules Execution no
367 T1127 Trusted Developer Utilities Proxy Execution Defense Evasion no
368 T1125 Video Capture Collection Silence|FIN7
369 T1124 System Time Discovery Discovery Darkhotel|ZIRCONIUM|Higaisa|Sidewinder|Chimera|Operation Wocao|The White Company|Lazarus Group|BRONZE BUTLER|Turla The White Company|Lazarus Group|BRONZE BUTLER|Turla
370 T1123 Audio Capture Collection APT37
371 T1120 Peripheral Device Discovery Discovery Operation Wocao|Turla|APT37|Gamaredon Group|Equation|APT28 Turla|APT37|Gamaredon Group|Equation|APT28
372 T1119 Automated Collection Collection Mustang Panda|Sidewinder|Chimera|menuPass|Operation Wocao|Gamaredon Group|Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6 Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6
373 T1115 Clipboard Data Collection Operation Wocao|APT39|APT38 APT39|APT38
374 T1114 Email Collection Collection Silent Librarian no
375 T1113 Screen Capture Collection GOLD SOUTHFIELD|Gamaredon Group|APT39|Silence|MuddyWater|OilRig|Dragonfly 2.0|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28 Gamaredon Group|APT39|Silence|MuddyWater|Dragonfly 2.0|OilRig|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28
376 T1112 Modify Registry Defense Evasion Operation Wocao|Kimsuky|Lazarus Group|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Patchwork|Gorgon Group|Honeybee|FIN8 Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Honeybee|Patchwork|Gorgon Group|FIN8
377 T1111 Two-Factor Authentication Interception Credential Access Chimera|Operation Wocao no
378 T1110 Brute Force Credential Access APT28|Fox Kitten|DarkVishnya|APT39|OilRig|FIN5|Turla DarkVishnya|APT39|OilRig|FIN5|Turla
379 T1108 Redundant Access Defense Evasion|Persistence no
380 T1106 Native API Execution Higaisa|menuPass|Operation Wocao|Chimera|Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|APT37|Gorgon Group Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|Gorgon Group|APT37
381 T1105 Ingress Tool Transfer Command And Control HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|UNC2452|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Gorgon Group|Turla|OilRig|Dragonfly 2.0|APT37|Leviathan|FIN8|PLATINUM|Elderwood|APT3|Magic Hound|APT32|BRONZE BUTLER|FIN7|menuPass|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28 Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|Soft Cell|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Turla|Gorgon Group|OilRig|Dragonfly 2.0|APT37|FIN8|PLATINUM|Leviathan|Elderwood|Magic Hound|APT3|APT32|BRONZE BUTLER|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28
382 T1104 Multi-Stage Channels Command And Control APT41|MuddyWater|APT3
383 T1102 Web Service Command And Control Fox Kitten|Turla|APT32|Gamaredon Group|Rocke|Inception|FIN6 Gamaredon Group|Rocke|Inception|FIN6
384 T1098 Account Manipulation Persistence APT3|Dragonfly 2.0|Lazarus Group
385 T1095 Non-Application Layer Protocol Command And Control HAFNIUM|Operation Wocao|FIN6|APT29|PLATINUM|APT3 APT29|PLATINUM|APT3
386 T1092 Communication Through Removable Media Command And Control APT28
387 T1091 Replication Through Removable Media Lateral Movement|Initial Access Mustang Panda|Tropic Trooper|Darkhotel|APT28 Tropic Trooper|Darkhotel|APT28
388 T1090 Proxy Command And Control Windigo|Fox Kitten|Operation Wocao|Sandworm Team|Blue Mockingbird|APT41|Turla Sandworm Team|Blue Mockingbird|Wizard Spider|APT41|Turla
389 T1087 Account Discovery Discovery APT29|UNC2452 no
390 T1083 File and Directory Discovery Discovery APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|UNC2452|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Dragonfly 2.0|Leafminer|Honeybee|Dark Caracal|Magic Hound|APT3|BRONZE BUTLER|Sowbug|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dark Caracal|Dragonfly 2.0|Magic Hound|Sowbug|BRONZE BUTLER|APT3|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang
391 T1082 System Information Discovery Discovery APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|UNC2452|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT37|APT19|Honeybee|APT32|Magic Hound|Sowbug|OilRig|APT3|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|Honeybee|APT19|APT37|APT32|Magic Hound|OilRig|APT3|Sowbug|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang
392 T1080 Taint Shared Content Lateral Movement Gamaredon Group|BRONZE BUTLER|Darkhotel BRONZE BUTLER|Darkhotel
393 T1078 Valid Accounts Defense Evasion|Persistence|Privilege Escalation|Initial Access APT29|Silent Librarian|UNC2452|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|APT33|Leviathan|OilRig|FIN5|menuPass|FIN10|APT28|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak Sandworm Team|Wizard Spider|Silence|APT41|Soft Cell|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|Leviathan|APT33|OilRig|FIN5|menuPass|APT28|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak
394 T1074 Data Staged Collection Wizard Spider
395 T1072 Software Deployment Tools Execution|Lateral Movement Silence|APT32|Threat Group-1314
396 T1071 Application Layer Protocol Command And Control Rocke|Magic Hound|Dragonfly 2.0
397 T1070 Indicator Removal on Host Defense Evasion APT29|UNC2452 no
398 T1069 Permission Groups Discovery Discovery APT29|UNC2452|TA505|APT3 TA505|APT3
399 T1068 Exploitation for Privilege Escalation Privilege Escalation ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28 Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28
400 T1064 Scripting Defense Evasion|Execution no
401 T1062 Hypervisor Persistence no
402 T1061 Graphical User Interface Execution no
403 T1059 Command and Scripting Interpreter Execution Windigo|Fox Kitten|APT32|Whitefly|APT39|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang APT32|Molerats|Whitefly|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang
404 T1057 Process Discovery Discovery APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|UNC2452|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang
405 T1056 Input Capture Collection|Credential Access APT39 no
406 T1055 Process Injection Defense Evasion|Privilege Escalation Operation Wocao|APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM
407 T1053 Scheduled Task/Job Execution|Persistence|Privilege Escalation no
408 T1052 Exfiltration Over Physical Medium Exfiltration no
409 T1051 Shared Webroot Lateral Movement no
410 T1049 System Network Connections Discovery Discovery Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|APT3|OilRig|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang Tropic Trooper|APT41|APT38|Soft Cell|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang
411 T1048 Exfiltration Over Alternative Protocol Exfiltration no
412 T1047 Windows Management Instrumentation Execution Mustang Panda|Windshift|UNC2452|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|OilRig|Threat Group-3390|Leviathan|FIN8|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|Soft Cell|APT32|MuddyWater|OilRig|Threat Group-3390|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda
413 T1046 Network Service Scanning Discovery Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|OilRig|Leafminer|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390 Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|Leafminer|OilRig|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390
414 T1043 Commonly Used Port Command And Control OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|FIN7|Dragonfly 2.0|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390 Machete|OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|Dragonfly 2.0|FIN7|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390
415 T1041 Exfiltration Over C2 Channel Exfiltration ZIRCONIUM|Higaisa|Chimera|APT39|Operation Wocao|Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|GALLIUM|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|Soft Cell|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang
416 T1040 Network Sniffing Credential Access|Discovery Kimsuky|Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28 Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28
417 T1039 Data from Network Shared Drive Collection Chimera|Fox Kitten|Gamaredon Group|Sowbug|BRONZE BUTLER|menuPass Sowbug|BRONZE BUTLER|menuPass
418 T1037 Boot or Logon Initialization Scripts Persistence|Privilege Escalation Rocke
419 T1036 Masquerading Defense Evasion APT29|Mustang Panda|ZIRCONIUM|TA551|UNC2452|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM|Dragonfly 2.0 Windshift|APT32|BRONZE BUTLER|menuPass|Dragonfly 2.0
420 T1034 Path Interception Persistence|Privilege Escalation no
421 T1033 System Owner/User Discovery Discovery Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3 Frankenstein|APT41|Soft Cell|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3
422 T1030 Data Transfer Size Limits Exfiltration Threat Group-3390
423 T1029 Scheduled Transfer Exfiltration Higaisa no
424 T1027 Obfuscated Files or Information Defense Evasion APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Patchwork|APT37|Honeybee|menuPass|Leafminer|Cobalt Group|Threat Group-3390|Dark Caracal|APT19|FIN8|BlackOasis|MuddyWater|Elderwood|Leviathan|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28 Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|Machete|Soft Cell|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Cobalt Group|Patchwork|Leafminer|APT37|Threat Group-3390|Honeybee|Dark Caracal|menuPass|APT19|BlackOasis|FIN8|Leviathan|Elderwood|MuddyWater|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28
425 T1026 Multiband Communication Command And Control Lazarus Group
426 T1025 Data from Removable Media Collection Turla|Gamaredon Group|APT28 Machete|Turla|Gamaredon Group|APT28
427 T1021 Remote Services Lateral Movement no
428 T1020 Automated Exfiltration Exfiltration Sidewinder|Gamaredon Group|Tropic Trooper|Frankenstein|Honeybee Tropic Trooper|Frankenstein|Honeybee
429 T1018 Remote System Discovery Discovery APT29|UNC2452|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Dragonfly 2.0|Deep Panda|Threat Group-3390|Leafminer|Ke3chang|FIN8|FIN5|APT3|BRONZE BUTLER|menuPass|FIN6|Turla Sandworm Team|Rocke|Wizard Spider|Silence|Soft Cell|APT39|APT32|Deep Panda|Threat Group-3390|Dragonfly 2.0|Leafminer|Ke3chang|FIN8|APT3|FIN5|BRONZE BUTLER|menuPass|FIN6|Turla
430 T1016 System Network Configuration Discovery Discovery ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|OilRig|Magic Hound|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang Sandworm Team|Tropic Trooper|Frankenstein|APT41|Soft Cell|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang
431 T1014 Rootkit Defense Evasion Rocke|APT41|APT28|Winnti Group
432 T1012 Query Registry Discovery ZIRCONIUM|Chimera|Fox Kitten|APT39|Operation Wocao|APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla
433 T1011 Exfiltration Over Other Network Medium Exfiltration no
434 T1010 Application Window Discovery Discovery Lazarus Group
435 T1008 Fallback Channels Command And Control Carbanak|APT41|OilRig|Lazarus Group APT41|OilRig|Lazarus Group
436 T1007 System Service Discovery Discovery Chimera|Operation Wocao|BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang
437 T1006 Direct Volume Access Defense Evasion no
438 T1005 Data from Local System Collection APT29|Windigo|UNC2452|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Dragonfly 2.0|Dark Caracal|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|Soft Cell|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang
439 T1003 OS Credential Dumping Credential Access APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom
440 T1001 Data Obfuscation Command And Control Operation Wocao|Axiom Axiom
dist/escu/lookups/ransomware_extensions.csv
Vendored
+2 -1
View File
@@ -295,4 +295,5 @@ Extensions,Name
.TELEGRAM,Telegram
.FUSION,Fusion
.MILIHPEN,Milihpen
.GANGBANG,Gangbang
.GANGBANG,Gangbang
.reddot,RedDot
1 Extensions Name
295 .TELEGRAM Telegram
296 .FUSION Fusion
297 .MILIHPEN Milihpen
298 .GANGBANG Gangbang
299 .reddot RedDot
dist/saaws/app.manifest
Vendored
+1 -1
View File
@@ -5,7 +5,7 @@
"id": {
"group": null,
"name": "DA-ESS_AmazonWebServices_Content",
"version": "3.25.0"
"version": "3.25.1"
},
"author": [
{
dist/saaws/default/analytic_stories.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-07-02T15:45:19 UTC
# On Date: 2021-07-13T23:06:32 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/saaws/default/analyticstories.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-07-02T15:45:19 UTC
# On Date: 2021-07-13T23:06:32 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/saaws/default/app.conf
Vendored
+2 -2
View File
@@ -4,7 +4,7 @@
is_configured = false
state = enabled
state_change_requires_restart = false
build = 32560
build = 34075
[triggers]
reload.analytic_stories = simple
@@ -18,7 +18,7 @@ reload.content-version = simple
[launcher]
author = Splunk
version = 3.25.0
version = 3.25.1
description = Explore the Analytic Stories included with Splunk Security Analytics for AWS Content
[ui]
dist/saaws/default/collections.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-07-02T15:45:19 UTC
# On Date: 2021-07-13T23:06:32 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/saaws/default/content-version.conf
Vendored
+1 -1
View File
@@ -1,2 +1,2 @@
[content-version]
version = 3.25.0
version = 3.25.1
dist/saaws/default/macros.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-07-02T15:45:19 UTC
# On Date: 2021-07-13T23:06:32 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/saaws/default/savedsearches.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-07-02T15:45:19 UTC
# On Date: 2021-07-13T23:06:32 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/saaws/default/transforms.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-07-02T15:45:19 UTC
# On Date: 2021-07-13T23:06:32 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/saaws/default/use_case_library.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-07-02T15:45:19 UTC
# On Date: 2021-07-13T23:06:32 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/saaws/lookups/ransomware_extensions.csv
Vendored
+2 -1
View File
@@ -295,4 +295,5 @@ Extensions,Name
.TELEGRAM,Telegram
.FUSION,Fusion
.MILIHPEN,Milihpen
.GANGBANG,Gangbang
.GANGBANG,Gangbang
.reddot,RedDot
1 Extensions Name
295 .TELEGRAM Telegram
296 .FUSION Fusion
297 .MILIHPEN Milihpen
298 .GANGBANG Gangbang
299 .reddot RedDot
docs/detections.md
+1402 -18
View File
File diff suppressed because it is too large Load Diff
docs/detections.wiki
+1298 -19
View File
File diff suppressed because it is too large Load Diff
docs/mitre-map/coverage.csv
+23121 -18350
View File
File diff suppressed because it is too large Load Diff
docs/mitre-map/coverage.json
+10643 -7707
View File
File diff suppressed because it is too large Load Diff
docs/mitre-map/detections.csv
+15047 -11010
View File
File diff suppressed because it is too large Load Diff
docs/mitre-map/detections.json
+6900 -6166
View File
File diff suppressed because it is too large Load Diff
docs/stories.md
+75 -5
View File
@@ -1295,6 +1295,8 @@ Attackers are finding stealthy ways "live off the land," leveraging utilities an
* [Powershell Creating Thread Mutex](detections.md#powershell-creating-thread-mutex)
* [Powershell Enable SMB1Protocol Feature](detections.md#powershell-enable-smb1protocol-feature)
* [Powershell Fileless Process Injection via GetProcAddress](detections.md#powershell-fileless-process-injection-via-getprocaddress)
* [Powershell Fileless Script Contains Base64 Encoded Content](detections.md#powershell-fileless-script-contains-base64-encoded-content)
@@ -4162,7 +4164,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: Endpoint
- **ATT&CK**: [T1003.002](https://attack.mitre.org/techniques/T1003.002/), [T1070.001](https://attack.mitre.org/techniques/T1070.001/), [T1204](https://attack.mitre.org/techniques/T1204/), [T1485](https://attack.mitre.org/techniques/T1485/), [T1486](https://attack.mitre.org/techniques/T1486/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1543](https://attack.mitre.org/techniques/T1543/), [T1569.001](https://attack.mitre.org/techniques/T1569.001/), [T1569.002](https://attack.mitre.org/techniques/T1569.002/)
- **ATT&CK**: [T1003.002](https://attack.mitre.org/techniques/T1003.002/), [T1070.001](https://attack.mitre.org/techniques/T1070.001/), [T1204](https://attack.mitre.org/techniques/T1204/), [T1485](https://attack.mitre.org/techniques/T1485/), [T1486](https://attack.mitre.org/techniques/T1486/), [T1489](https://attack.mitre.org/techniques/T1489/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1543](https://attack.mitre.org/techniques/T1543/), [T1569.001](https://attack.mitre.org/techniques/T1569.001/), [T1569.002](https://attack.mitre.org/techniques/T1569.002/)
- **Last Updated**: 2021-03-17
<details>
@@ -4192,6 +4194,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
* [Resize ShadowStorage volume](detections.md#resize-shadowstorage-volume)
* [Resize Shadowstorage Volume](detections.md#resize-shadowstorage-volume)
* [Suspicious Event Log Service Behavior](detections.md#suspicious-event-log-service-behavior)
* [Suspicious wevtutil Usage](detections.md#suspicious-wevtutil-usage)
@@ -4213,6 +4217,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
| T1490 | Inhibit System Recovery | Impact |
| T1486 | Data Encrypted for Impact | Impact |
| T1003.002 | Security Account Manager | Credential Access |
| T1489 | Service Stop | Impact |
| T1070.001 | Clear Windows Event Logs | Defense Evasion |
#### Kill Chain Phase
@@ -4693,7 +4698,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: Endpoint, Network_Traffic
- **ATT&CK**: [T1020](https://attack.mitre.org/techniques/T1020/), [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1036.003](https://attack.mitre.org/techniques/T1036.003/), [T1047](https://attack.mitre.org/techniques/T1047/), [T1048](https://attack.mitre.org/techniques/T1048/), [T1053.005](https://attack.mitre.org/techniques/T1053.005/), [T1069.001](https://attack.mitre.org/techniques/T1069.001/), [T1069.002](https://attack.mitre.org/techniques/T1069.002/), [T1070](https://attack.mitre.org/techniques/T1070/), [T1070.001](https://attack.mitre.org/techniques/T1070.001/), [T1070.004](https://attack.mitre.org/techniques/T1070.004/), [T1071.001](https://attack.mitre.org/techniques/T1071.001/), [T1087.001](https://attack.mitre.org/techniques/T1087.001/), [T1087.002](https://attack.mitre.org/techniques/T1087.002/), [T1112](https://attack.mitre.org/techniques/T1112/), [T1204](https://attack.mitre.org/techniques/T1204/), [T1218.003](https://attack.mitre.org/techniques/T1218.003/), [T1222](https://attack.mitre.org/techniques/T1222/), [T1482](https://attack.mitre.org/techniques/T1482/), [T1485](https://attack.mitre.org/techniques/T1485/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1491](https://attack.mitre.org/techniques/T1491/), [T1547.001](https://attack.mitre.org/techniques/T1547.001/), [T1548](https://attack.mitre.org/techniques/T1548/), [T1592](https://attack.mitre.org/techniques/T1592/)
- **ATT&CK**: [T1020](https://attack.mitre.org/techniques/T1020/), [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1027.005](https://attack.mitre.org/techniques/T1027.005/), [T1036.003](https://attack.mitre.org/techniques/T1036.003/), [T1047](https://attack.mitre.org/techniques/T1047/), [T1048](https://attack.mitre.org/techniques/T1048/), [T1053.005](https://attack.mitre.org/techniques/T1053.005/), [T1059.005](https://attack.mitre.org/techniques/T1059.005/), [T1069.001](https://attack.mitre.org/techniques/T1069.001/), [T1069.002](https://attack.mitre.org/techniques/T1069.002/), [T1070](https://attack.mitre.org/techniques/T1070/), [T1070.001](https://attack.mitre.org/techniques/T1070.001/), [T1070.004](https://attack.mitre.org/techniques/T1070.004/), [T1071.001](https://attack.mitre.org/techniques/T1071.001/), [T1087.001](https://attack.mitre.org/techniques/T1087.001/), [T1087.002](https://attack.mitre.org/techniques/T1087.002/), [T1112](https://attack.mitre.org/techniques/T1112/), [T1204](https://attack.mitre.org/techniques/T1204/), [T1218.003](https://attack.mitre.org/techniques/T1218.003/), [T1222](https://attack.mitre.org/techniques/T1222/), [T1482](https://attack.mitre.org/techniques/T1482/), [T1485](https://attack.mitre.org/techniques/T1485/), [T1489](https://attack.mitre.org/techniques/T1489/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1491](https://attack.mitre.org/techniques/T1491/), [T1531](https://attack.mitre.org/techniques/T1531/), [T1547.001](https://attack.mitre.org/techniques/T1547.001/), [T1548](https://attack.mitre.org/techniques/T1548/), [T1562.001](https://attack.mitre.org/techniques/T1562.001/), [T1562.007](https://attack.mitre.org/techniques/T1562.007/), [T1569.002](https://attack.mitre.org/techniques/T1569.002/), [T1574.002](https://attack.mitre.org/techniques/T1574.002/), [T1592](https://attack.mitre.org/techniques/T1592/)
- **Last Updated**: 2020-02-04
<details>
@@ -4701,8 +4706,16 @@ Leverage searches that allow you to detect and investigate unusual activities th
#### Detection Profile
* [Allow File And Printing Sharing In Firewall](detections.md#allow-file-and-printing-sharing-in-firewall)
* [Allow Network Discovery In Firewall](detections.md#allow-network-discovery-in-firewall)
* [Allow Operation with Consent Admin](detections.md#allow-operation-with-consent-admin)
* [Attempt To Disable Services](detections.md#attempt-to-disable-services)
* [Attempt To delete Services](detections.md#attempt-to-delete-services)
* [BCDEdit Failure Recovery Modification](detections.md#bcdedit-failure-recovery-modification)
* [CMLUA Or CMSTPLUA UAC Bypass](detections.md#cmlua-or-cmstplua-uac-bypass)
@@ -4715,6 +4728,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
* [Conti Common Exec parameter](detections.md#conti-common-exec-parameter)
* [Delete A Net User](detections.md#delete-a-net-user)
* [Delete ShadowCopy With PowerShell](detections.md#delete-shadowcopy-with-powershell)
* [Deleting Shadow Copies](detections.md#deleting-shadow-copies)
@@ -4729,24 +4744,52 @@ Leverage searches that allow you to detect and investigate unusual activities th
* [Detect SharpHound Usage](detections.md#detect-sharphound-usage)
* [Disable AMSI Through Registry](detections.md#disable-amsi-through-registry)
* [Disable ETW Through Registry](detections.md#disable-etw-through-registry)
* [Disable Logs Using WevtUtil](detections.md#disable-logs-using-wevtutil)
* [Disable Net User Account](detections.md#disable-net-user-account)
* [Disable Windows Behavior Monitoring](detections.md#disable-windows-behavior-monitoring)
* [Excessive Service Stop Attempt](detections.md#excessive-service-stop-attempt)
* [Excessive Usage Of Net App](detections.md#excessive-usage-of-net-app)
* [Excessive Usage Of SC Service Utility](detections.md#excessive-usage-of-sc-service-utility)
* [Execute Javascript With Jscript COM CLSID](detections.md#execute-javascript-with-jscript-com-clsid)
* [ICACLS Grant Command](detections.md#icacls-grant-command)
* [Known Services Killed by Ransomware](detections.md#known-services-killed-by-ransomware)
* [Modification Of Wallpaper](detections.md#modification-of-wallpaper)
* [Msmpeng Application DLL Side Loading](detections.md#msmpeng-application-dll-side-loading)
* [Permission Modification using Takeown App](detections.md#permission-modification-using-takeown-app)
* [Powershell Disable Security Monitoring](detections.md#powershell-disable-security-monitoring)
* [Powershell Enable SMB1Protocol Feature](detections.md#powershell-enable-smb1protocol-feature)
* [Prevent Automatic Repair Mode using Bcdedit](detections.md#prevent-automatic-repair-mode-using-bcdedit)
* [Prohibited Network Traffic Allowed](detections.md#prohibited-network-traffic-allowed)
* [Recon AVProduct Through Pwh or WMI](detections.md#recon-avproduct-through-pwh-or-wmi)
* [Recursive Delete of Directory In Batch CMD](detections.md#recursive-delete-of-directory-in-batch-cmd)
* [Registry Keys Used For Persistence](detections.md#registry-keys-used-for-persistence)
* [Remote Process Instantiation via WMI](detections.md#remote-process-instantiation-via-wmi)
* [Resize Shadowstorage Volume](detections.md#resize-shadowstorage-volume)
* [Revil Common Exec Parameter](detections.md#revil-common-exec-parameter)
* [Revil Registry Entry](detections.md#revil-registry-entry)
@@ -4796,7 +4839,9 @@ Leverage searches that allow you to detect and investigate unusual activities th
| ID | Technique | Tactic |
| ----------- | ----------- |--------------|
| T1562.007 | Disable or Modify Cloud Firewall | Defense Evasion |
| T1548 | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion |
| T1489 | Service Stop | Impact |
| T1490 | Inhibit System Recovery | Impact |
| T1218.003 | CMSTP | Defense Evasion |
| T1070.004 | File Deletion | Defense Evasion |
@@ -4808,9 +4853,15 @@ Leverage searches that allow you to detect and investigate unusual activities th
| T1482 | Domain Trust Discovery | Discovery |
| T1069.002 | Domain Groups | Discovery |
| T1069.001 | Local Groups | Discovery |
| T1562.001 | Disable or Modify Tools | Defense Evasion |
| T1070.001 | Clear Windows Event Logs | Defense Evasion |
| T1491 | Defacement | Impact |
| T1531 | Account Access Removal | Impact |
| T1569.002 | Service Execution | Execution |
| T1059.005 | Visual Basic | Execution |
| T1222 | File and Directory Permissions Modification | Defense Evasion |
| T1491 | Defacement | Impact |
| T1574.002 | DLL Side-Loading | Persistence, Privilege Escalation, Defense Evasion |
| T1027.005 | Indicator Removal from Tools | Defense Evasion |
| T1048 | Exfiltration Over Alternative Protocol | Exfiltration |
| T1592 | Gather Victim Host Information | Reconnaissance |
| T1547.001 | Registry Run Keys / Startup Folder | Persistence, Privilege Escalation |
@@ -4897,7 +4948,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: Endpoint
- **ATT&CK**: [T1112](https://attack.mitre.org/techniques/T1112/), [T1204](https://attack.mitre.org/techniques/T1204/), [T1218.003](https://attack.mitre.org/techniques/T1218.003/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1491](https://attack.mitre.org/techniques/T1491/)
- **ATT&CK**: [T1112](https://attack.mitre.org/techniques/T1112/), [T1204](https://attack.mitre.org/techniques/T1204/), [T1218.003](https://attack.mitre.org/techniques/T1218.003/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1491](https://attack.mitre.org/techniques/T1491/), [T1562.001](https://attack.mitre.org/techniques/T1562.001/), [T1562.007](https://attack.mitre.org/techniques/T1562.007/), [T1574.002](https://attack.mitre.org/techniques/T1574.002/)
- **Last Updated**: 2021-06-04
<details>
@@ -4905,10 +4956,18 @@ Leverage searches that allow you to detect and investigate unusual activities th
#### Detection Profile
* [Allow Network Discovery In Firewall](detections.md#allow-network-discovery-in-firewall)
* [Delete ShadowCopy With PowerShell](detections.md#delete-shadowcopy-with-powershell)
* [Disable Windows Behavior Monitoring](detections.md#disable-windows-behavior-monitoring)
* [Modification Of Wallpaper](detections.md#modification-of-wallpaper)
* [Msmpeng Application DLL Side Loading](detections.md#msmpeng-application-dll-side-loading)
* [Powershell Disable Security Monitoring](detections.md#powershell-disable-security-monitoring)
* [Revil Common Exec Parameter](detections.md#revil-common-exec-parameter)
* [Revil Registry Entry](detections.md#revil-registry-entry)
@@ -4920,8 +4979,11 @@ Leverage searches that allow you to detect and investigate unusual activities th
| ID | Technique | Tactic |
| ----------- | ----------- |--------------|
| T1562.007 | Disable or Modify Cloud Firewall | Defense Evasion |
| T1490 | Inhibit System Recovery | Impact |
| T1562.001 | Disable or Modify Tools | Defense Evasion |
| T1491 | Defacement | Impact |
| T1574.002 | DLL Side-Loading | Persistence, Privilege Escalation, Defense Evasion |
| T1204 | User Execution | Execution |
| T1112 | Modify Registry | Defense Evasion |
| T1218.003 | CMSTP | Defense Evasion |
@@ -5391,10 +5453,18 @@ Leverage searches that allow you to detect and investigate unusual activities th
#### Detection Profile
* [Attempt To Disable Services](detections.md#attempt-to-disable-services)
* [Attempt To delete Services](detections.md#attempt-to-delete-services)
* [Delete A Net User](detections.md#delete-a-net-user)
* [Deleting Of Net Users](detections.md#deleting-of-net-users)
* [Deny Permission using Cacls Utility](detections.md#deny-permission-using-cacls-utility)
* [Disable Net User Account](detections.md#disable-net-user-account)
* [Disable Windows App Hotkeys](detections.md#disable-windows-app-hotkeys)
* [Disabling Net User Account](detections.md#disabling-net-user-account)
@@ -5442,12 +5512,12 @@ Leverage searches that allow you to detect and investigate unusual activities th
| ID | Technique | Tactic |
| ----------- | ----------- |--------------|
| T1489 | Service Stop | Impact |
| T1531 | Account Access Removal | Impact |
| T1222 | File and Directory Permissions Modification | Defense Evasion |
| T1562.001 | Disable or Modify Tools | Defense Evasion |
| T1105 | Ingress Tool Transfer | Command And Control |
| T1087 | Account Discovery | Discovery |
| T1489 | Service Stop | Impact |
| T1036 | Masquerading | Defense Evasion |
| T1053 | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
| T1543.003 | Windows Service | Persistence, Privilege Escalation |
docs/stories.wiki
+117 -11
View File
@@ -1744,6 +1744,8 @@ Attackers are finding stealthy ways "live off the land," leveraging utilities an
* [[Documentation:ESSOC:detections:Detections#Powershell_creating_thread_mutex|Powershell Creating Thread Mutex]]
* [[Documentation:ESSOC:detections:Detections#Powershell_enable_smb1protocol_feature|Powershell Enable SMB1Protocol Feature]]
* [[Documentation:ESSOC:detections:Detections#Powershell_fileless_process_injection_via_getprocaddress|Powershell Fileless Process Injection via GetProcAddress]]
* [[Documentation:ESSOC:detections:Detections#Powershell_fileless_script_contains_base64_encoded_content|Powershell Fileless Script Contains Base64 Encoded Content]]
@@ -5468,7 +5470,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/ T1204], [https://attack.mitre.org/techniques/T1543/ T1543], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1569.001/ T1569.001], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1003.002/ T1003.002], [https://attack.mitre.org/techniques/T1070.001/ T1070.001]
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/ T1204], [https://attack.mitre.org/techniques/T1543/ T1543], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1569.001/ T1569.001], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1003.002/ T1003.002], [https://attack.mitre.org/techniques/T1489/ T1489], [https://attack.mitre.org/techniques/T1070.001/ T1070.001]
* '''Last Updated''': 2021-03-17
<div class="toccolours mw-collapsible mw-collapsed">
@@ -5498,6 +5500,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
* [[Documentation:ESSOC:detections:Detections#Resize_shadowstorage_volume|Resize ShadowStorage volume]]
* [[Documentation:ESSOC:detections:Detections#Resize_shadowstorage_volume|Resize Shadowstorage Volume]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_event_log_service_behavior|Suspicious Event Log Service Behavior]]
* [[Documentation:ESSOC:detections:Detections#Suspicious_wevtutil_usage|Suspicious wevtutil Usage]]
@@ -5546,6 +5550,10 @@ Leverage searches that allow you to detect and investigate unusual activities th
| Security Account Manager
| Credential Access
|-
| T1489
| Service Stop
| Impact
|-
| T1070.001
| Clear Windows Event Logs
| Defense Evasion
@@ -6209,7 +6217,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint, Network_Traffic
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1218.003/ T1218.003], [https://attack.mitre.org/techniques/T1070.004/ T1070.004], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1204/ T1204], [https://attack.mitre.org/techniques/T1020/ T1020], [https://attack.mitre.org/techniques/T1087.002/ T1087.002], [https://attack.mitre.org/techniques/T1087.001/ T1087.001], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1069.002/ T1069.002], [https://attack.mitre.org/techniques/T1069.001/ T1069.001], [https://attack.mitre.org/techniques/T1070.001/ T1070.001], [https://attack.mitre.org/techniques/T1491/ T1491], [https://attack.mitre.org/techniques/T1222/ T1222], [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1592/ T1592], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1047/ T1047], [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001], [https://attack.mitre.org/techniques/T1070/ T1070]
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.007/ T1562.007], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1489/ T1489], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1218.003/ T1218.003], [https://attack.mitre.org/techniques/T1070.004/ T1070.004], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1204/ T1204], [https://attack.mitre.org/techniques/T1020/ T1020], [https://attack.mitre.org/techniques/T1087.002/ T1087.002], [https://attack.mitre.org/techniques/T1087.001/ T1087.001], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1069.002/ T1069.002], [https://attack.mitre.org/techniques/T1069.001/ T1069.001], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1070.001/ T1070.001], [https://attack.mitre.org/techniques/T1531/ T1531], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1059.005/ T1059.005], [https://attack.mitre.org/techniques/T1222/ T1222], [https://attack.mitre.org/techniques/T1491/ T1491], [https://attack.mitre.org/techniques/T1574.002/ T1574.002], [https://attack.mitre.org/techniques/T1027.005/ T1027.005], [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1592/ T1592], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1047/ T1047], [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001], [https://attack.mitre.org/techniques/T1070/ T1070]
* '''Last Updated''': 2020-02-04
<div class="toccolours mw-collapsible mw-collapsed">
@@ -6217,8 +6225,16 @@ Leverage searches that allow you to detect and investigate unusual activities th
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Allow_file_and_printing_sharing_in_firewall|Allow File And Printing Sharing In Firewall]]
* [[Documentation:ESSOC:detections:Detections#Allow_network_discovery_in_firewall|Allow Network Discovery In Firewall]]
* [[Documentation:ESSOC:detections:Detections#Allow_operation_with_consent_admin|Allow Operation with Consent Admin]]
* [[Documentation:ESSOC:detections:Detections#Attempt_to_disable_services|Attempt To Disable Services]]
* [[Documentation:ESSOC:detections:Detections#Attempt_to_delete_services|Attempt To delete Services]]
* [[Documentation:ESSOC:detections:Detections#Bcdedit_failure_recovery_modification|BCDEdit Failure Recovery Modification]]
* [[Documentation:ESSOC:detections:Detections#Cmlua_or_cmstplua_uac_bypass|CMLUA Or CMSTPLUA UAC Bypass]]
@@ -6231,6 +6247,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
* [[Documentation:ESSOC:detections:Detections#Conti_common_exec_parameter|Conti Common Exec parameter]]
* [[Documentation:ESSOC:detections:Detections#Delete_a_net_user|Delete A Net User]]
* [[Documentation:ESSOC:detections:Detections#Delete_shadowcopy_with_powershell|Delete ShadowCopy With PowerShell]]
* [[Documentation:ESSOC:detections:Detections#Deleting_shadow_copies|Deleting Shadow Copies]]
@@ -6245,24 +6263,52 @@ Leverage searches that allow you to detect and investigate unusual activities th
* [[Documentation:ESSOC:detections:Detections#Detect_sharphound_usage|Detect SharpHound Usage]]
* [[Documentation:ESSOC:detections:Detections#Disable_amsi_through_registry|Disable AMSI Through Registry]]
* [[Documentation:ESSOC:detections:Detections#Disable_etw_through_registry|Disable ETW Through Registry]]
* [[Documentation:ESSOC:detections:Detections#Disable_logs_using_wevtutil|Disable Logs Using WevtUtil]]
* [[Documentation:ESSOC:detections:Detections#Disable_net_user_account|Disable Net User Account]]
* [[Documentation:ESSOC:detections:Detections#Disable_windows_behavior_monitoring|Disable Windows Behavior Monitoring]]
* [[Documentation:ESSOC:detections:Detections#Excessive_service_stop_attempt|Excessive Service Stop Attempt]]
* [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_net_app|Excessive Usage Of Net App]]
* [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_sc_service_utility|Excessive Usage Of SC Service Utility]]
* [[Documentation:ESSOC:detections:Detections#Execute_javascript_with_jscript_com_clsid|Execute Javascript With Jscript COM CLSID]]
* [[Documentation:ESSOC:detections:Detections#Icacls_grant_command|ICACLS Grant Command]]
* [[Documentation:ESSOC:detections:Detections#Known_services_killed_by_ransomware|Known Services Killed by Ransomware]]
* [[Documentation:ESSOC:detections:Detections#Modification_of_wallpaper|Modification Of Wallpaper]]
* [[Documentation:ESSOC:detections:Detections#Msmpeng_application_dll_side_loading|Msmpeng Application DLL Side Loading]]
* [[Documentation:ESSOC:detections:Detections#Permission_modification_using_takeown_app|Permission Modification using Takeown App]]
* [[Documentation:ESSOC:detections:Detections#Powershell_disable_security_monitoring|Powershell Disable Security Monitoring]]
* [[Documentation:ESSOC:detections:Detections#Powershell_enable_smb1protocol_feature|Powershell Enable SMB1Protocol Feature]]
* [[Documentation:ESSOC:detections:Detections#Prevent_automatic_repair_mode_using_bcdedit|Prevent Automatic Repair Mode using Bcdedit]]
* [[Documentation:ESSOC:detections:Detections#Prohibited_network_traffic_allowed|Prohibited Network Traffic Allowed]]
* [[Documentation:ESSOC:detections:Detections#Recon_avproduct_through_pwh_or_wmi|Recon AVProduct Through Pwh or WMI]]
* [[Documentation:ESSOC:detections:Detections#Recursive_delete_of_directory_in_batch_cmd|Recursive Delete of Directory In Batch CMD]]
* [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
* [[Documentation:ESSOC:detections:Detections#Remote_process_instantiation_via_wmi|Remote Process Instantiation via WMI]]
* [[Documentation:ESSOC:detections:Detections#Resize_shadowstorage_volume|Resize Shadowstorage Volume]]
* [[Documentation:ESSOC:detections:Detections#Revil_common_exec_parameter|Revil Common Exec Parameter]]
* [[Documentation:ESSOC:detections:Detections#Revil_registry_entry|Revil Registry Entry]]
@@ -6315,10 +6361,18 @@ Leverage searches that allow you to detect and investigate unusual activities th
! Technique
! Tactic
|-
| T1562.007
| Disable or Modify Cloud Firewall
| Defense Evasion
|-
| T1548
| Abuse Elevation Control Mechanism
| Privilege Escalation, Defense Evasion
|-
| T1489
| Service Stop
| Impact
|-
| T1490
| Inhibit System Recovery
| Impact
@@ -6363,16 +6417,40 @@ Leverage searches that allow you to detect and investigate unusual activities th
| Local Groups
| Discovery
|-
| T1562.001
| Disable or Modify Tools
| Defense Evasion
|-
| T1070.001
| Clear Windows Event Logs
| Defense Evasion
|-
| T1531
| Account Access Removal
| Impact
|-
| T1569.002
| Service Execution
| Execution
|-
| T1059.005
| Visual Basic
| Execution
|-
| T1222
| File and Directory Permissions Modification
| Defense Evasion
|-
| T1491
| Defacement
| Impact
|-
| T1222
| File and Directory Permissions Modification
| T1574.002
| DLL Side-Loading
| Persistence, Privilege Escalation, Defense Evasion
|-
| T1027.005
| Indicator Removal from Tools
| Defense Evasion
|-
| T1048
@@ -6501,7 +6579,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1491/ T1491], [https://attack.mitre.org/techniques/T1204/ T1204], [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1218.003/ T1218.003]
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.007/ T1562.007], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1491/ T1491], [https://attack.mitre.org/techniques/T1574.002/ T1574.002], [https://attack.mitre.org/techniques/T1204/ T1204], [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1218.003/ T1218.003]
* '''Last Updated''': 2021-06-04
<div class="toccolours mw-collapsible mw-collapsed">
@@ -6509,10 +6587,18 @@ Leverage searches that allow you to detect and investigate unusual activities th
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Allow_network_discovery_in_firewall|Allow Network Discovery In Firewall]]
* [[Documentation:ESSOC:detections:Detections#Delete_shadowcopy_with_powershell|Delete ShadowCopy With PowerShell]]
* [[Documentation:ESSOC:detections:Detections#Disable_windows_behavior_monitoring|Disable Windows Behavior Monitoring]]
* [[Documentation:ESSOC:detections:Detections#Modification_of_wallpaper|Modification Of Wallpaper]]
* [[Documentation:ESSOC:detections:Detections#Msmpeng_application_dll_side_loading|Msmpeng Application DLL Side Loading]]
* [[Documentation:ESSOC:detections:Detections#Powershell_disable_security_monitoring|Powershell Disable Security Monitoring]]
* [[Documentation:ESSOC:detections:Detections#Revil_common_exec_parameter|Revil Common Exec Parameter]]
* [[Documentation:ESSOC:detections:Detections#Revil_registry_entry|Revil Registry Entry]]
@@ -6527,14 +6613,26 @@ Leverage searches that allow you to detect and investigate unusual activities th
! Technique
! Tactic
|-
| T1562.007
| Disable or Modify Cloud Firewall
| Defense Evasion
|-
| T1490
| Inhibit System Recovery
| Impact
|-
| T1562.001
| Disable or Modify Tools
| Defense Evasion
|-
| T1491
| Defacement
| Impact
|-
| T1574.002
| DLL Side-Loading
| Persistence, Privilege Escalation, Defense Evasion
|-
| T1204
| User Execution
| Execution
@@ -7184,7 +7282,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
* '''Datamodel''': Endpoint
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1531/ T1531], [https://attack.mitre.org/techniques/T1222/ T1222], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1105/ T1105], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1489/ T1489], [https://attack.mitre.org/techniques/T1036/ T1036], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1543.003/ T1543.003], [https://attack.mitre.org/techniques/T1543/ T1543]
* '''ATT&CK''': [https://attack.mitre.org/techniques/T1489/ T1489], [https://attack.mitre.org/techniques/T1531/ T1531], [https://attack.mitre.org/techniques/T1222/ T1222], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1105/ T1105], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1036/ T1036], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1543.003/ T1543.003], [https://attack.mitre.org/techniques/T1543/ T1543]
* '''Last Updated''': 2021-05-07
<div class="toccolours mw-collapsible mw-collapsed">
@@ -7192,10 +7290,18 @@ Leverage searches that allow you to detect and investigate unusual activities th
====Detection Profile====
* [[Documentation:ESSOC:detections:Detections#Attempt_to_disable_services|Attempt To Disable Services]]
* [[Documentation:ESSOC:detections:Detections#Attempt_to_delete_services|Attempt To delete Services]]
* [[Documentation:ESSOC:detections:Detections#Delete_a_net_user|Delete A Net User]]
* [[Documentation:ESSOC:detections:Detections#Deleting_of_net_users|Deleting Of Net Users]]
* [[Documentation:ESSOC:detections:Detections#Deny_permission_using_cacls_utility|Deny Permission using Cacls Utility]]
* [[Documentation:ESSOC:detections:Detections#Disable_net_user_account|Disable Net User Account]]
* [[Documentation:ESSOC:detections:Detections#Disable_windows_app_hotkeys|Disable Windows App Hotkeys]]
* [[Documentation:ESSOC:detections:Detections#Disabling_net_user_account|Disabling Net User Account]]
@@ -7246,6 +7352,10 @@ Leverage searches that allow you to detect and investigate unusual activities th
! Technique
! Tactic
|-
| T1489
| Service Stop
| Impact
|-
| T1531
| Account Access Removal
| Impact
@@ -7266,10 +7376,6 @@ Leverage searches that allow you to detect and investigate unusual activities th
| Account Discovery
| Discovery
|-
| T1489
| Service Stop
| Impact
|-
| T1036
| Masquerading
| Defense Evasion
@@ -7423,7 +7529,7 @@ In March of 2016, adversaries were seen using JexBoss--an open-source utility us
<pre>
#############
# Automatically generated by doc_gen.py in https://github.com/splunk/security_content
# On Date: 2021-07-02 15:57:11.500371 UTC
# On Date: 2021-07-13 23:18:20.194549 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############