admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-03-30 05:12:06 -07:00
committed by GitHub
parent b398dce03d be64c00111
commit c20c7242b8
367 changed files with 1084 additions and 993 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/contentctl_project/contentctl_infrastructure/adapter/conf_writer.py
+6
View File
@@ -20,6 +20,12 @@ class ConfWriter():
f.write(output)
@staticmethod
def writeConfFileHeaderEmpty(output_path : str) -> None:
with open(output_path, 'w') as f:
f.write('')
@staticmethod
def writeConfFile(template_name : str, output_path : str, objects : list) -> None:
bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_conf_adapter.py
+2 -2
View File
@@ -59,8 +59,8 @@ class ObjToConfAdapter(Adapter):
workbench_panels.append(investigation)
investigation.search = investigation.search.replace(">",">")
investigation.search = investigation.search.replace("<","&lt;")
# ConfWriter.writeConfFileHeader(os.path.join(output_path,
# 'default/data/ui/panels/', str("workbench_panel_" + response_file_name_xml)))
ConfWriter.writeConfFileHeaderEmpty(os.path.join(output_path,
'default/data/ui/panels/', str("workbench_panel_" + response_file_name_xml)))
ConfWriter.writeConfFile('panel.j2',
os.path.join(output_path,
'default/data/ui/panels/', str("workbench_panel_" + response_file_name_xml)),
bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2020-12-25T17:05:55 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2020-12-25T17:05:55 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/mitre_enrichment.csv
+372 -249
View File
@@ -1,59 +1,197 @@
mitre_id,technique,tactics,groups
T1205.001,Port Knocking,Defense Evasion|Persistence|Command And Control,no
T1564.009,Resource Forking,Defense Evasion,no
T1562.010,Downgrade Attack,Defense Evasion,no
T1547.015,Login Items,Persistence|Privilege Escalation,no
T1620,Reflective Code Loading,Defense Evasion,no
T1619,Cloud Storage Object Discovery,Discovery,no
T1218.014,MMC,Defense Evasion,no
T1218.013,Mavinject,Defense Evasion,no
T1614.001,System Language Discovery,Discovery,no
T1615,Group Policy Discovery,Discovery,Turla
T1036.007,Double File Extension,Defense Evasion,Mustang Panda
T1562.009,Safe Mode Boot,Defense Evasion,no
T1564.008,Email Hiding Rules,Defense Evasion,FIN4
T1505.004,IIS Components,Persistence,no
T1027.006,HTML Smuggling,Defense Evasion,no
T1213.003,Code Repositories,Collection,APT29
T1553.006,Code Signing Policy Modification,Defense Evasion,Turla|APT39
T1614,System Location Discovery,Discovery,no
T1613,Container and Resource Discovery,Discovery,TeamTNT
T1552.007,Container API,Credential Access,no
T1612,Build Image on Host,Defense Evasion,no
T1611,Escape to Host,Privilege Escalation,TeamTNT
T1204.003,Malicious Image,Execution,TeamTNT
T1053.007,Container Orchestration Job,Execution|Persistence|Privilege Escalation,no
T1610,Deploy Container,Defense Evasion|Execution,TeamTNT
T1609,Container Administration Command,Execution,TeamTNT
T1608.005,Link Target,Resource Development,Silent Librarian
T1608.004,Drive-by Target,Resource Development,Transparent Tribe|APT32|Threat Group-3390
T1608.003,Install Digital Certificate,Resource Development,no
T1608.002,Upload Tool,Resource Development,Threat Group-3390
T1608.001,Upload Malware,Resource Development,TeamTNT|APT32
T1608,Stage Capabilities,Resource Development,no
T1016.001,Internet Connection Discovery,Discovery,APT29|UNC2452|Turla
T1553.005,Mark-of-the-Web Bypass,Defense Evasion,TA505
T1555.005,Password Managers,Credential Access,Fox Kitten|Operation Wocao
T1484.002,Domain Trust Modification,Defense Evasion|Privilege Escalation,APT29|UNC2452
T1484.001,Group Policy Modification,Defense Evasion|Privilege Escalation,Indrik Spider
T1547.014,Active Setup,Persistence|Privilege Escalation,no
T1606.002,SAML Tokens,Credential Access,APT29|UNC2452
T1606.001,Web Cookies,Credential Access,APT29|UNC2452
T1606,Forge Web Credentials,Credential Access,no
T1555.004,Windows Credential Manager,Credential Access,Stealth Falcon|OilRig|Turla
T1059.008,Network Device CLI,Execution,no
T1602.002,Network Device Configuration Dump,Collection,no
T1542.005,TFTP Boot,Defense Evasion|Persistence,no
T1542.004,ROMMONkit,Defense Evasion|Persistence,no
T1602.001,SNMP (MIB Dump),Collection,no
T1602,Data from Configuration Repository,Collection,no
T1601.002,Downgrade System Image,Defense Evasion,no
T1601.001,Patch System Image,Defense Evasion,no
T1601,Modify System Image,Defense Evasion,no
T1600.002,Disable Crypto Hardware,Defense Evasion,no
T1600.001,Reduce Key Space,Defense Evasion,no
T1600,Weaken Encryption,Defense Evasion,no
T1556.004,Network Device Authentication,Credential Access|Defense Evasion|Persistence,no
T1599.001,Network Address Translation Traversal,Defense Evasion,no
T1599,Network Boundary Bridging,Defense Evasion,no
T1020.001,Traffic Duplication,Exfiltration,no
T1557.002,ARP Cache Poisoning,Credential Access|Collection,Cleaver
T1588.006,Vulnerabilities,Resource Development,Sandworm Team
T1053.006,Systemd Timers,Execution|Persistence|Privilege Escalation,no
T1562.008,Disable Cloud Logs,Defense Evasion,no
T1547.012,Print Processors,Persistence|Privilege Escalation,no
T1598.003,Spearphishing Link,Reconnaissance,Magic Hound|Silent Librarian|Sidewinder|Sandworm Team|APT32|Kimsuky
T1598.002,Spearphishing Attachment,Reconnaissance,Sidewinder
T1598.001,Spearphishing Service,Reconnaissance,no
T1598,Phishing for Information,Reconnaissance,ZIRCONIUM|APT28
T1597.002,Purchase Technical Data,Reconnaissance,no
T1597.001,Threat Intel Vendors,Reconnaissance,no
T1597,Search Closed Sources,Reconnaissance,no
T1596.005,Scan Databases,Reconnaissance,no
T1596.004,CDNs,Reconnaissance,no
T1596.003,Digital Certificates,Reconnaissance,no
T1596.001,DNS/Passive DNS,Reconnaissance,no
T1596.002,WHOIS,Reconnaissance,no
T1596,Search Open Technical Databases,Reconnaissance,no
T1595.002,Vulnerability Scanning,Reconnaissance,TeamTNT|APT29|Volatile Cedar|APT28|Sandworm Team
T1595.001,Scanning IP Blocks,Reconnaissance,TeamTNT
T1595,Active Scanning,Reconnaissance,no
T1594,Search Victim-Owned Websites,Reconnaissance,Silent Librarian|Sandworm Team
T1593.002,Search Engines,Reconnaissance,no
T1593.001,Social Media,Reconnaissance,Kimsuky
T1593,Search Open Websites/Domains,Reconnaissance,Sandworm Team
T1592.004,Client Configurations,Reconnaissance,HAFNIUM
T1592.003,Firmware,Reconnaissance,no
T1592.002,Software,Reconnaissance,Andariel|Sandworm Team
T1592.001,Hardware,Reconnaissance,no
T1592,Gather Victim Host Information,Reconnaissance,no
T1591.004,Identify Roles,Reconnaissance,no
T1591.003,Identify Business Tempo,Reconnaissance,no
T1591.001,Determine Physical Locations,Reconnaissance,no
T1591.002,Business Relationships,Reconnaissance,Sandworm Team
T1591,Gather Victim Org Information,Reconnaissance,no
T1590.006,Network Security Appliances,Reconnaissance,no
T1590.005,IP Addresses,Reconnaissance,Andariel|HAFNIUM
T1590.004,Network Topology,Reconnaissance,no
T1590.003,Network Trust Dependencies,Reconnaissance,no
T1590.002,DNS,Reconnaissance,no
T1590.001,Domain Properties,Reconnaissance,Sandworm Team
T1590,Gather Victim Network Information,Reconnaissance,HAFNIUM
T1589.003,Employee Names,Reconnaissance,Silent Librarian|Sandworm Team
T1589.002,Email Addresses,Reconnaissance,Kimsuky|Magic Hound|TA551|MuddyWater|HAFNIUM|APT32|Silent Librarian|Sandworm Team
T1589.001,Credentials,Reconnaissance,Leviathan|APT28|Magic Hound|Chimera
T1589,Gather Victim Identity Information,Reconnaissance,Magic Hound|APT32
T1588.005,Exploits,Resource Development,no
T1588.004,Digital Certificates,Resource Development,Lazarus Group|Silent Librarian
T1588.003,Code Signing Certificates,Resource Development,Wizard Spider
T1588.002,Tool,Resource Development,CostaRicto|Night Dragon|DarkVishnya|FIN5|Gorgon Group|Patchwork|Chimera|Dragonfly|Blue Mockingbird|Whitefly|APT41|FIN6|TEMP.Veles|Kimsuky|PittyTiger|Cobalt Group|APT29|Thrip|Ke3chang|DarkHydrus|APT32|APT38|BRONZE BUTLER|Carbanak|Cleaver|Inception|Leafminer|Threat Group-3390|Ferocious Kitten|IndigoZebra|BackdoorDiplomacy|menuPass|APT-C-36|Magic Hound|APT28|Wizard Spider|Frankenstein|Silence|WIRTE|Turla|APT33|APT19|FIN10|CopyKittens|APT39|APT1|MuddyWater|Silent Librarian|GALLIUM|Sandworm Team
T1588.001,Malware,Resource Development,Andariel|BackdoorDiplomacy|Turla|APT1
T1588,Obtain Capabilities,Resource Development,no
T1587.004,Exploits,Resource Development,no
T1587.003,Digital Certificates,Resource Development,APT29|PROMETHIUM
T1587.002,Code Signing Certificates,Resource Development,PROMETHIUM|Patchwork
T1587.001,Malware,Resource Development,TeamTNT|APT29|Lazarus Group|UNC2452|Sandworm Team|Turla|FIN7|Night Dragon|Cleaver
T1587,Develop Capabilities,Resource Development,Kimsuky
T1586.002,Email Accounts,Resource Development,IndigoZebra|Leviathan|Magic Hound|Kimsuky
T1586.001,Social Media Accounts,Resource Development,Leviathan
T1586,Compromise Accounts,Resource Development,no
T1585.002,Email Accounts,Resource Development,Leviathan|Magic Hound|Silent Librarian|Sandworm Team|APT1
T1585.001,Social Media Accounts,Resource Development,Leviathan|Magic Hound|Fox Kitten|Sandworm Team|APT32|Cleaver
T1585,Establish Accounts,Resource Development,Fox Kitten|APT17
T1584.006,Web Services,Resource Development,Turla
T1584.005,Botnet,Resource Development,no
T1584.004,Server,Resource Development,Indrik Spider|Turla|APT16
T1584.003,Virtual Private Server,Resource Development,Turla
T1584.002,DNS Server,Resource Development,no
T1584.001,Domains,Resource Development,Transparent Tribe|Magic Hound|APT29|UNC2452|APT1
T1583.006,Web Services,Resource Development,IndigoZebra|ZIRCONIUM|MuddyWater|HAFNIUM|Lazarus Group|Turla|APT32|APT17|APT29
T1583.005,Botnet,Resource Development,no
T1583.004,Server,Resource Development,GALLIUM|Sandworm Team
T1583.003,Virtual Private Server,Resource Development,HAFNIUM|TEMP.Veles
T1583.002,DNS Server,Resource Development,no
T1584,Compromise Infrastructure,Resource Development,no
T1583.001,Domains,Resource Development,IndigoZebra|TeamTNT|Ferocious Kitten|FIN7|Transparent Tribe|Leviathan|Magic Hound|APT29|Mustang Panda|ZIRCONIUM|UNC2452|Lazarus Group|Silent Librarian|menuPass|Sandworm Team|APT32|Kimsuky|APT1|APT28
T1583,Acquire Infrastructure,Resource Development,no
T1564.007,VBA Stomping,Defense Evasion,no
T1558.004,AS-REP Roasting,Credential Access,no
T1580,Cloud Infrastructure Discovery,Discovery,no
T1218.012,Verclsid,Defense Evasion,no
T1205.001,Port Knocking,Defense Evasion|Persistence|Command And Control,PROMETHIUM
T1564.006,Run Virtual Instance,Defense Evasion,no
T1564.005,Hidden File System,Defense Evasion,Strider|Equation
T1556.003,Pluggable Authentication Modules,Credential Access|Defense Evasion,no
T1556.003,Pluggable Authentication Modules,Credential Access|Defense Evasion|Persistence,no
T1574.012,COR_PROFILER,Persistence|Privilege Escalation|Defense Evasion,Blue Mockingbird
T1562.007,Disable or Modify Cloud Firewall,Defense Evasion,no
T1098.004,SSH Authorized Keys,Persistence,no
T1098.004,SSH Authorized Keys,Persistence,TeamTNT
T1480.001,Environmental Keying,Defense Evasion,APT41|Equation
T1059.007,JavaScript/JScript,Execution,APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer
T1059.007,JavaScript,Execution,Indrik Spider|MuddyWater|Turla|Higaisa|Sidewinder|Evilnum|Kimsuky|FIN6|APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer
T1578.004,Revert Cloud Instance,Defense Evasion,no
T1578.003,Delete Cloud Instance,Defense Evasion,no
T1578.001,Create Snapshot,Defense Evasion,no
T1578.002,Create Cloud Instance,Defense Evasion,no
T1127.001,MSBuild,Defense Evasion,Frankenstein
T1027.005,Indicator Removal from Tools,Defense Evasion,Soft Cell|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda
T1027.005,Indicator Removal from Tools,Defense Evasion,Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda
T1562.006,Indicator Blocking,Defense Evasion,no
T1573.002,Asymmetric Cryptography,Command And Control,Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6
T1573.001,Symmetric Cryptography,Command And Control,Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group
T1573.002,Asymmetric Cryptography,Command And Control,Operation Wocao|Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6
T1573.001,Symmetric Cryptography,Command And Control,Mustang Panda|Darkhotel|ZIRCONIUM|Higaisa|Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group
T1573,Encrypted Channel,Command And Control,Tropic Trooper
T1027.004,Compile After Delivery,Defense Evasion,Gamaredon Group|Rocke|MuddyWater
T1574.004,Dylib Hijacking,Persistence|Privilege Escalation|Defense Evasion,no
T1546.015,Component Object Model Hijacking,Privilege Escalation|Persistence,APT28
T1071.004,DNS,Command And Control,APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7
T1071.003,Mail Protocols,Command And Control,APT32|SilverTerrier|APT28
T1071.002,File Transfer Protocols,Command And Control,APT41|SilverTerrier|Machete|Honeybee
T1071.001,Web Protocols,Command And Control,Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|Machete|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Cobalt Group|APT19|Threat Group-3390|Rancor|Orangeworm|APT37|Ke3chang|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|APT32|OilRig|Magic Hound|Gamaredon Group|Stealth Falcon
T1572,Protocol Tunneling,Command And Control,OilRig|Cobalt Group|FIN6
T1048.003,Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol,Exfiltration,APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group
T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,no
T1071.004,DNS,Command And Control,Chimera|APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7
T1071.003,Mail Protocols,Command And Control,Turla|Kimsuky|APT32|SilverTerrier|APT28
T1071.002,File Transfer Protocols,Command And Control,Kimsuky|APT41|SilverTerrier|Honeybee
T1071.001,Web Protocols,Command And Control,TeamTNT|FIN8|APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|UNC2452|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Rancor|Ke3chang|Orangeworm|APT37|APT19|Cobalt Group|Threat Group-3390|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|Magic Hound|APT32|OilRig|Gamaredon Group|Stealth Falcon
T1572,Protocol Tunneling,Command And Control,Leviathan|CostaRicto|Chimera|Fox Kitten|OilRig|Cobalt Group|FIN6
T1048.003,Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol,Exfiltration,Wizard Spider|FIN6|APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group
T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,APT28|APT29|UNC2452
T1048.001,Exfiltration Over Symmetric Encrypted Non-C2 Protocol,Exfiltration,no
T1001.003,Protocol Impersonation,Command And Control,Lazarus Group
T1001.002,Steganography,Command And Control,Axiom
T1001.003,Protocol Impersonation,Command And Control,Higaisa|Lazarus Group
T1001.002,Steganography,Command And Control,APT29|Axiom
T1001.001,Junk Data,Command And Control,APT28
T1132.002,Non-Standard Encoding,Command And Control,no
T1132.001,Standard Encoding,Command And Control,Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork
T1132.001,Standard Encoding,Command And Control,HAFNIUM|TA551|Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork
T1090.004,Domain Fronting,Command And Control,APT29
T1090.003,Multi-hop Proxy,Command And Control,Inception|FIN4|APT29
T1090.002,External Proxy,Command And Control,APT39|Silence|Soft Cell|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28
T1090.001,Internal Proxy,Command And Control,APT39|Strider
T1090.003,Multi-hop Proxy,Command And Control,Leviathan|CostaRicto|APT28|Operation Wocao|Inception|FIN4|APT29
T1090.002,External Proxy,Command And Control,Tonto Team|APT39|Silence|GALLIUM|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28
T1090.001,Internal Proxy,Command And Control,APT29|Higaisa|UNC2452|Operation Wocao|APT39|Strider
T1102.003,One-Way Communication,Command And Control,Leviathan
T1102.002,Bidirectional Communication,Command And Control,Sandworm Team|APT39|APT12|Turla|FIN7|APT37|Magic Hound|Carbanak
T1102.002,Bidirectional Communication,Command And Control,ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|Turla|FIN7|APT37|Magic Hound|Carbanak
T1102.001,Dead Drop Resolver,Command And Control,Rocke|APT41|BRONZE BUTLER|RTM|Patchwork
T1571,Non-Standard Port,Command And Control,Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7
T1074.002,Remote Data Staging,Collection,Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8
T1074.001,Local Data Staging,Collection,Machete|Soft Cell|TEMP.Veles|Patchwork|Dragonfly 2.0|Honeybee|Leviathan|APT3|FIN5|menuPass|FIN6|Lazarus Group|Threat Group-3390|APT28
T1078.004,Cloud Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT33
T1074.002,Remote Data Staging,Collection,Leviathan|APT28|APT29|Chimera|UNC2452|Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8
T1074.001,Local Data Staging,Collection,Indrik Spider|BackdoorDiplomacy|Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|Honeybee|Dragonfly 2.0|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28
T1078.004,Cloud Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT28|APT33
T1564.004,NTFS File Attributes,Defense Evasion,APT32
T1564.003,Hidden Window,Defense Evasion,Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound
T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Tropic Trooper|FIN10|Stolen Pencil|APT32
T1078.002,Domain Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,TA505|APT3|Threat Group-1314
T1564.003,Hidden Window,Defense Evasion,Nomadic Octopus|Higaisa|Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound
T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Kimsuky|HAFNIUM|Turla|Operation Wocao|PROMETHIUM|Tropic Trooper|FIN10|Stolen Pencil|APT32
T1078.002,Domain Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Naikon|Indrik Spider|Chimera|Operation Wocao|Sandworm Team|Wizard Spider|APT29|TA505|APT3|Threat Group-1314
T1078.001,Default Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,no
T1564.002,Hidden Users,Defense Evasion,no
T1574.006,LD_PRELOAD,Persistence|Privilege Escalation|Defense Evasion,Rocke
T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,BRONZE BUTLER|Naikon|APT41|Soft Cell|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390
T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,Whitefly|RTM|Threat Group-3390|menuPass
T1564.002,Hidden Users,Defense Evasion,Dragonfly 2.0
T1574.006,Dynamic Linker Hijacking,Persistence|Privilege Escalation|Defense Evasion,APT41|Rocke
T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,Mustang Panda|Higaisa|BlackTech|Sidewinder|Chimera|BRONZE BUTLER|Naikon|APT41|GALLIUM|Tropic Trooper|APT19|Patchwork|APT32|APT3|menuPass|Threat Group-3390
T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,BackdoorDiplomacy|Tonto Team|Evilnum|APT41|Whitefly|RTM|Threat Group-3390|menuPass
T1574.008,Path Interception by Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,no
T1574.007,Path Interception by PATH Environment Variable,Persistence|Privilege Escalation|Defense Evasion,no
T1574.009,Path Interception by Unquoted Path,Persistence|Privilege Escalation|Defense Evasion,no
@@ -61,174 +199,174 @@ T1574.011,Services Registry Permissions Weakness,Persistence|Privilege Escalatio
T1574.005,Executable Installer File Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no
T1574.010,Services File Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no
T1574,Hijack Execution Flow,Persistence|Privilege Escalation|Defense Evasion,no
T1069.001,Local Groups,Discovery,Turla|OilRig|admin@338
T1570,Lateral Tool Transfer,Lateral Movement,APT32|Wizard Spider|Turla|FIN10
T1069.001,Local Groups,Discovery,Tonto Team|Chimera|Operation Wocao|Turla|OilRig|admin@338
T1570,Lateral Tool Transfer,Lateral Movement,Sandworm Team|Chimera|GALLIUM|Operation Wocao|APT32|Wizard Spider|Turla|FIN10
T1568.003,DNS Calculation,Command And Control,APT12
T1204.002,Malicious File,Execution,Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|APT19|Dragonfly 2.0|BRONZE BUTLER|Cobalt Group|DarkHydrus|Gorgon Group|Patchwork|OilRig|Dark Caracal|MuddyWater|Lazarus Group|FIN7|APT32|Rancor|APT37|FIN8|APT28|Elderwood|TA459|APT29|Leviathan|menuPass|PLATINUM
T1204.001,Malicious Link,Execution,Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla
T1204.002,Malicious File,Execution,Nomadic Octopus|Indrik Spider|APT38|Andariel|Ferocious Kitten|IndigoZebra|Transparent Tribe|Tonto Team|Magic Hound|Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Dragonfly 2.0|FIN7|BRONZE BUTLER|Gorgon Group|OilRig|Dark Caracal|Cobalt Group|DarkHydrus|Rancor|Patchwork|APT32|APT19|MuddyWater|Lazarus Group|menuPass|APT37|Leviathan|TA459|APT29|APT28|FIN8|PLATINUM|Elderwood
T1204.001,Malicious Link,Execution,FIN7|Transparent Tribe|APT3|Magic Hound|APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|Turla|APT33
T1195.003,Compromise Hardware Supply Chain,Initial Access,no
T1195.002,Compromise Software Supply Chain,Initial Access,Sandworm Team|APT41
T1195.002,Compromise Software Supply Chain,Initial Access,APT29|UNC2452|Cobalt Group|GOLD SOUTHFIELD|Dragonfly|Sandworm Team|APT41
T1195.001,Compromise Software Dependencies and Development Tools,Initial Access,no
T1568.001,Fast Flux DNS,Command And Control,TA505
T1052.001,Exfiltration over USB,Exfiltration,Tropic Trooper
T1569.002,Service Execution,Execution,Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang
T1568.001,Fast Flux DNS,Command And Control,menuPass|TA505
T1052.001,Exfiltration over USB,Exfiltration,Mustang Panda|Tropic Trooper
T1569.002,Service Execution,Execution,APT38|Chimera|Operation Wocao|Wizard Spider|Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang
T1569.001,Launchctl,Execution,no
T1569,System Services,Execution,no
T1568.002,Domain Generation Algorithms,Command And Control,APT41
T1568,Dynamic Resolution,Command And Control,no
T1568.002,Domain Generation Algorithms,Command And Control,TA551|APT41
T1568,Dynamic Resolution,Command And Control,Transparent Tribe|APT29|UNC2452
T1011.001,Exfiltration Over Bluetooth,Exfiltration,no
T1567.002,Exfiltration to Cloud Storage,Exfiltration,Leviathan|Turla
T1567.002,Exfiltration to Cloud Storage,Exfiltration,FIN7|ZIRCONIUM|HAFNIUM|Chimera|Leviathan|Turla
T1567.001,Exfiltration to Code Repository,Exfiltration,no
T1059.006,Python,Execution,Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete
T1059.005,Visual Basic,Execution,APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound
T1059.004,Unix Shell,Execution,Rocke|APT41
T1059.003,Windows Command Shell,Execution,TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|Soft Cell|Turla|Silence|APT32|APT39|Darkhotel|MuddyWater|APT18|APT38|Dark Caracal|Gorgon Group|Dragonfly 2.0|Rancor|Ke3chang|APT37|Leviathan|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|Threat Group-3390|menuPass|Gamaredon Group|Suckfly|Patchwork|Threat Group-1314|APT3|admin@338|APT1
T1059.006,Python,Execution,Tonto Team|APT37|ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete
T1059.005,Visual Basic,Execution,OilRig|APT38|Transparent Tribe|APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound
T1059.004,Unix Shell,Execution,TeamTNT|Rocke|APT41
T1059.003,Windows Command Shell,Execution,Sandworm Team|Nomadic Octopus|TeamTNT|APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|UNC2452|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Gorgon Group|Dark Caracal|Ke3chang|Dragonfly 2.0|Rancor|FIN8|APT28|APT37|Magic Hound|BRONZE BUTLER|Sowbug|menuPass|FIN10|Threat Group-3390|Gamaredon Group|Patchwork|Suckfly|Threat Group-1314|APT3|admin@338|APT1
T1059.002,AppleScript,Execution,no
T1059.001,PowerShell,Execution,Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|Soft Cell|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|DarkHydrus|APT28|Thrip|Gorgon Group|Cobalt Group|Dragonfly 2.0|Leviathan|TA459|FIN8|MuddyWater|Magic Hound|OilRig|BRONZE BUTLER|CopyKittens|APT32|FIN7|FIN10|Threat Group-3390|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda
T1567,Exfiltration Over Web Service,Exfiltration,no
T1059.001,PowerShell,Execution,Nomadic Octopus|TeamTNT|APT38|Tonto Team|Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|Thrip|Cobalt Group|APT28|DarkHydrus|Dragonfly 2.0|APT19|Gorgon Group|TA459|Leviathan|MuddyWater|FIN8|CopyKittens|OilRig|Magic Hound|BRONZE BUTLER|FIN7|APT32|menuPass|FIN10|Threat Group-3390|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda
T1567,Exfiltration Over Web Service,Exfiltration,APT28
T1497.003,Time Based Evasion,Defense Evasion|Discovery,no
T1497.002,User Activity Based Checks,Defense Evasion|Discovery,FIN7
T1497.001,System Checks,Defense Evasion|Discovery,Frankenstein
T1497.002,User Activity Based Checks,Defense Evasion|Discovery,Darkhotel|FIN7
T1497.001,System Checks,Defense Evasion|Discovery,OilRig|Darkhotel|Evilnum|Frankenstein
T1498.002,Reflection Amplification,Impact,no
T1498.001,Direct Network Flood,Impact,no
T1566.003,Spearphishing via Service,Initial Access,Magic Hound|Windshift|FIN6|OilRig|Dark Caracal
T1566.002,Spearphishing Link,Initial Access,Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Turla|APT28|Cobalt Group|Dragonfly 2.0|OilRig|APT33|Elderwood|Leviathan|Magic Hound|Patchwork|APT29|FIN8
T1566.001,Spearphishing Attachment,Initial Access,Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Turla|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|OilRig|Lazarus Group|APT19|Dragonfly 2.0|BRONZE BUTLER|APT32|FIN8|MuddyWater|APT28|TA459|Leviathan|Patchwork|PLATINUM|Elderwood|APT29|APT37|menuPass
T1566,Phishing,Initial Access,no
T1566.003,Spearphishing via Service,Initial Access,APT29|Ajax Security Team|Magic Hound|Windshift|FIN6|OilRig|Dark Caracal
T1566.002,Spearphishing Link,Initial Access,Transparent Tribe|FIN7|APT3|Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|APT28|Cobalt Group|Turla|Dragonfly 2.0|OilRig|Elderwood|APT33|APT29|Leviathan|FIN8|Patchwork|Magic Hound
T1566.001,Spearphishing Attachment,Initial Access,APT38|Andariel|Ferocious Kitten|IndigoZebra|Transparent Tribe|Nomadic Octopus|Tonto Team|Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|DarkHydrus|Lazarus Group|Gorgon Group|OilRig|BRONZE BUTLER|APT19|APT32|Cobalt Group|Rancor|FIN7|Dragonfly 2.0|MuddyWater|APT28|TA459|APT29|APT37|Leviathan|FIN8|Patchwork|menuPass|Elderwood|PLATINUM
T1566,Phishing,Initial Access,GOLD SOUTHFIELD|Dragonfly
T1565.003,Runtime Data Manipulation,Impact,APT38
T1565.002,Transmitted Data Manipulation,Impact,APT38
T1565.001,Stored Data Manipulation,Impact,FIN4|APT38
T1565.001,Stored Data Manipulation,Impact,APT38
T1565,Data Manipulation,Impact,no
T1564.001,Hidden Files and Directories,Defense Evasion,Rocke|APT32|Tropic Trooper|APT28|Lazarus Group
T1564.001,Hidden Files and Directories,Defense Evasion,Transparent Tribe|Mustang Panda|Rocke|APT32|Tropic Trooper|APT28|Lazarus Group
T1564,Hide Artifacts,Defense Evasion,no
T1563.002,RDP Hijacking,Lateral Movement,no
T1563.001,SSH Hijacking,Lateral Movement,no
T1563,Remote Service Session Hijacking,Lateral Movement,no
T1518.001,Security Software Discovery,Discovery,Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon
T1518.001,Security Software Discovery,Discovery,TeamTNT|APT38|Windshift|Sidewinder|Operation Wocao|Wizard Spider|Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon
T1069.003,Cloud Groups,Discovery,no
T1069.002,Domain Groups,Discovery,Turla|Wizard Spider|Inception|OilRig|FIN6|Dragonfly 2.0|Ke3chang
T1069.002,Domain Groups,Discovery,Turla|Inception|OilRig|Dragonfly 2.0|Ke3chang
T1087.004,Cloud Account,Discovery,no
T1087.003,Email Account,Discovery,Sandworm Team|TA505
T1087.002,Domain Account,Discovery,Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang
T1087.001,Local Account,Discovery,Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338
T1087.002,Domain Account,Discovery,MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang
T1087.001,Local Account,Discovery,Chimera|Fox Kitten|Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338
T1553.004,Install Root Certificate,Defense Evasion,no
T1562.004,Disable or Modify System Firewall,Defense Evasion,Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak
T1562.003,HISTCONTROL,Defense Evasion,no
T1562.002,Disable Windows Event Logging,Defense Evasion,Threat Group-3390
T1562.001,Disable or Modify Tools,Defense Evasion,Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda
T1562.004,Disable or Modify System Firewall,Defense Evasion,TeamTNT|APT38|APT29|UNC2452|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak
T1562.003,Impair Command History Logging,Defense Evasion,APT38
T1562.002,Disable Windows Event Logging,Defense Evasion,Sandworm Team|APT29|UNC2452|Threat Group-3390
T1562.001,Disable or Modify Tools,Defense Evasion,TeamTNT|Indrik Spider|APT29|MuddyWater|UNC2452|Wizard Spider|FIN6|Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda
T1562,Impair Defenses,Defense Evasion,no
T1003.004,LSA Secrets,Credential Access,OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390
T1003.005,Cached Domain Credentials,Credential Access,OilRig|MuddyWater|Leafminer|APT33
T1561.002,Disk Structure Wipe,Impact,Sandworm Team|Lazarus Group|APT38|APT37
T1561.001,Disk Content Wipe,Impact,Lazarus Group
T1561,Disk Wipe,Impact,no
T1560.003,Archive via Custom Method,Collection,Lazarus Group|Kimsuky|CopyKittens|FIN6
T1560.003,Archive via Custom Method,Collection,Mustang Panda|Lazarus Group|Kimsuky|CopyKittens|FIN6
T1560.002,Archive via Library,Collection,Lazarus Group|Threat Group-3390
T1560.001,Archive via Utility,Collection,APT41|Soft Cell|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|APT3|Sowbug|menuPass|APT1|Ke3chang
T1560,Archive Collected Data,Collection,menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang
T1560.001,Archive via Utility,Collection,APT28|APT29|Mustang Panda|HAFNIUM|UNC2452|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|APT1|Ke3chang
T1560,Archive Collected Data,Collection,Leviathan|menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang
T1499.004,Application or System Exploitation,Impact,no
T1499.003,Application Exhaustion Flood,Impact,no
T1499.002,Service Exhaustion Flood,Impact,no
T1499.001,OS Exhaustion Flood,Impact,no
T1491.002,External Defacement,Impact,no
T1491.002,External Defacement,Impact,Sandworm Team
T1491.001,Internal Defacement,Impact,Lazarus Group
T1114.003,Email Forwarding Rule,Collection,no
T1114.002,Remote Email Collection,Collection,APT1|FIN4|APT28|Dragonfly 2.0|Ke3chang|Leafminer
T1114.001,Local Email Collection,Collection,Magic Hound|APT1
T1114.003,Email Forwarding Rule,Collection,Silent Librarian|Kimsuky
T1114.002,Remote Email Collection,Collection,APT29|HAFNIUM|Chimera|UNC2452|APT1|FIN4|Ke3chang|Leafminer|Dragonfly 2.0|APT28
T1114.001,Local Email Collection,Collection,Chimera|Magic Hound|APT1
T1134.005,SID-History Injection,Defense Evasion|Privilege Escalation,no
T1134.004,Parent PID Spoofing,Defense Evasion|Privilege Escalation,no
T1134.003,Make and Impersonate Token,Defense Evasion|Privilege Escalation,no
T1134.002,Create Process with Token,Defense Evasion|Privilege Escalation,Turla|Lazarus Group
T1134.001,Token Impersonation/Theft,Defense Evasion|Privilege Escalation,APT28
T1213.002,Sharepoint,Collection,Ke3chang|APT28
T1134.001,Token Impersonation/Theft,Defense Evasion|Privilege Escalation,FIN8|APT28
T1213.002,Sharepoint,Collection,Chimera|Ke3chang|APT28
T1213.001,Confluence,Collection,no
T1555.003,Credentials from Web Browsers,Credential Access,Magic Hound|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats
T1555.003,Credentials from Web Browsers,Credential Access,Ajax Security Team|ZIRCONIUM|FIN6|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats
T1555.002,Securityd Memory,Credential Access,no
T1555.001,Keychain,Credential Access,no
T1559.002,Dynamic Data Exchange,Execution,Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7
T1559.002,Dynamic Data Exchange,Execution,Leviathan|Sidewinder|Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|FIN7|APT28
T1559.001,Component Object Model,Execution,Gamaredon Group|MuddyWater
T1559,Inter-Process Communication,Execution,no
T1558.002,Silver Ticket,Credential Access,no
T1558.001,Golden Ticket,Credential Access,Ke3chang
T1558,Steal or Forge Kerberos Tickets,Credential Access,no
T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,no
T1557,Man-in-the-Middle,Credential Access|Collection,no
T1556.002,Password Filter DLL,Credential Access|Defense Evasion,Strider
T1556.001,Domain Controller Authentication,Credential Access|Defense Evasion,no
T1556,Modify Authentication Process,Credential Access|Defense Evasion,no
T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,Wizard Spider
T1557,Adversary-in-the-Middle,Credential Access|Collection,Kimsuky
T1556.002,Password Filter DLL,Credential Access|Defense Evasion|Persistence,Strider
T1556.001,Domain Controller Authentication,Credential Access|Defense Evasion|Persistence,Chimera
T1556,Modify Authentication Process,Credential Access|Defense Evasion|Persistence,no
T1056.004,Credential API Hooking,Collection|Credential Access,PLATINUM
T1056.003,Web Portal Capture,Collection|Credential Access,no
T1056.002,GUI Input Capture,Collection|Credential Access,FIN4
T1056.001,Keylogging,Collection|Credential Access,APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|Ke3chang|OilRig|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28
T1555,Credentials from Password Stores,Credential Access,APT39|OilRig|MuddyWater|Leafminer|APT33|Turla|Stealth Falcon
T1552.005,Cloud Instance Metadata API,Credential Access,no
T1056.001,Keylogging,Collection|Credential Access,Tonto Team|Ajax Security Team|Operation Wocao|APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28
T1555,Credentials from Password Stores,Credential Access,APT29|Evilnum|UNC2452|FIN6|APT39|OilRig|MuddyWater|Leafminer|APT33|Stealth Falcon
T1552.005,Cloud Instance Metadata API,Credential Access,TeamTNT
T1003.008,/etc/passwd and /etc/shadow,Credential Access,no
T1003.007,Proc Filesystem,Credential Access,no
T1003.006,DCSync,Credential Access,no
T1558.003,Kerberoasting,Credential Access,no
T1003.006,DCSync,Credential Access,APT29|UNC2452|Operation Wocao
T1558.003,Kerberoasting,Credential Access,FIN7|APT29|UNC2452|Operation Wocao|Wizard Spider
T1552.006,Group Policy Preferences,Credential Access,APT33
T1003.003,NTDS,Credential Access,FIN6|Dragonfly 2.0
T1003.002,Security Account Manager,Credential Access,Threat Group-3390|Ke3chang|Soft Cell|Night Dragon|Dragonfly 2.0|menuPass
T1003.001,LSASS Memory,Credential Access,Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|Soft Cell|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Lazarus Group|Leafminer|Magic Hound|MuddyWater|PLATINUM|FIN8|BRONZE BUTLER|OilRig|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver
T1110.004,Credential Stuffing,Credential Access,no
T1110.003,Password Spraying,Credential Access,APT33|Leafminer|Lazarus Group
T1110.002,Password Cracking,Credential Access,APT41|Dragonfly 2.0|APT3
T1110.001,Password Guessing,Credential Access,no
T1021.006,Windows Remote Management,Lateral Movement,Threat Group-3390
T1021.005,VNC,Lateral Movement,GCMAN
T1021.004,SSH,Lateral Movement,Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN
T1003.003,NTDS,Credential Access,APT28|Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6|Dragonfly 2.0
T1003.002,Security Account Manager,Credential Access,Wizard Spider|Threat Group-3390|Ke3chang|GALLIUM|Night Dragon|Dragonfly 2.0|menuPass
T1003.001,LSASS Memory,Credential Access,Indrik Spider|HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Leafminer|Magic Hound|FIN8|PLATINUM|MuddyWater|OilRig|BRONZE BUTLER|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver
T1110.004,Credential Stuffing,Credential Access,Chimera
T1110.003,Password Spraying,Credential Access,Sandworm Team|APT29|Silent Librarian|Chimera|APT28|APT33|Leafminer|Lazarus Group
T1110.002,Password Cracking,Credential Access,FIN6|APT41|Dragonfly 2.0|APT3
T1110.001,Password Guessing,Credential Access,APT28
T1021.006,Windows Remote Management,Lateral Movement,APT29|UNC2452|Chimera|Wizard Spider|Threat Group-3390
T1021.005,VNC,Lateral Movement,FIN7|Fox Kitten|GCMAN
T1021.004,SSH,Lateral Movement,TeamTNT|FIN7|Fox Kitten|Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN
T1021.003,Distributed Component Object Model,Lateral Movement,no
T1021.002,SMB/Windows Admin Shares,Lateral Movement,Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang
T1021.001,Remote Desktop Protocol,Lateral Movement,Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|menuPass|FIN10|Patchwork|FIN6|Lazarus Group|APT1|Axiom
T1021.002,SMB/Windows Admin Shares,Lateral Movement,Sandworm Team|APT28|Fox Kitten|APT41|Operation Wocao|Wizard Spider|Chimera|Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang
T1021.001,Remote Desktop Protocol,Lateral Movement,Kimsuky|FIN7|Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|FIN10|menuPass|Patchwork|FIN6|Lazarus Group|APT1|Axiom
T1554,Compromise Client Software Binary,Persistence,no
T1036.006,Space after Filename,Defense Evasion,no
T1036.005,Match Legitimate Name or Location,Defense Evasion,Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1
T1036.004,Masquerade Task or Service,Defense Evasion,Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7
T1036.003,Rename System Utilities,Defense Evasion,menuPass|APT32|Soft Cell|PLATINUM
T1036.002,Right-to-Left Override,Defense Evasion,BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic
T1036.001,Invalid Code Signature,Defense Evasion,Windshift
T1036.005,Match Legitimate Name or Location,Defense Evasion,APT28|Ferocious Kitten|FIN7|BackdoorDiplomacy|Transparent Tribe|Naikon|APT29|Mustang Panda|Sidewinder|Darkhotel|Lazarus Group|Indrik Spider|UNC2452|Fox Kitten|Machete|Chimera|PROMETHIUM|Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|Sowbug|BRONZE BUTLER|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1
T1036.004,Masquerade Task or Service,Defense Evasion,BackdoorDiplomacy|APT41|Naikon|ZIRCONIUM|APT29|Higaisa|UNC2452|Fox Kitten|Kimsuky|PROMETHIUM|Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7
T1036.003,Rename System Utilities,Defense Evasion,menuPass|APT32|GALLIUM
T1036.002,Right-to-Left Override,Defense Evasion,Ferocious Kitten|BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic
T1036.001,Invalid Code Signature,Defense Evasion,Windshift|APT37
T1553.003,SIP and Trust Provider Hijacking,Defense Evasion,no
T1553.002,Code Signing,Defense Evasion,Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|APT37|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel
T1553.002,Code Signing,Defense Evasion,menuPass|APT29|GALLIUM|UNC2452|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel
T1553.001,Gatekeeper Bypass,Defense Evasion,no
T1553,Subvert Trust Controls,Defense Evasion,no
T1027.003,Steganography,Defense Evasion,BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37
T1027.002,Software Packing,Defense Evasion,TA505|Rocke|Soft Cell|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon
T1027.001,Binary Padding,Defense Evasion,Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee
T1222.002,Linux and Mac File and Directory Permissions Modification,Defense Evasion,Rocke|APT32
T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,no
T1552.004,Private Keys,Credential Access,Rocke
T1027.003,Steganography,Defense Evasion,Andariel|Leviathan|TA551|BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37
T1027.002,Software Packing,Defense Evasion,Sandworm Team|Kimsuky|TeamTNT|ZIRCONIUM|TA505|Rocke|GALLIUM|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon
T1027.001,Binary Padding,Defense Evasion,APT29|Mustang Panda|Higaisa|Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee
T1222.002,Linux and Mac File and Directory Permissions Modification,Defense Evasion,TeamTNT|Rocke|APT32
T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,Wizard Spider
T1552.004,Private Keys,Credential Access,TeamTNT|APT29|UNC2452|Operation Wocao|Rocke
T1552.003,Bash History,Credential Access,no
T1552.002,Credentials in Registry,Credential Access,APT32
T1552.001,Credentials In Files,Credential Access,Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3
T1552.001,Credentials In Files,Credential Access,TeamTNT|Kimsuky|Fox Kitten|Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3
T1552,Unsecured Credentials,Credential Access,no
T1216.001,PubPrn,Defense Evasion,APT32
T1070.006,Timestomp,Defense Evasion,Rocke|TEMP.Veles|APT32|Lazarus Group|APT28
T1070.006,Timestomp,Defense Evasion,APT38|APT29|UNC2452|Chimera|Kimsuky|Rocke|TEMP.Veles|APT32|Lazarus Group|APT28
T1070.005,Network Share Connection Removal,Defense Evasion,Threat Group-3390
T1070.004,File Deletion,Defense Evasion,Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|FIN10|APT28|Threat Group-3390|Group5|Lazarus Group|APT18|APT29
T1070.003,Clear Command History,Defense Evasion,APT41
T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,no
T1070.004,File Deletion,Defense Evasion,TeamTNT|APT39|Mustang Panda|Chimera|Evilnum|UNC2452|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Cobalt Group|Dragonfly 2.0|Honeybee|Patchwork|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|APT3|Magic Hound|Threat Group-3390|APT28|FIN10|Group5|Lazarus Group|APT18|APT29
T1070.003,Clear Command History,Defense Evasion,TeamTNT|menuPass|APT41
T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,APT29|UNC2452
T1550.001,Application Access Token,Defense Evasion|Lateral Movement,APT28
T1550.003,Pass the Ticket,Defense Evasion|Lateral Movement,APT32|BRONZE BUTLER|APT29
T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,Soft Cell|APT32|Night Dragon|APT28|APT1
T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,no
T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,Chimera|Kimsuky|GALLIUM|APT32|Night Dragon|APT28|APT1
T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,APT29|UNC2452
T1548.004,Elevated Execution with Prompt,Privilege Escalation|Defense Evasion,no
T1548.003,Sudo and Sudo Caching,Privilege Escalation|Defense Evasion,no
T1548.002,Bypass User Access Control,Privilege Escalation|Defense Evasion,APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29
T1548.002,Bypass User Account Control,Privilege Escalation|Defense Evasion,Evilnum|APT37|MuddyWater|Threat Group-3390|Honeybee|Cobalt Group|BRONZE BUTLER|Patchwork|APT29
T1548.001,Setuid and Setgid,Privilege Escalation|Defense Evasion,no
T1548,Abuse Elevation Control Mechanism,Privilege Escalation|Defense Evasion,no
T1136.003,Cloud Account,Persistence,no
T1070.002,Clear Linux or Mac System Logs,Defense Evasion,Rocke
T1070.001,Clear Windows Event Logs,Defense Evasion,APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28
T1136.002,Domain Account,Persistence,Soft Cell
T1136.001,Local Account,Persistence,APT39|APT41|Dragonfly 2.0|Leafminer|APT3
T1070.002,Clear Linux or Mac System Logs,Defense Evasion,TeamTNT|Rocke
T1070.001,Clear Windows Event Logs,Defense Evasion,Indrik Spider|Chimera|Operation Wocao|APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28
T1136.002,Domain Account,Persistence,Sandworm Team|HAFNIUM|GALLIUM
T1136.001,Local Account,Persistence,TeamTNT|Fox Kitten|APT39|APT41|Leafminer|Dragonfly 2.0|APT3
T1547.011,Plist Modification,Persistence|Privilege Escalation,no
T1547.010,Port Monitors,Persistence|Privilege Escalation,no
T1547.009,Shortcut Modification,Persistence|Privilege Escalation,APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Leviathan|Lazarus Group
T1547.009,Shortcut Modification,Persistence|Privilege Escalation,APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Lazarus Group|Leviathan
T1547.008,LSASS Driver,Persistence|Privilege Escalation,no
T1547.007,Re-opened Applications,Persistence|Privilege Escalation,no
T1547.006,Kernel Modules and Extensions,Persistence|Privilege Escalation,no
T1547.005,Security Support Provider,Persistence|Privilege Escalation,no
T1547.004,Winlogon Helper DLL,Persistence|Privilege Escalation,Tropic Trooper|Turla
T1547.004,Winlogon Helper DLL,Persistence|Privilege Escalation,Wizard Spider|Tropic Trooper|Turla
T1547.003,Time Providers,Persistence|Privilege Escalation,no
T1546.014,Emond,Privilege Escalation|Persistence,no
T1546.013,PowerShell Profile,Privilege Escalation|Persistence,Turla
@@ -236,37 +374,37 @@ T1546.012,Image File Execution Options Injection,Privilege Escalation|Persistenc
T1218.008,Odbcconf,Defense Evasion,Cobalt Group
T1546.011,Application Shimming,Privilege Escalation|Persistence,FIN7
T1547.002,Authentication Package,Persistence|Privilege Escalation,no
T1546.010,AppInit DLLs,Privilege Escalation|Persistence,no
T1546.010,AppInit DLLs,Privilege Escalation|Persistence,APT39
T1546.009,AppCert DLLs,Privilege Escalation|Persistence,Honeybee
T1218.007,Msiexec,Defense Evasion,TA505|Rancor
T1546.008,Accessibility Features,Privilege Escalation|Persistence,APT41|APT3|APT29|Deep Panda|Axiom
T1218.007,Msiexec,Defense Evasion,ZIRCONIUM|Molerats|Machete|TA505|Rancor
T1546.008,Accessibility Features,Privilege Escalation|Persistence,Fox Kitten|APT41|APT3|APT29|Deep Panda|Axiom
T1546.007,Netsh Helper DLL,Privilege Escalation|Persistence,no
T1546.006,LC_LOAD_DYLIB Addition,Privilege Escalation|Persistence,no
T1546.005,Trap,Privilege Escalation|Persistence,no
T1546.004,.bash_profile and .bashrc,Privilege Escalation|Persistence,no
T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,APT33|Blue Mockingbird|Turla|Leviathan|APT29
T1546.004,Unix Shell Configuration Modification,Privilege Escalation|Persistence,no
T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,FIN8|Mustang Panda|UNC2452|APT33|Blue Mockingbird|Turla|Leviathan|APT29
T1546.002,Screensaver,Privilege Escalation|Persistence,no
T1546.001,Change Default File Association,Privilege Escalation|Persistence,Kimsuky
T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Machete|Kimsuky|APT33|APT39|APT32|APT18|Turla|Dark Caracal|Cobalt Group|Honeybee|Threat Group-3390|Dragonfly 2.0|Gorgon Group|Ke3chang|APT19|Leviathan|MuddyWater|APT37|BRONZE BUTLER|Magic Hound|APT3|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel
T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,TeamTNT|Naikon|Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Dark Caracal|Threat Group-3390|Honeybee|Turla|Cobalt Group|Ke3chang|Dragonfly 2.0|APT19|Gorgon Group|MuddyWater|APT37|Leviathan|BRONZE BUTLER|APT3|Magic Hound|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel
T1218.002,Control Panel,Defense Evasion,no
T1218.010,Regsvr32,Defense Evasion,Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda
T1218.010,Regsvr32,Defense Evasion,TA551|Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda
T1218.009,Regsvcs/Regasm,Defense Evasion,no
T1218.005,Mshta,Defense Evasion,Inception|Kimsuky|APT32|MuddyWater|FIN7
T1218.004,InstallUtil,Defense Evasion,no
T1218.001,Compiled HTML File,Defense Evasion,APT41|Silence|Lazarus Group|Dark Caracal|OilRig
T1218.005,Mshta,Defense Evasion,Mustang Panda|TA551|Sidewinder|Inception|Kimsuky|APT32|MuddyWater|FIN7
T1218.004,InstallUtil,Defense Evasion,Mustang Panda|menuPass
T1218.001,Compiled HTML File,Defense Evasion,APT41|Silence|Dark Caracal|OilRig|Lazarus Group
T1218.003,CMSTP,Defense Evasion,Cobalt Group|MuddyWater
T1218.011,Rundll32,Defense Evasion,APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28
T1218.011,Rundll32,Defense Evasion,APT38|HAFNIUM|TA551|UNC2452|APT41|Gamaredon Group|APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28
T1547,Boot or Logon Autostart Execution,Persistence|Privilege Escalation,no
T1546,Event Triggered Execution,Privilege Escalation|Persistence,no
T1098.003,Add Office 365 Global Administrator Role,Persistence,no
T1098.002,Exchange Email Delegate Permissions,Persistence,Magic Hound
T1098.001,Additional Azure Service Principal Credentials,Persistence,no
T1098.002,Exchange Email Delegate Permissions,Persistence,APT28|APT29|UNC2452|Magic Hound
T1098.001,Additional Cloud Credentials,Persistence,APT29|UNC2452
T1543.004,Launch Daemon,Persistence|Privilege Escalation,no
T1543.003,Windows Service,Persistence|Privilege Escalation,Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|Honeybee|FIN7|Threat Group-3390|APT19|APT3|Lazarus Group|Carbanak
T1543.002,Systemd Service,Persistence|Privilege Escalation,Rocke
T1543.003,Windows Service,Persistence|Privilege Escalation,TeamTNT|APT38|PROMETHIUM|Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|FIN7|APT19|Threat Group-3390|Honeybee|APT3|Lazarus Group|Carbanak
T1543.002,Systemd Service,Persistence|Privilege Escalation,TeamTNT|Rocke
T1543.001,Launch Agent,Persistence|Privilege Escalation,no
T1037.005,Startup Items,Persistence|Privilege Escalation,no
T1037.004,Rc.common,Persistence|Privilege Escalation,no
T1037.004,RC Scripts,Persistence|Privilege Escalation,no
T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Threat Group-3390|menuPass|Gorgon Group|Patchwork
T1055.013,Process Doppelgänging,Defense Evasion|Privilege Escalation,Leafminer
T1055.011,Extra Window Memory Injection,Defense Evasion|Privilege Escalation,no
@@ -274,10 +412,10 @@ T1055.014,VDSO Hijacking,Defense Evasion|Privilege Escalation,no
T1055.009,Proc Memory,Defense Evasion|Privilege Escalation,no
T1055.008,Ptrace System Calls,Defense Evasion|Privilege Escalation,no
T1055.005,Thread Local Storage,Defense Evasion|Privilege Escalation,no
T1055.004,Asynchronous Procedure Call,Defense Evasion|Privilege Escalation,no
T1055.004,Asynchronous Procedure Call,Defense Evasion|Privilege Escalation,FIN8
T1055.003,Thread Execution Hijacking,Defense Evasion|Privilege Escalation,no
T1055.002,Portable Executable Injection,Defense Evasion|Privilege Escalation,Rocke|Gorgon Group
T1055.001,Dynamic-link Library Injection,Defense Evasion|Privilege Escalation,TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda
T1055.001,Dynamic-link Library Injection,Defense Evasion|Privilege Escalation,BackdoorDiplomacy|Leviathan|Wizard Spider|TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda
T1037.003,Network Logon Script,Persistence|Privilege Escalation,no
T1543,Create or Modify System Process,Persistence|Privilege Escalation,no
T1037.002,Logon Script (Mac),Persistence|Privilege Escalation,no
@@ -285,13 +423,13 @@ T1037.001,Logon Script (Windows),Persistence|Privilege Escalation,Cobalt Group|A
T1542.003,Bootkit,Persistence|Defense Evasion,APT41|Lazarus Group|APT28
T1542.002,Component Firmware,Persistence|Defense Evasion,Equation
T1542.001,System Firmware,Persistence|Defense Evasion,no
T1505.003,Web Shell,Persistence,Tropic Trooper|Soft Cell|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda
T1505.003,Web Shell,Persistence,BackdoorDiplomacy|APT38|APT29|APT28|Tonto Team|Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda
T1505.002,Transport Agent,Persistence,no
T1505.001,SQL Stored Procedures,Persistence,no
T1053.003,Cron,Execution|Persistence|Privilege Escalation,Rocke
T1505.001,SQL Stored Procedures,Persistence,Sandworm Team
T1053.003,Cron,Execution|Persistence|Privilege Escalation,APT38|Rocke
T1053.004,Launchd,Execution|Persistence|Privilege Escalation,no
T1053.001,At (Linux),Execution|Persistence|Privilege Escalation,no
T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|Machete|Soft Cell|Silence|TEMP.Veles|APT33|APT39|Dragonfly 2.0|Patchwork|OilRig|Rancor|Cobalt Group|FIN8|menuPass|FIN10|APT32|FIN7|Stealth Falcon|FIN6|APT3|APT29
T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,APT37|APT38|Naikon|CostaRicto|Mustang Panda|Higaisa|UNC2452|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|Rancor|OilRig|Patchwork|Dragonfly 2.0|Cobalt Group|FIN8|menuPass|FIN10|FIN7|APT32|Stealth Falcon|FIN6|APT3|APT29
T1053.002,At (Windows),Execution|Persistence|Privilege Escalation,BRONZE BUTLER|Threat Group-3390|APT18
T1542,Pre-OS Boot,Defense Evasion|Persistence,no
T1137.001,Office Template Macros,Persistence,MuddyWater
@@ -301,156 +439,141 @@ T1137.005,Outlook Rules,Persistence,no
T1137.006,Add-ins,Persistence,Naikon
T1137.002,Office Test,Persistence,APT28
T1531,Account Access Removal,Impact,no
T1539,Steal Web Session Cookie,Credential Access,no
T1539,Steal Web Session Cookie,Credential Access,Evilnum
T1529,System Shutdown/Reboot,Impact,Lazarus Group|APT38|APT37
T1518,Software Discovery,Discovery,BRONZE BUTLER|Tropic Trooper|Inception
T1534,Internal Spearphishing,Lateral Movement,Gamaredon Group
T1518,Software Discovery,Discovery,Mustang Panda|Windshift|MuddyWater|Windigo|Sidewinder|Operation Wocao|BRONZE BUTLER|Tropic Trooper|Inception
T1547.013,XDG Autostart Entries,Persistence|Privilege Escalation,no
T1534,Internal Spearphishing,Lateral Movement,Leviathan|Gamaredon Group
T1528,Steal Application Access Token,Credential Access,APT28
T1535,Unused/Unsupported Cloud Regions,Defense Evasion,no
T1525,Implant Container Image,Persistence,no
T1525,Implant Internal Image,Persistence,no
T1538,Cloud Service Dashboard,Discovery,no
T1530,Data from Cloud Storage Object,Collection,no
T1530,Data from Cloud Storage Object,Collection,Fox Kitten
T1578,Modify Cloud Compute Infrastructure,Defense Evasion,no
T1537,Transfer Data to Cloud Account,Exfiltration,no
T1526,Cloud Service Discovery,Discovery,no
T1505,Server Software Component,Persistence,no
T1499,Endpoint Denial of Service,Impact,no
T1497,Virtualization/Sandbox Evasion,Defense Evasion|Discovery,no
T1498,Network Denial of Service,Impact,no
T1496,Resource Hijacking,Impact,Blue Mockingbird|Rocke|APT41|Lazarus Group
T1499,Endpoint Denial of Service,Impact,Sandworm Team
T1497,Virtualization/Sandbox Evasion,Defense Evasion|Discovery,Darkhotel
T1498,Network Denial of Service,Impact,APT28
T1496,Resource Hijacking,Impact,TeamTNT|Blue Mockingbird|Rocke|APT41
T1495,Firmware Corruption,Impact,no
T1491,Defacement,Impact,no
T1490,Inhibit System Recovery,Impact,no
T1489,Service Stop,Impact,Lazarus Group
T1486,Data Encrypted for Impact,Impact,APT41|TA505|APT38
T1489,Service Stop,Impact,Indrik Spider|Wizard Spider|Lazarus Group
T1486,Data Encrypted for Impact,Impact,FIN7|Indrik Spider|APT41|TA505|APT38
T1485,Data Destruction,Impact,Sandworm Team|Lazarus Group|APT38
T1484,Group Policy Modification,Defense Evasion|Privilege Escalation,no
T1482,Domain Trust Discovery,Discovery,Wizard Spider
T1484,Domain Policy Modification,Defense Evasion|Privilege Escalation,no
T1482,Domain Trust Discovery,Discovery,FIN8|APT29|Chimera|UNC2452
T1480,Execution Guardrails,Defense Evasion,no
T1221,Template Injection,Defense Evasion,Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|DarkHydrus|Dragonfly 2.0
T1222,File and Directory Permissions Modification,Defense Evasion,no
T1221,Template Injection,Defense Evasion,Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus
T1220,XSL Script Processing,Defense Evasion,Cobalt Group
T1197,BITS Jobs,Defense Evasion|Persistence,Patchwork|APT41|Leviathan
T1217,Browser Bookmark Discovery,Discovery,no
T1213,Data from Information Repositories,Collection,Turla
T1189,Drive-by Compromise,Initial Access,Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|BRONZE BUTLER|Leafminer|Dark Caracal|APT19|APT32|Lazarus Group|Threat Group-3390|Elderwood|APT37|Patchwork|PLATINUM
T1203,Exploitation for Client Execution,Execution,Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|Lazarus Group|BRONZE BUTLER|Cobalt Group|APT37|Patchwork|Leviathan|Elderwood|TA459|APT29
T1220,XSL Script Processing,Defense Evasion,Higaisa|Cobalt Group
T1217,Browser Bookmark Discovery,Discovery,APT38|Chimera|Fox Kitten
T1212,Exploitation for Credential Access,Credential Access,no
T1189,Drive-by Compromise,Initial Access,Transparent Tribe|Andariel|Leviathan|Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|APT19|Lazarus Group|Threat Group-3390|BRONZE BUTLER|APT32|Dark Caracal|Dragonfly 2.0|Leafminer|Patchwork|APT37|Elderwood|PLATINUM
T1211,Exploitation for Defense Evasion,Defense Evasion,APT28
T1190,Exploit Public-Facing Application,Initial Access,Blue Mockingbird|Rocke|APT39|BlackTech|APT41|Soft Cell|Night Dragon|Axiom
T1210,Exploitation of Remote Services,Lateral Movement,Threat Group-3390|APT28
T1202,Indirect Command Execution,Defense Evasion,no
T1200,Hardware Additions,Initial Access,DarkVishnya
T1201,Password Policy Discovery,Discovery,Turla|OilRig
T1219,Remote Access Software,Command And Control,Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak
T1207,Rogue Domain Controller,Defense Evasion,no
T1199,Trusted Relationship,Initial Access,APT28|menuPass
T1197,BITS Jobs,Defense Evasion|Persistence,APT39|Patchwork|APT41|Leviathan
T1203,Exploitation for Client Execution,Execution,Andariel|Transparent Tribe|APT3|Tonto Team|Mustang Panda|Darkhotel|Higaisa|HAFNIUM|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Cobalt Group|Lazarus Group|Patchwork|Elderwood|APT29|TA459|APT37|Leviathan
T1201,Password Policy Discovery,Discovery,Chimera|Turla|OilRig
T1195,Supply Chain Compromise,Initial Access,no
T1199,Trusted Relationship,Initial Access,APT29|Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass
T1218,Signed Binary Proxy Execution,Defense Evasion,no
T1204,User Execution,Execution,no
T1213,Data from Information Repositories,Collection,APT28|Fox Kitten|FIN6|Turla
T1190,Exploit Public-Facing Application,Initial Access,BackdoorDiplomacy|menuPass|Volatile Cedar|UNC2452|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom
T1210,Exploitation of Remote Services,Lateral Movement,Tonto Team|FIN7|Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28
T1200,Hardware Additions,Initial Access,DarkVishnya
T1202,Indirect Command Execution,Defense Evasion,no
T1219,Remote Access Software,Command And Control,TeamTNT|Mustang Panda|MuddyWater|Evilnum|GOLD SOUTHFIELD|Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Cobalt Group|Thrip|Carbanak
T1207,Rogue Domain Controller,Defense Evasion,no
T1216,Signed Script Proxy Execution,Defense Evasion,no
T1195,Supply Chain Compromise,Initial Access,Elderwood
T1205,Traffic Signaling,Defense Evasion|Persistence|Command And Control,no
T1176,Browser Extensions,Persistence,Kimsuky|Stolen Pencil
T1175,Component Object Model and Distributed COM,Lateral Movement|Execution,no
T1187,Forced Authentication,Credential Access,DarkHydrus|Dragonfly 2.0
T1185,Man in the Browser,Collection,no
T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,Blue Mockingbird
T1136,Create Account,Persistence,no
T1140,Deobfuscate/Decode Files or Information,Defense Evasion,Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|menuPass|Honeybee|Threat Group-3390|APT19|Gorgon Group|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER
T1175,Component Object Model and Distributed COM,Lateral Movement|Execution,no
T1185,Browser Session Hijacking,Collection,no
T1140,Deobfuscate/Decode Files or Information,Defense Evasion,APT39|APT29|ZIRCONIUM|Higaisa|UNC2452|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|Honeybee|Gorgon Group|Threat Group-3390|menuPass|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER
T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,FIN6|Blue Mockingbird
T1149,LC_MAIN Hijacking,Defense Evasion,no
T1135,Network Share Discovery,Discovery,APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug
T1136,Create Account,Persistence,Sandworm Team|Indrik Spider
T1135,Network Share Discovery,Discovery,Tonto Team|APT38|Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug
T1137,Office Application Startup,Persistence,Gamaredon Group|APT32
T1153,Source,Execution,no
T1133,External Remote Services,Persistence|Initial Access,Sandworm Team|APT41|Soft Cell|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18
T1133,External Remote Services,Persistence|Initial Access,TeamTNT|Leviathan|APT28|APT29|UNC2452|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|Ke3chang|OilRig|Dragonfly 2.0|FIN5|Threat Group-3390|APT18
T1132,Data Encoding,Command And Control,no
T1129,Shared Modules,Execution,no
T1127,Trusted Developer Utilities Proxy Execution,Defense Evasion,no
T1125,Video Capture,Collection,Silence|FIN7
T1124,System Time Discovery,Discovery,The White Company|Lazarus Group|BRONZE BUTLER|Turla
T1124,System Time Discovery,Discovery,Darkhotel|ZIRCONIUM|Higaisa|Sidewinder|Chimera|Operation Wocao|The White Company|Lazarus Group|BRONZE BUTLER|Turla
T1123,Audio Capture,Collection,APT37
T1120,Peripheral Device Discovery,Discovery,Turla|APT37|Gamaredon Group|Equation|APT28
T1119,Automated Collection,Collection,Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6
T1115,Clipboard Data,Collection,APT39|APT38
T1114,Email Collection,Collection,no
T1113,Screen Capture,Collection,Gamaredon Group|APT39|Silence|MuddyWater|Dragonfly 2.0|OilRig|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28
T1112,Modify Registry,Defense Evasion,Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Honeybee|Patchwork|Gorgon Group|FIN8
T1111,Two-Factor Authentication Interception,Credential Access,no
T1110,Brute Force,Credential Access,DarkVishnya|APT39|OilRig|FIN5|Turla
T1120,Peripheral Device Discovery,Discovery,OilRig|BackdoorDiplomacy|Operation Wocao|Turla|APT37|Gamaredon Group|Equation|APT28
T1119,Automated Collection,Collection,Mustang Panda|Sidewinder|Chimera|menuPass|Operation Wocao|Gamaredon Group|Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6
T1115,Clipboard Data,Collection,Operation Wocao|APT39|APT38
T1114,Email Collection,Collection,Magic Hound|Silent Librarian
T1113,Screen Capture,Collection,GOLD SOUTHFIELD|Gamaredon Group|APT39|Silence|MuddyWater|Dragonfly 2.0|OilRig|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28
T1112,Modify Registry,Defense Evasion,Operation Wocao|Kimsuky|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Patchwork|Gorgon Group|Threat Group-3390|Dragonfly 2.0|APT19|Honeybee|FIN8
T1111,Two-Factor Authentication Interception,Credential Access,Chimera|Operation Wocao
T1110,Brute Force,Credential Access,APT38|APT28|Fox Kitten|DarkVishnya|APT39|OilRig|FIN5|Turla
T1108,Redundant Access,Defense Evasion|Persistence,no
T1106,Native API,Execution,Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|Gorgon Group|APT37
T1105,Ingress Tool Transfer,Command And Control,Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|Soft Cell|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Turla|Gorgon Group|OilRig|Dragonfly 2.0|APT37|FIN8|PLATINUM|Leviathan|Elderwood|Magic Hound|APT3|APT32|BRONZE BUTLER|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28
T1106,Native API,Execution,APT38|Higaisa|menuPass|Operation Wocao|Chimera|Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|APT37|Gorgon Group
T1105,Ingress Tool Transfer,Command And Control,TeamTNT|Nomadic Octopus|IndigoZebra|Andariel|BackdoorDiplomacy|Tonto Team|HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|UNC2452|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Gorgon Group|OilRig|Turla|Cobalt Group|Dragonfly 2.0|FIN8|PLATINUM|APT37|Elderwood|Leviathan|APT32|Magic Hound|BRONZE BUTLER|APT3|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28
T1104,Multi-Stage Channels,Command And Control,APT41|MuddyWater|APT3
T1102,Web Service,Command And Control,Gamaredon Group|Rocke|Inception|FIN6
T1098,Account Manipulation,Persistence,APT3|Dragonfly 2.0|Lazarus Group
T1095,Non-Application Layer Protocol,Command And Control,APT29|PLATINUM|APT3
T1102,Web Service,Command And Control,TeamTNT|FIN8|Fox Kitten|Turla|APT32|Gamaredon Group|Rocke|Inception|FIN6
T1098,Account Manipulation,Persistence,Sandworm Team|APT3|Dragonfly 2.0|Lazarus Group
T1095,Non-Application Layer Protocol,Command And Control,BackdoorDiplomacy|HAFNIUM|Operation Wocao|FIN6|APT29|PLATINUM|APT3
T1092,Communication Through Removable Media,Command And Control,APT28
T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Tropic Trooper|Darkhotel|APT28
T1090,Proxy,Command And Control,Sandworm Team|Blue Mockingbird|Wizard Spider|APT41|Turla
T1087,Account Discovery,Discovery,no
T1083,File and Directory Discovery,Discovery,Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dark Caracal|Dragonfly 2.0|Magic Hound|Sowbug|BRONZE BUTLER|APT3|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang
T1082,System Information Discovery,Discovery,Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|Honeybee|APT19|APT37|APT32|Magic Hound|OilRig|APT3|Sowbug|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang
T1080,Taint Shared Content,Lateral Movement,BRONZE BUTLER|Darkhotel
T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Sandworm Team|Wizard Spider|Silence|APT41|Soft Cell|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|Leviathan|APT33|OilRig|FIN5|menuPass|APT28|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak
T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Mustang Panda|Tropic Trooper|Darkhotel|APT28
T1090,Proxy,Command And Control,Windigo|Fox Kitten|Operation Wocao|Sandworm Team|Blue Mockingbird|APT41|Turla
T1087,Account Discovery,Discovery,APT29|UNC2452
T1083,File and Directory Discovery,Discovery,APT38|APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|UNC2452|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dark Caracal|Dragonfly 2.0|APT3|Sowbug|Magic Hound|BRONZE BUTLER|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang
T1082,System Information Discovery,Discovery,TeamTNT|APT38|APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|UNC2452|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT32|APT37|Honeybee|APT19|Magic Hound|Sowbug|OilRig|APT3|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang
T1080,Taint Shared Content,Lateral Movement,Gamaredon Group|BRONZE BUTLER|Darkhotel
T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,FIN7|Leviathan|APT29|Silent Librarian|UNC2452|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|APT33|FIN5|OilRig|APT28|menuPass|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak
T1074,Data Staged,Collection,Wizard Spider
T1072,Software Deployment Tools,Execution|Lateral Movement,Silence|APT32|Threat Group-1314
T1071,Application Layer Protocol,Command And Control,Rocke|Magic Hound|Dragonfly 2.0
T1070,Indicator Removal on Host,Defense Evasion,no
T1069,Permission Groups Discovery,Discovery,TA505|APT3
T1068,Exploitation for Privilege Escalation,Privilege Escalation,Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28
T1071,Application Layer Protocol,Command And Control,TeamTNT|Rocke|Magic Hound|Dragonfly 2.0
T1070,Indicator Removal on Host,Defense Evasion,APT29|UNC2452
T1069,Permission Groups Discovery,Discovery,APT29|UNC2452|TA505|APT3
T1068,Exploitation for Privilege Escalation,Privilege Escalation,Tonto Team|ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28
T1064,Scripting,Defense Evasion|Execution,no
T1062,Hypervisor,Persistence,no
T1061,Graphical User Interface,Execution,no
T1059,Command and Scripting Interpreter,Execution,APT32|Molerats|Whitefly|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang
T1057,Process Discovery,Discovery,Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang
T1056,Input Capture,Collection|Credential Access,no
T1055,Process Injection,Defense Evasion|Privilege Escalation,APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM
T1059,Command and Scripting Interpreter,Execution,APT37|Windigo|Fox Kitten|APT32|Whitefly|APT39|Dragonfly 2.0|FIN7|APT19|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang
T1057,Process Discovery,Discovery,TeamTNT|Andariel|APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|UNC2452|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang
T1056,Input Capture,Collection|Credential Access,APT39
T1055,Process Injection,Defense Evasion|Privilege Escalation,Operation Wocao|APT32|Sharpshooter|Silence|APT41|Kimsuky|Cobalt Group|Turla|APT37|Honeybee|PLATINUM
T1053,Scheduled Task/Job,Execution|Persistence|Privilege Escalation,no
T1052,Exfiltration Over Physical Medium,Exfiltration,no
T1051,Shared Webroot,Lateral Movement,no
T1049,System Network Connections Discovery,Discovery,Tropic Trooper|APT41|APT38|Soft Cell|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang
T1049,System Network Connections Discovery,Discovery,TeamTNT|Andariel|BackdoorDiplomacy|Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang
T1048,Exfiltration Over Alternative Protocol,Exfiltration,no
T1047,Windows Management Instrumentation,Execution,Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|Soft Cell|APT32|MuddyWater|OilRig|Threat Group-3390|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda
T1046,Network Service Scanning,Discovery,Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|Leafminer|OilRig|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390
T1043,Commonly Used Port,Command And Control,Machete|OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|Dragonfly 2.0|FIN7|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390
T1041,Exfiltration Over C2 Channel,Exfiltration,Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|Soft Cell|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang
T1040,Network Sniffing,Credential Access|Discovery,Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28
T1039,Data from Network Shared Drive,Collection,Sowbug|BRONZE BUTLER|menuPass
T1047,Windows Management Instrumentation,Execution,Sandworm Team|FIN7|Indrik Spider|Naikon|Mustang Panda|Windshift|UNC2452|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|Threat Group-3390|OilRig|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda
T1046,Network Service Scanning,Discovery,TeamTNT|BackdoorDiplomacy|Naikon|CostaRicto|Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|OilRig|Cobalt Group|Leafminer|menuPass|Suckfly|FIN6|Threat Group-3390
T1043,Commonly Used Port,Command And Control,OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|FIN7|APT19|Dragonfly 2.0|FIN8|APT37|APT3|Magic Hound|Lazarus Group|Threat Group-3390
T1041,Exfiltration Over C2 Channel,Exfiltration,Leviathan|ZIRCONIUM|Higaisa|Chimera|APT39|Operation Wocao|Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|GALLIUM|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang
T1040,Network Sniffing,Credential Access|Discovery,Kimsuky|Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28
T1039,Data from Network Shared Drive,Collection,APT28|Chimera|Fox Kitten|Gamaredon Group|BRONZE BUTLER|Sowbug|menuPass
T1037,Boot or Logon Initialization Scripts,Persistence|Privilege Escalation,Rocke
T1036,Masquerading,Defense Evasion,Windshift|APT32|BRONZE BUTLER|menuPass|Dragonfly 2.0
T1036,Masquerading,Defense Evasion,APT28|Nomadic Octopus|OilRig|APT29|ZIRCONIUM|TA551|UNC2452|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM|Dragonfly 2.0
T1034,Path Interception,Persistence|Privilege Escalation,no
T1033,System Owner/User Discovery,Discovery,Frankenstein|APT41|Soft Cell|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3
T1030,Data Transfer Size Limits,Exfiltration,Threat Group-3390
T1029,Scheduled Transfer,Exfiltration,no
T1027,Obfuscated Files or Information,Defense Evasion,Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|Machete|Soft Cell|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Cobalt Group|Patchwork|Leafminer|APT37|Threat Group-3390|Honeybee|Dark Caracal|menuPass|APT19|BlackOasis|FIN8|Leviathan|Elderwood|MuddyWater|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28
T1033,System Owner/User Discovery,Discovery,APT38|Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|APT37|Dragonfly 2.0|APT19|APT32|Magic Hound|OilRig|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3
T1030,Data Transfer Size Limits,Exfiltration,APT28|Threat Group-3390
T1029,Scheduled Transfer,Exfiltration,Higaisa
T1027,Obfuscated Files or Information,Defense Evasion,TeamTNT|BackdoorDiplomacy|Transparent Tribe|APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Patchwork|menuPass|APT37|Threat Group-3390|Cobalt Group|Dark Caracal|Leafminer|Honeybee|APT19|BlackOasis|Leviathan|FIN8|MuddyWater|FIN7|Elderwood|OilRig|Magic Hound|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28
T1026,Multiband Communication,Command And Control,Lazarus Group
T1025,Data from Removable Media,Collection,Machete|Turla|Gamaredon Group|APT28
T1025,Data from Removable Media,Collection,Turla|Gamaredon Group|APT28
T1021,Remote Services,Lateral Movement,no
T1020,Automated Exfiltration,Exfiltration,Tropic Trooper|Frankenstein|Honeybee
T1018,Remote System Discovery,Discovery,Sandworm Team|Rocke|Wizard Spider|Silence|Soft Cell|APT39|APT32|Deep Panda|Threat Group-3390|Dragonfly 2.0|Leafminer|Ke3chang|FIN8|APT3|FIN5|BRONZE BUTLER|menuPass|FIN6|Turla
T1016,System Network Configuration Discovery,Discovery,Sandworm Team|Tropic Trooper|Frankenstein|APT41|Soft Cell|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang
T1014,Rootkit,Defense Evasion,Rocke|APT41|APT28|Winnti Group
T1012,Query Registry,Discovery,APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla
T1020,Automated Exfiltration,Exfiltration,Sidewinder|Gamaredon Group|Tropic Trooper|Frankenstein|Honeybee
T1018,Remote System Discovery,Discovery,Indrik Spider|Naikon|APT29|UNC2452|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Deep Panda|Ke3chang|Threat Group-3390|Dragonfly 2.0|Leafminer|FIN8|FIN5|APT3|BRONZE BUTLER|menuPass|FIN6|Turla
T1016,System Network Configuration Discovery,Discovery,TeamTNT|ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|Threat Group-3390|menuPass|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang
T1014,Rootkit,Defense Evasion,TeamTNT|Rocke|APT41|APT28|Winnti Group
T1012,Query Registry,Discovery,ZIRCONIUM|Chimera|Fox Kitten|APT39|Operation Wocao|APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla
T1011,Exfiltration Over Other Network Medium,Exfiltration,no
T1010,Application Window Discovery,Discovery,Lazarus Group
T1008,Fallback Channels,Command And Control,APT41|OilRig|Lazarus Group
T1007,System Service Discovery,Discovery,BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang
T1008,Fallback Channels,Command And Control,FIN7|APT41|OilRig|Lazarus Group
T1007,System Service Discovery,Discovery,Indrik Spider|Chimera|Operation Wocao|BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang
T1006,Direct Volume Access,Defense Evasion,no
T1005,Data from Local System,Collection,Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|Soft Cell|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang
T1003,OS Credential Dumping,Credential Access,APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom
T1001,Data Obfuscation,Command And Control,Axiom
T1204.003,Malicious Image,Execution,no
T1580,Cloud Infrastructure Discovery,Discovery,no
T1547.014,Active Setup,Persistence|Privilege Escalation,no
T1595,Active Scanning,Reconnaissance,no
T1558.004,AS-REP Roasting,Credential Access,no
T1053.006,Systemd Timers,Execution|Persistence|Privilege Escalation,no
T1016.001,Internet Connection Discovery,Discovery,no
T1547.012,Print Processors,Persistence|Privilege Escalation,no
T1592,Gather Victim Host Information,Reconnaissance,no
T1218.012,Verclsid,Defense Evasion,no
T1590,Gather Victim Network Information,Reconnaissance,no
T1590.005,IP Addresses,Reconnaissance,no
T1588.002,Tool,Resource Development,no
T1557.002,ARP Cache Poisoning,Credential Access|Collection,no
T1542.005,TFTP Boot,Defense Evasion|Persistence,no
T1020.001,Traffic Duplication,Exfiltration,no
T1005,Data from Local System,Collection,FIN7|APT41|APT38|Andariel|APT29|Windigo|UNC2452|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang
T1003,OS Credential Dumping,Credential Access,Tonto Team|APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom
T1001,Data Obfuscation,Command And Control,Operation Wocao|Axiom
1 mitre_id technique tactics groups
2 T1205.001 T1564.009 Port Knocking Resource Forking Defense Evasion|Persistence|Command And Control Defense Evasion no
3 T1562.010 Downgrade Attack Defense Evasion no
4 T1547.015 Login Items Persistence|Privilege Escalation no
5 T1620 Reflective Code Loading Defense Evasion no
6 T1619 Cloud Storage Object Discovery Discovery no
7 T1218.014 MMC Defense Evasion no
8 T1218.013 Mavinject Defense Evasion no
9 T1614.001 System Language Discovery Discovery no
10 T1615 Group Policy Discovery Discovery Turla
11 T1036.007 Double File Extension Defense Evasion Mustang Panda
12 T1562.009 Safe Mode Boot Defense Evasion no
13 T1564.008 Email Hiding Rules Defense Evasion FIN4
14 T1505.004 IIS Components Persistence no
15 T1027.006 HTML Smuggling Defense Evasion no
16 T1213.003 Code Repositories Collection APT29
17 T1553.006 Code Signing Policy Modification Defense Evasion Turla|APT39
18 T1614 System Location Discovery Discovery no
19 T1613 Container and Resource Discovery Discovery TeamTNT
20 T1552.007 Container API Credential Access no
21 T1612 Build Image on Host Defense Evasion no
22 T1611 Escape to Host Privilege Escalation TeamTNT
23 T1204.003 Malicious Image Execution TeamTNT
24 T1053.007 Container Orchestration Job Execution|Persistence|Privilege Escalation no
25 T1610 Deploy Container Defense Evasion|Execution TeamTNT
26 T1609 Container Administration Command Execution TeamTNT
27 T1608.005 Link Target Resource Development Silent Librarian
28 T1608.004 Drive-by Target Resource Development Transparent Tribe|APT32|Threat Group-3390
29 T1608.003 Install Digital Certificate Resource Development no
30 T1608.002 Upload Tool Resource Development Threat Group-3390
31 T1608.001 Upload Malware Resource Development TeamTNT|APT32
32 T1608 Stage Capabilities Resource Development no
33 T1016.001 Internet Connection Discovery Discovery APT29|UNC2452|Turla
34 T1553.005 Mark-of-the-Web Bypass Defense Evasion TA505
35 T1555.005 Password Managers Credential Access Fox Kitten|Operation Wocao
36 T1484.002 Domain Trust Modification Defense Evasion|Privilege Escalation APT29|UNC2452
37 T1484.001 Group Policy Modification Defense Evasion|Privilege Escalation Indrik Spider
38 T1547.014 Active Setup Persistence|Privilege Escalation no
39 T1606.002 SAML Tokens Credential Access APT29|UNC2452
40 T1606.001 Web Cookies Credential Access APT29|UNC2452
41 T1606 Forge Web Credentials Credential Access no
42 T1555.004 Windows Credential Manager Credential Access Stealth Falcon|OilRig|Turla
43 T1059.008 Network Device CLI Execution no
44 T1602.002 Network Device Configuration Dump Collection no
45 T1542.005 TFTP Boot Defense Evasion|Persistence no
46 T1542.004 ROMMONkit Defense Evasion|Persistence no
47 T1602.001 SNMP (MIB Dump) Collection no
48 T1602 Data from Configuration Repository Collection no
49 T1601.002 Downgrade System Image Defense Evasion no
50 T1601.001 Patch System Image Defense Evasion no
51 T1601 Modify System Image Defense Evasion no
52 T1600.002 Disable Crypto Hardware Defense Evasion no
53 T1600.001 Reduce Key Space Defense Evasion no
54 T1600 Weaken Encryption Defense Evasion no
55 T1556.004 Network Device Authentication Credential Access|Defense Evasion|Persistence no
56 T1599.001 Network Address Translation Traversal Defense Evasion no
57 T1599 Network Boundary Bridging Defense Evasion no
58 T1020.001 Traffic Duplication Exfiltration no
59 T1557.002 ARP Cache Poisoning Credential Access|Collection Cleaver
60 T1588.006 Vulnerabilities Resource Development Sandworm Team
61 T1053.006 Systemd Timers Execution|Persistence|Privilege Escalation no
62 T1562.008 Disable Cloud Logs Defense Evasion no
63 T1547.012 Print Processors Persistence|Privilege Escalation no
64 T1598.003 Spearphishing Link Reconnaissance Magic Hound|Silent Librarian|Sidewinder|Sandworm Team|APT32|Kimsuky
65 T1598.002 Spearphishing Attachment Reconnaissance Sidewinder
66 T1598.001 Spearphishing Service Reconnaissance no
67 T1598 Phishing for Information Reconnaissance ZIRCONIUM|APT28
68 T1597.002 Purchase Technical Data Reconnaissance no
69 T1597.001 Threat Intel Vendors Reconnaissance no
70 T1597 Search Closed Sources Reconnaissance no
71 T1596.005 Scan Databases Reconnaissance no
72 T1596.004 CDNs Reconnaissance no
73 T1596.003 Digital Certificates Reconnaissance no
74 T1596.001 DNS/Passive DNS Reconnaissance no
75 T1596.002 WHOIS Reconnaissance no
76 T1596 Search Open Technical Databases Reconnaissance no
77 T1595.002 Vulnerability Scanning Reconnaissance TeamTNT|APT29|Volatile Cedar|APT28|Sandworm Team
78 T1595.001 Scanning IP Blocks Reconnaissance TeamTNT
79 T1595 Active Scanning Reconnaissance no
80 T1594 Search Victim-Owned Websites Reconnaissance Silent Librarian|Sandworm Team
81 T1593.002 Search Engines Reconnaissance no
82 T1593.001 Social Media Reconnaissance Kimsuky
83 T1593 Search Open Websites/Domains Reconnaissance Sandworm Team
84 T1592.004 Client Configurations Reconnaissance HAFNIUM
85 T1592.003 Firmware Reconnaissance no
86 T1592.002 Software Reconnaissance Andariel|Sandworm Team
87 T1592.001 Hardware Reconnaissance no
88 T1592 Gather Victim Host Information Reconnaissance no
89 T1591.004 Identify Roles Reconnaissance no
90 T1591.003 Identify Business Tempo Reconnaissance no
91 T1591.001 Determine Physical Locations Reconnaissance no
92 T1591.002 Business Relationships Reconnaissance Sandworm Team
93 T1591 Gather Victim Org Information Reconnaissance no
94 T1590.006 Network Security Appliances Reconnaissance no
95 T1590.005 IP Addresses Reconnaissance Andariel|HAFNIUM
96 T1590.004 Network Topology Reconnaissance no
97 T1590.003 Network Trust Dependencies Reconnaissance no
98 T1590.002 DNS Reconnaissance no
99 T1590.001 Domain Properties Reconnaissance Sandworm Team
100 T1590 Gather Victim Network Information Reconnaissance HAFNIUM
101 T1589.003 Employee Names Reconnaissance Silent Librarian|Sandworm Team
102 T1589.002 Email Addresses Reconnaissance Kimsuky|Magic Hound|TA551|MuddyWater|HAFNIUM|APT32|Silent Librarian|Sandworm Team
103 T1589.001 Credentials Reconnaissance Leviathan|APT28|Magic Hound|Chimera
104 T1589 Gather Victim Identity Information Reconnaissance Magic Hound|APT32
105 T1588.005 Exploits Resource Development no
106 T1588.004 Digital Certificates Resource Development Lazarus Group|Silent Librarian
107 T1588.003 Code Signing Certificates Resource Development Wizard Spider
108 T1588.002 Tool Resource Development CostaRicto|Night Dragon|DarkVishnya|FIN5|Gorgon Group|Patchwork|Chimera|Dragonfly|Blue Mockingbird|Whitefly|APT41|FIN6|TEMP.Veles|Kimsuky|PittyTiger|Cobalt Group|APT29|Thrip|Ke3chang|DarkHydrus|APT32|APT38|BRONZE BUTLER|Carbanak|Cleaver|Inception|Leafminer|Threat Group-3390|Ferocious Kitten|IndigoZebra|BackdoorDiplomacy|menuPass|APT-C-36|Magic Hound|APT28|Wizard Spider|Frankenstein|Silence|WIRTE|Turla|APT33|APT19|FIN10|CopyKittens|APT39|APT1|MuddyWater|Silent Librarian|GALLIUM|Sandworm Team
109 T1588.001 Malware Resource Development Andariel|BackdoorDiplomacy|Turla|APT1
110 T1588 Obtain Capabilities Resource Development no
111 T1587.004 Exploits Resource Development no
112 T1587.003 Digital Certificates Resource Development APT29|PROMETHIUM
113 T1587.002 Code Signing Certificates Resource Development PROMETHIUM|Patchwork
114 T1587.001 Malware Resource Development TeamTNT|APT29|Lazarus Group|UNC2452|Sandworm Team|Turla|FIN7|Night Dragon|Cleaver
115 T1587 Develop Capabilities Resource Development Kimsuky
116 T1586.002 Email Accounts Resource Development IndigoZebra|Leviathan|Magic Hound|Kimsuky
117 T1586.001 Social Media Accounts Resource Development Leviathan
118 T1586 Compromise Accounts Resource Development no
119 T1585.002 Email Accounts Resource Development Leviathan|Magic Hound|Silent Librarian|Sandworm Team|APT1
120 T1585.001 Social Media Accounts Resource Development Leviathan|Magic Hound|Fox Kitten|Sandworm Team|APT32|Cleaver
121 T1585 Establish Accounts Resource Development Fox Kitten|APT17
122 T1584.006 Web Services Resource Development Turla
123 T1584.005 Botnet Resource Development no
124 T1584.004 Server Resource Development Indrik Spider|Turla|APT16
125 T1584.003 Virtual Private Server Resource Development Turla
126 T1584.002 DNS Server Resource Development no
127 T1584.001 Domains Resource Development Transparent Tribe|Magic Hound|APT29|UNC2452|APT1
128 T1583.006 Web Services Resource Development IndigoZebra|ZIRCONIUM|MuddyWater|HAFNIUM|Lazarus Group|Turla|APT32|APT17|APT29
129 T1583.005 Botnet Resource Development no
130 T1583.004 Server Resource Development GALLIUM|Sandworm Team
131 T1583.003 Virtual Private Server Resource Development HAFNIUM|TEMP.Veles
132 T1583.002 DNS Server Resource Development no
133 T1584 Compromise Infrastructure Resource Development no
134 T1583.001 Domains Resource Development IndigoZebra|TeamTNT|Ferocious Kitten|FIN7|Transparent Tribe|Leviathan|Magic Hound|APT29|Mustang Panda|ZIRCONIUM|UNC2452|Lazarus Group|Silent Librarian|menuPass|Sandworm Team|APT32|Kimsuky|APT1|APT28
135 T1583 Acquire Infrastructure Resource Development no
136 T1564.007 VBA Stomping Defense Evasion no
137 T1558.004 AS-REP Roasting Credential Access no
138 T1580 Cloud Infrastructure Discovery Discovery no
139 T1218.012 Verclsid Defense Evasion no
140 T1205.001 Port Knocking Defense Evasion|Persistence|Command And Control PROMETHIUM
141 T1564.006 Run Virtual Instance Defense Evasion no
142 T1564.005 Hidden File System Defense Evasion Strider|Equation
143 T1556.003 Pluggable Authentication Modules Credential Access|Defense Evasion Credential Access|Defense Evasion|Persistence no
144 T1574.012 COR_PROFILER Persistence|Privilege Escalation|Defense Evasion Blue Mockingbird
145 T1562.007 Disable or Modify Cloud Firewall Defense Evasion no
146 T1098.004 SSH Authorized Keys Persistence no TeamTNT
147 T1480.001 Environmental Keying Defense Evasion APT41|Equation
148 T1059.007 JavaScript/JScript JavaScript Execution APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer Indrik Spider|MuddyWater|Turla|Higaisa|Sidewinder|Evilnum|Kimsuky|FIN6|APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer
149 T1578.004 Revert Cloud Instance Defense Evasion no
150 T1578.003 Delete Cloud Instance Defense Evasion no
151 T1578.001 Create Snapshot Defense Evasion no
152 T1578.002 Create Cloud Instance Defense Evasion no
153 T1127.001 MSBuild Defense Evasion Frankenstein
154 T1027.005 Indicator Removal from Tools Defense Evasion Soft Cell|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda
155 T1562.006 Indicator Blocking Defense Evasion no
156 T1573.002 Asymmetric Cryptography Command And Control Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6 Operation Wocao|Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6
157 T1573.001 Symmetric Cryptography Command And Control Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group Mustang Panda|Darkhotel|ZIRCONIUM|Higaisa|Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group
158 T1573 Encrypted Channel Command And Control Tropic Trooper
159 T1027.004 Compile After Delivery Defense Evasion Gamaredon Group|Rocke|MuddyWater
160 T1574.004 Dylib Hijacking Persistence|Privilege Escalation|Defense Evasion no
161 T1546.015 Component Object Model Hijacking Privilege Escalation|Persistence APT28
162 T1071.004 DNS Command And Control APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7 Chimera|APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7
163 T1071.003 Mail Protocols Command And Control APT32|SilverTerrier|APT28 Turla|Kimsuky|APT32|SilverTerrier|APT28
164 T1071.002 File Transfer Protocols Command And Control APT41|SilverTerrier|Machete|Honeybee Kimsuky|APT41|SilverTerrier|Honeybee
165 T1071.001 Web Protocols Command And Control Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|Machete|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Cobalt Group|APT19|Threat Group-3390|Rancor|Orangeworm|APT37|Ke3chang|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|APT32|OilRig|Magic Hound|Gamaredon Group|Stealth Falcon TeamTNT|FIN8|APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|UNC2452|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Rancor|Ke3chang|Orangeworm|APT37|APT19|Cobalt Group|Threat Group-3390|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|Magic Hound|APT32|OilRig|Gamaredon Group|Stealth Falcon
166 T1572 Protocol Tunneling Command And Control OilRig|Cobalt Group|FIN6 Leviathan|CostaRicto|Chimera|Fox Kitten|OilRig|Cobalt Group|FIN6
167 T1048.003 Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol Exfiltration APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group Wizard Spider|FIN6|APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group
168 T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol Exfiltration no APT28|APT29|UNC2452
169 T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol Exfiltration no
170 T1001.003 Protocol Impersonation Command And Control Lazarus Group Higaisa|Lazarus Group
171 T1001.002 Steganography Command And Control Axiom APT29|Axiom
172 T1001.001 Junk Data Command And Control APT28
173 T1132.002 Non-Standard Encoding Command And Control no
174 T1132.001 Standard Encoding Command And Control Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork HAFNIUM|TA551|Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork
175 T1090.004 Domain Fronting Command And Control APT29
176 T1090.003 Multi-hop Proxy Command And Control Inception|FIN4|APT29 Leviathan|CostaRicto|APT28|Operation Wocao|Inception|FIN4|APT29
177 T1090.002 External Proxy Command And Control APT39|Silence|Soft Cell|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28 Tonto Team|APT39|Silence|GALLIUM|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28
178 T1090.001 Internal Proxy Command And Control APT39|Strider APT29|Higaisa|UNC2452|Operation Wocao|APT39|Strider
179 T1102.003 One-Way Communication Command And Control Leviathan
180 T1102.002 Bidirectional Communication Command And Control Sandworm Team|APT39|APT12|Turla|FIN7|APT37|Magic Hound|Carbanak ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|Turla|FIN7|APT37|Magic Hound|Carbanak
181 T1102.001 Dead Drop Resolver Command And Control Rocke|APT41|BRONZE BUTLER|RTM|Patchwork
182 T1571 Non-Standard Port Command And Control Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7
183 T1074.002 Remote Data Staging Collection Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8 Leviathan|APT28|APT29|Chimera|UNC2452|Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8
184 T1074.001 Local Data Staging Collection Machete|Soft Cell|TEMP.Veles|Patchwork|Dragonfly 2.0|Honeybee|Leviathan|APT3|FIN5|menuPass|FIN6|Lazarus Group|Threat Group-3390|APT28 Indrik Spider|BackdoorDiplomacy|Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|Honeybee|Dragonfly 2.0|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28
185 T1078.004 Cloud Accounts Defense Evasion|Persistence|Privilege Escalation|Initial Access APT33 APT28|APT33
186 T1564.004 NTFS File Attributes Defense Evasion APT32
187 T1564.003 Hidden Window Defense Evasion Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound Nomadic Octopus|Higaisa|Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound
188 T1078.003 Local Accounts Defense Evasion|Persistence|Privilege Escalation|Initial Access Tropic Trooper|FIN10|Stolen Pencil|APT32 Kimsuky|HAFNIUM|Turla|Operation Wocao|PROMETHIUM|Tropic Trooper|FIN10|Stolen Pencil|APT32
189 T1078.002 Domain Accounts Defense Evasion|Persistence|Privilege Escalation|Initial Access TA505|APT3|Threat Group-1314 Naikon|Indrik Spider|Chimera|Operation Wocao|Sandworm Team|Wizard Spider|APT29|TA505|APT3|Threat Group-1314
190 T1078.001 Default Accounts Defense Evasion|Persistence|Privilege Escalation|Initial Access no
191 T1564.002 Hidden Users Defense Evasion no Dragonfly 2.0
192 T1574.006 LD_PRELOAD Dynamic Linker Hijacking Persistence|Privilege Escalation|Defense Evasion Rocke APT41|Rocke
193 T1574.002 DLL Side-Loading Persistence|Privilege Escalation|Defense Evasion BRONZE BUTLER|Naikon|APT41|Soft Cell|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390 Mustang Panda|Higaisa|BlackTech|Sidewinder|Chimera|BRONZE BUTLER|Naikon|APT41|GALLIUM|Tropic Trooper|APT19|Patchwork|APT32|APT3|menuPass|Threat Group-3390
194 T1574.001 DLL Search Order Hijacking Persistence|Privilege Escalation|Defense Evasion Whitefly|RTM|Threat Group-3390|menuPass BackdoorDiplomacy|Tonto Team|Evilnum|APT41|Whitefly|RTM|Threat Group-3390|menuPass
195 T1574.008 Path Interception by Search Order Hijacking Persistence|Privilege Escalation|Defense Evasion no
196 T1574.007 Path Interception by PATH Environment Variable Persistence|Privilege Escalation|Defense Evasion no
197 T1574.009 Path Interception by Unquoted Path Persistence|Privilege Escalation|Defense Evasion no
199 T1574.005 Executable Installer File Permissions Weakness Persistence|Privilege Escalation|Defense Evasion no
200 T1574.010 Services File Permissions Weakness Persistence|Privilege Escalation|Defense Evasion no
201 T1574 Hijack Execution Flow Persistence|Privilege Escalation|Defense Evasion no
202 T1069.001 Local Groups Discovery Turla|OilRig|admin@338 Tonto Team|Chimera|Operation Wocao|Turla|OilRig|admin@338
203 T1570 Lateral Tool Transfer Lateral Movement APT32|Wizard Spider|Turla|FIN10 Sandworm Team|Chimera|GALLIUM|Operation Wocao|APT32|Wizard Spider|Turla|FIN10
204 T1568.003 DNS Calculation Command And Control APT12
205 T1204.002 Malicious File Execution Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|APT19|Dragonfly 2.0|BRONZE BUTLER|Cobalt Group|DarkHydrus|Gorgon Group|Patchwork|OilRig|Dark Caracal|MuddyWater|Lazarus Group|FIN7|APT32|Rancor|APT37|FIN8|APT28|Elderwood|TA459|APT29|Leviathan|menuPass|PLATINUM Nomadic Octopus|Indrik Spider|APT38|Andariel|Ferocious Kitten|IndigoZebra|Transparent Tribe|Tonto Team|Magic Hound|Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Dragonfly 2.0|FIN7|BRONZE BUTLER|Gorgon Group|OilRig|Dark Caracal|Cobalt Group|DarkHydrus|Rancor|Patchwork|APT32|APT19|MuddyWater|Lazarus Group|menuPass|APT37|Leviathan|TA459|APT29|APT28|FIN8|PLATINUM|Elderwood
206 T1204.001 Malicious Link Execution Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla FIN7|Transparent Tribe|APT3|Magic Hound|APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|Turla|APT33
207 T1195.003 Compromise Hardware Supply Chain Initial Access no
208 T1195.002 Compromise Software Supply Chain Initial Access Sandworm Team|APT41 APT29|UNC2452|Cobalt Group|GOLD SOUTHFIELD|Dragonfly|Sandworm Team|APT41
209 T1195.001 Compromise Software Dependencies and Development Tools Initial Access no
210 T1568.001 Fast Flux DNS Command And Control TA505 menuPass|TA505
211 T1052.001 Exfiltration over USB Exfiltration Tropic Trooper Mustang Panda|Tropic Trooper
212 T1569.002 Service Execution Execution Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang APT38|Chimera|Operation Wocao|Wizard Spider|Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang
213 T1569.001 Launchctl Execution no
214 T1569 System Services Execution no
215 T1568.002 Domain Generation Algorithms Command And Control APT41 TA551|APT41
216 T1568 Dynamic Resolution Command And Control no Transparent Tribe|APT29|UNC2452
217 T1011.001 Exfiltration Over Bluetooth Exfiltration no
218 T1567.002 Exfiltration to Cloud Storage Exfiltration Leviathan|Turla FIN7|ZIRCONIUM|HAFNIUM|Chimera|Leviathan|Turla
219 T1567.001 Exfiltration to Code Repository Exfiltration no
220 T1059.006 Python Execution Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete Tonto Team|APT37|ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete
221 T1059.005 Visual Basic Execution APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound OilRig|APT38|Transparent Tribe|APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound
222 T1059.004 Unix Shell Execution Rocke|APT41 TeamTNT|Rocke|APT41
223 T1059.003 Windows Command Shell Execution TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|Soft Cell|Turla|Silence|APT32|APT39|Darkhotel|MuddyWater|APT18|APT38|Dark Caracal|Gorgon Group|Dragonfly 2.0|Rancor|Ke3chang|APT37|Leviathan|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|Threat Group-3390|menuPass|Gamaredon Group|Suckfly|Patchwork|Threat Group-1314|APT3|admin@338|APT1 Sandworm Team|Nomadic Octopus|TeamTNT|APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|UNC2452|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Gorgon Group|Dark Caracal|Ke3chang|Dragonfly 2.0|Rancor|FIN8|APT28|APT37|Magic Hound|BRONZE BUTLER|Sowbug|menuPass|FIN10|Threat Group-3390|Gamaredon Group|Patchwork|Suckfly|Threat Group-1314|APT3|admin@338|APT1
224 T1059.002 AppleScript Execution no
225 T1059.001 PowerShell Execution Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|Soft Cell|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|DarkHydrus|APT28|Thrip|Gorgon Group|Cobalt Group|Dragonfly 2.0|Leviathan|TA459|FIN8|MuddyWater|Magic Hound|OilRig|BRONZE BUTLER|CopyKittens|APT32|FIN7|FIN10|Threat Group-3390|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda Nomadic Octopus|TeamTNT|APT38|Tonto Team|Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|Thrip|Cobalt Group|APT28|DarkHydrus|Dragonfly 2.0|APT19|Gorgon Group|TA459|Leviathan|MuddyWater|FIN8|CopyKittens|OilRig|Magic Hound|BRONZE BUTLER|FIN7|APT32|menuPass|FIN10|Threat Group-3390|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda
226 T1567 Exfiltration Over Web Service Exfiltration no APT28
227 T1497.003 Time Based Evasion Defense Evasion|Discovery no
228 T1497.002 User Activity Based Checks Defense Evasion|Discovery FIN7 Darkhotel|FIN7
229 T1497.001 System Checks Defense Evasion|Discovery Frankenstein OilRig|Darkhotel|Evilnum|Frankenstein
230 T1498.002 Reflection Amplification Impact no
231 T1498.001 Direct Network Flood Impact no
232 T1566.003 Spearphishing via Service Initial Access Magic Hound|Windshift|FIN6|OilRig|Dark Caracal APT29|Ajax Security Team|Magic Hound|Windshift|FIN6|OilRig|Dark Caracal
233 T1566.002 Spearphishing Link Initial Access Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Turla|APT28|Cobalt Group|Dragonfly 2.0|OilRig|APT33|Elderwood|Leviathan|Magic Hound|Patchwork|APT29|FIN8 Transparent Tribe|FIN7|APT3|Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|APT28|Cobalt Group|Turla|Dragonfly 2.0|OilRig|Elderwood|APT33|APT29|Leviathan|FIN8|Patchwork|Magic Hound
234 T1566.001 Spearphishing Attachment Initial Access Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Turla|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|OilRig|Lazarus Group|APT19|Dragonfly 2.0|BRONZE BUTLER|APT32|FIN8|MuddyWater|APT28|TA459|Leviathan|Patchwork|PLATINUM|Elderwood|APT29|APT37|menuPass APT38|Andariel|Ferocious Kitten|IndigoZebra|Transparent Tribe|Nomadic Octopus|Tonto Team|Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|DarkHydrus|Lazarus Group|Gorgon Group|OilRig|BRONZE BUTLER|APT19|APT32|Cobalt Group|Rancor|FIN7|Dragonfly 2.0|MuddyWater|APT28|TA459|APT29|APT37|Leviathan|FIN8|Patchwork|menuPass|Elderwood|PLATINUM
235 T1566 Phishing Initial Access no GOLD SOUTHFIELD|Dragonfly
236 T1565.003 Runtime Data Manipulation Impact APT38
237 T1565.002 Transmitted Data Manipulation Impact APT38
238 T1565.001 Stored Data Manipulation Impact FIN4|APT38 APT38
239 T1565 Data Manipulation Impact no
240 T1564.001 Hidden Files and Directories Defense Evasion Rocke|APT32|Tropic Trooper|APT28|Lazarus Group Transparent Tribe|Mustang Panda|Rocke|APT32|Tropic Trooper|APT28|Lazarus Group
241 T1564 Hide Artifacts Defense Evasion no
242 T1563.002 RDP Hijacking Lateral Movement no
243 T1563.001 SSH Hijacking Lateral Movement no
244 T1563 Remote Service Session Hijacking Lateral Movement no
245 T1518.001 Security Software Discovery Discovery Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon TeamTNT|APT38|Windshift|Sidewinder|Operation Wocao|Wizard Spider|Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon
246 T1069.003 Cloud Groups Discovery no
247 T1069.002 Domain Groups Discovery Turla|Wizard Spider|Inception|OilRig|FIN6|Dragonfly 2.0|Ke3chang Turla|Inception|OilRig|Dragonfly 2.0|Ke3chang
248 T1087.004 Cloud Account Discovery no
249 T1087.003 Email Account Discovery Sandworm Team|TA505
250 T1087.002 Domain Account Discovery Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang
251 T1087.001 Local Account Discovery Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338 Chimera|Fox Kitten|Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338
252 T1553.004 Install Root Certificate Defense Evasion no
253 T1562.004 Disable or Modify System Firewall Defense Evasion Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak TeamTNT|APT38|APT29|UNC2452|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak
254 T1562.003 HISTCONTROL Impair Command History Logging Defense Evasion no APT38
255 T1562.002 Disable Windows Event Logging Defense Evasion Threat Group-3390 Sandworm Team|APT29|UNC2452|Threat Group-3390
256 T1562.001 Disable or Modify Tools Defense Evasion Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda TeamTNT|Indrik Spider|APT29|MuddyWater|UNC2452|Wizard Spider|FIN6|Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda
257 T1562 Impair Defenses Defense Evasion no
258 T1003.004 LSA Secrets Credential Access OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390
259 T1003.005 Cached Domain Credentials Credential Access OilRig|MuddyWater|Leafminer|APT33
260 T1561.002 Disk Structure Wipe Impact Sandworm Team|Lazarus Group|APT38|APT37
261 T1561.001 Disk Content Wipe Impact Lazarus Group
262 T1561 Disk Wipe Impact no
263 T1560.003 Archive via Custom Method Collection Lazarus Group|Kimsuky|CopyKittens|FIN6 Mustang Panda|Lazarus Group|Kimsuky|CopyKittens|FIN6
264 T1560.002 Archive via Library Collection Lazarus Group|Threat Group-3390
265 T1560.001 Archive via Utility Collection APT41|Soft Cell|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|APT3|Sowbug|menuPass|APT1|Ke3chang APT28|APT29|Mustang Panda|HAFNIUM|UNC2452|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|APT1|Ke3chang
266 T1560 Archive Collected Data Collection menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang Leviathan|menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang
267 T1499.004 Application or System Exploitation Impact no
268 T1499.003 Application Exhaustion Flood Impact no
269 T1499.002 Service Exhaustion Flood Impact no
270 T1499.001 OS Exhaustion Flood Impact no
271 T1491.002 External Defacement Impact no Sandworm Team
272 T1491.001 Internal Defacement Impact Lazarus Group
273 T1114.003 Email Forwarding Rule Collection no Silent Librarian|Kimsuky
274 T1114.002 Remote Email Collection Collection APT1|FIN4|APT28|Dragonfly 2.0|Ke3chang|Leafminer APT29|HAFNIUM|Chimera|UNC2452|APT1|FIN4|Ke3chang|Leafminer|Dragonfly 2.0|APT28
275 T1114.001 Local Email Collection Collection Magic Hound|APT1 Chimera|Magic Hound|APT1
276 T1134.005 SID-History Injection Defense Evasion|Privilege Escalation no
277 T1134.004 Parent PID Spoofing Defense Evasion|Privilege Escalation no
278 T1134.003 Make and Impersonate Token Defense Evasion|Privilege Escalation no
279 T1134.002 Create Process with Token Defense Evasion|Privilege Escalation Turla|Lazarus Group
280 T1134.001 Token Impersonation/Theft Defense Evasion|Privilege Escalation APT28 FIN8|APT28
281 T1213.002 Sharepoint Collection Ke3chang|APT28 Chimera|Ke3chang|APT28
282 T1213.001 Confluence Collection no
283 T1555.003 Credentials from Web Browsers Credential Access Magic Hound|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats Ajax Security Team|ZIRCONIUM|FIN6|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats
284 T1555.002 Securityd Memory Credential Access no
285 T1555.001 Keychain Credential Access no
286 T1559.002 Dynamic Data Exchange Execution Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7 Leviathan|Sidewinder|Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|FIN7|APT28
287 T1559.001 Component Object Model Execution Gamaredon Group|MuddyWater
288 T1559 Inter-Process Communication Execution no
289 T1558.002 Silver Ticket Credential Access no
290 T1558.001 Golden Ticket Credential Access Ke3chang
291 T1558 Steal or Forge Kerberos Tickets Credential Access no
292 T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay Credential Access|Collection no Wizard Spider
293 T1557 Man-in-the-Middle Adversary-in-the-Middle Credential Access|Collection no Kimsuky
294 T1556.002 Password Filter DLL Credential Access|Defense Evasion Credential Access|Defense Evasion|Persistence Strider
295 T1556.001 Domain Controller Authentication Credential Access|Defense Evasion Credential Access|Defense Evasion|Persistence no Chimera
296 T1556 Modify Authentication Process Credential Access|Defense Evasion Credential Access|Defense Evasion|Persistence no
297 T1056.004 Credential API Hooking Collection|Credential Access PLATINUM
298 T1056.003 Web Portal Capture Collection|Credential Access no
299 T1056.002 GUI Input Capture Collection|Credential Access FIN4
300 T1056.001 Keylogging Collection|Credential Access APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|Ke3chang|OilRig|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28 Tonto Team|Ajax Security Team|Operation Wocao|APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28
301 T1555 Credentials from Password Stores Credential Access APT39|OilRig|MuddyWater|Leafminer|APT33|Turla|Stealth Falcon APT29|Evilnum|UNC2452|FIN6|APT39|OilRig|MuddyWater|Leafminer|APT33|Stealth Falcon
302 T1552.005 Cloud Instance Metadata API Credential Access no TeamTNT
303 T1003.008 /etc/passwd and /etc/shadow Credential Access no
304 T1003.007 Proc Filesystem Credential Access no
305 T1003.006 DCSync Credential Access no APT29|UNC2452|Operation Wocao
306 T1558.003 Kerberoasting Credential Access no FIN7|APT29|UNC2452|Operation Wocao|Wizard Spider
307 T1552.006 Group Policy Preferences Credential Access APT33
308 T1003.003 NTDS Credential Access FIN6|Dragonfly 2.0 APT28|Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6|Dragonfly 2.0
309 T1003.002 Security Account Manager Credential Access Threat Group-3390|Ke3chang|Soft Cell|Night Dragon|Dragonfly 2.0|menuPass Wizard Spider|Threat Group-3390|Ke3chang|GALLIUM|Night Dragon|Dragonfly 2.0|menuPass
310 T1003.001 LSASS Memory Credential Access Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|Soft Cell|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Lazarus Group|Leafminer|Magic Hound|MuddyWater|PLATINUM|FIN8|BRONZE BUTLER|OilRig|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver Indrik Spider|HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Leafminer|Magic Hound|FIN8|PLATINUM|MuddyWater|OilRig|BRONZE BUTLER|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver
311 T1110.004 Credential Stuffing Credential Access no Chimera
312 T1110.003 Password Spraying Credential Access APT33|Leafminer|Lazarus Group Sandworm Team|APT29|Silent Librarian|Chimera|APT28|APT33|Leafminer|Lazarus Group
313 T1110.002 Password Cracking Credential Access APT41|Dragonfly 2.0|APT3 FIN6|APT41|Dragonfly 2.0|APT3
314 T1110.001 Password Guessing Credential Access no APT28
315 T1021.006 Windows Remote Management Lateral Movement Threat Group-3390 APT29|UNC2452|Chimera|Wizard Spider|Threat Group-3390
316 T1021.005 VNC Lateral Movement GCMAN FIN7|Fox Kitten|GCMAN
317 T1021.004 SSH Lateral Movement Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN TeamTNT|FIN7|Fox Kitten|Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN
318 T1021.003 Distributed Component Object Model Lateral Movement no
319 T1021.002 SMB/Windows Admin Shares Lateral Movement Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang Sandworm Team|APT28|Fox Kitten|APT41|Operation Wocao|Wizard Spider|Chimera|Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang
320 T1021.001 Remote Desktop Protocol Lateral Movement Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|menuPass|FIN10|Patchwork|FIN6|Lazarus Group|APT1|Axiom Kimsuky|FIN7|Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|FIN10|menuPass|Patchwork|FIN6|Lazarus Group|APT1|Axiom
321 T1554 Compromise Client Software Binary Persistence no
322 T1036.006 Space after Filename Defense Evasion no
323 T1036.005 Match Legitimate Name or Location Defense Evasion Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1 APT28|Ferocious Kitten|FIN7|BackdoorDiplomacy|Transparent Tribe|Naikon|APT29|Mustang Panda|Sidewinder|Darkhotel|Lazarus Group|Indrik Spider|UNC2452|Fox Kitten|Machete|Chimera|PROMETHIUM|Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|Sowbug|BRONZE BUTLER|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1
324 T1036.004 Masquerade Task or Service Defense Evasion Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7 BackdoorDiplomacy|APT41|Naikon|ZIRCONIUM|APT29|Higaisa|UNC2452|Fox Kitten|Kimsuky|PROMETHIUM|Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7
325 T1036.003 Rename System Utilities Defense Evasion menuPass|APT32|Soft Cell|PLATINUM menuPass|APT32|GALLIUM
326 T1036.002 Right-to-Left Override Defense Evasion BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic Ferocious Kitten|BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic
327 T1036.001 Invalid Code Signature Defense Evasion Windshift Windshift|APT37
328 T1553.003 SIP and Trust Provider Hijacking Defense Evasion no
329 T1553.002 Code Signing Defense Evasion Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|APT37|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel menuPass|APT29|GALLIUM|UNC2452|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel
330 T1553.001 Gatekeeper Bypass Defense Evasion no
331 T1553 Subvert Trust Controls Defense Evasion no
332 T1027.003 Steganography Defense Evasion BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37 Andariel|Leviathan|TA551|BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37
333 T1027.002 Software Packing Defense Evasion TA505|Rocke|Soft Cell|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon Sandworm Team|Kimsuky|TeamTNT|ZIRCONIUM|TA505|Rocke|GALLIUM|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon
334 T1027.001 Binary Padding Defense Evasion Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee APT29|Mustang Panda|Higaisa|Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee
335 T1222.002 Linux and Mac File and Directory Permissions Modification Defense Evasion Rocke|APT32 TeamTNT|Rocke|APT32
336 T1222.001 Windows File and Directory Permissions Modification Defense Evasion no Wizard Spider
337 T1552.004 Private Keys Credential Access Rocke TeamTNT|APT29|UNC2452|Operation Wocao|Rocke
338 T1552.003 Bash History Credential Access no
339 T1552.002 Credentials in Registry Credential Access APT32
340 T1552.001 Credentials In Files Credential Access Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3 TeamTNT|Kimsuky|Fox Kitten|Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3
341 T1552 Unsecured Credentials Credential Access no
342 T1216.001 PubPrn Defense Evasion APT32
343 T1070.006 Timestomp Defense Evasion Rocke|TEMP.Veles|APT32|Lazarus Group|APT28 APT38|APT29|UNC2452|Chimera|Kimsuky|Rocke|TEMP.Veles|APT32|Lazarus Group|APT28
344 T1070.005 Network Share Connection Removal Defense Evasion Threat Group-3390
345 T1070.004 File Deletion Defense Evasion Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|FIN10|APT28|Threat Group-3390|Group5|Lazarus Group|APT18|APT29 TeamTNT|APT39|Mustang Panda|Chimera|Evilnum|UNC2452|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Cobalt Group|Dragonfly 2.0|Honeybee|Patchwork|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|APT3|Magic Hound|Threat Group-3390|APT28|FIN10|Group5|Lazarus Group|APT18|APT29
346 T1070.003 Clear Command History Defense Evasion APT41 TeamTNT|menuPass|APT41
347 T1550.004 Web Session Cookie Defense Evasion|Lateral Movement no APT29|UNC2452
348 T1550.001 Application Access Token Defense Evasion|Lateral Movement APT28
349 T1550.003 Pass the Ticket Defense Evasion|Lateral Movement APT32|BRONZE BUTLER|APT29
350 T1550.002 Pass the Hash Defense Evasion|Lateral Movement Soft Cell|APT32|Night Dragon|APT28|APT1 Chimera|Kimsuky|GALLIUM|APT32|Night Dragon|APT28|APT1
351 T1550 Use Alternate Authentication Material Defense Evasion|Lateral Movement no APT29|UNC2452
352 T1548.004 Elevated Execution with Prompt Privilege Escalation|Defense Evasion no
353 T1548.003 Sudo and Sudo Caching Privilege Escalation|Defense Evasion no
354 T1548.002 Bypass User Access Control Bypass User Account Control Privilege Escalation|Defense Evasion APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29 Evilnum|APT37|MuddyWater|Threat Group-3390|Honeybee|Cobalt Group|BRONZE BUTLER|Patchwork|APT29
355 T1548.001 Setuid and Setgid Privilege Escalation|Defense Evasion no
356 T1548 Abuse Elevation Control Mechanism Privilege Escalation|Defense Evasion no
357 T1136.003 Cloud Account Persistence no
358 T1070.002 Clear Linux or Mac System Logs Defense Evasion Rocke TeamTNT|Rocke
359 T1070.001 Clear Windows Event Logs Defense Evasion APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28 Indrik Spider|Chimera|Operation Wocao|APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28
360 T1136.002 Domain Account Persistence Soft Cell Sandworm Team|HAFNIUM|GALLIUM
361 T1136.001 Local Account Persistence APT39|APT41|Dragonfly 2.0|Leafminer|APT3 TeamTNT|Fox Kitten|APT39|APT41|Leafminer|Dragonfly 2.0|APT3
362 T1547.011 Plist Modification Persistence|Privilege Escalation no
363 T1547.010 Port Monitors Persistence|Privilege Escalation no
364 T1547.009 Shortcut Modification Persistence|Privilege Escalation APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Leviathan|Lazarus Group APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Lazarus Group|Leviathan
365 T1547.008 LSASS Driver Persistence|Privilege Escalation no
366 T1547.007 Re-opened Applications Persistence|Privilege Escalation no
367 T1547.006 Kernel Modules and Extensions Persistence|Privilege Escalation no
368 T1547.005 Security Support Provider Persistence|Privilege Escalation no
369 T1547.004 Winlogon Helper DLL Persistence|Privilege Escalation Tropic Trooper|Turla Wizard Spider|Tropic Trooper|Turla
370 T1547.003 Time Providers Persistence|Privilege Escalation no
371 T1546.014 Emond Privilege Escalation|Persistence no
372 T1546.013 PowerShell Profile Privilege Escalation|Persistence Turla
374 T1218.008 Odbcconf Defense Evasion Cobalt Group
375 T1546.011 Application Shimming Privilege Escalation|Persistence FIN7
376 T1547.002 Authentication Package Persistence|Privilege Escalation no
377 T1546.010 AppInit DLLs Privilege Escalation|Persistence no APT39
378 T1546.009 AppCert DLLs Privilege Escalation|Persistence Honeybee
379 T1218.007 Msiexec Defense Evasion TA505|Rancor ZIRCONIUM|Molerats|Machete|TA505|Rancor
380 T1546.008 Accessibility Features Privilege Escalation|Persistence APT41|APT3|APT29|Deep Panda|Axiom Fox Kitten|APT41|APT3|APT29|Deep Panda|Axiom
381 T1546.007 Netsh Helper DLL Privilege Escalation|Persistence no
382 T1546.006 LC_LOAD_DYLIB Addition Privilege Escalation|Persistence no
383 T1546.005 Trap Privilege Escalation|Persistence no
384 T1546.004 .bash_profile and .bashrc Unix Shell Configuration Modification Privilege Escalation|Persistence no
385 T1546.003 Windows Management Instrumentation Event Subscription Privilege Escalation|Persistence APT33|Blue Mockingbird|Turla|Leviathan|APT29 FIN8|Mustang Panda|UNC2452|APT33|Blue Mockingbird|Turla|Leviathan|APT29
386 T1546.002 Screensaver Privilege Escalation|Persistence no
387 T1546.001 Change Default File Association Privilege Escalation|Persistence Kimsuky
388 T1547.001 Registry Run Keys / Startup Folder Persistence|Privilege Escalation Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Machete|Kimsuky|APT33|APT39|APT32|APT18|Turla|Dark Caracal|Cobalt Group|Honeybee|Threat Group-3390|Dragonfly 2.0|Gorgon Group|Ke3chang|APT19|Leviathan|MuddyWater|APT37|BRONZE BUTLER|Magic Hound|APT3|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel TeamTNT|Naikon|Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Dark Caracal|Threat Group-3390|Honeybee|Turla|Cobalt Group|Ke3chang|Dragonfly 2.0|APT19|Gorgon Group|MuddyWater|APT37|Leviathan|BRONZE BUTLER|APT3|Magic Hound|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel
389 T1218.002 Control Panel Defense Evasion no
390 T1218.010 Regsvr32 Defense Evasion Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda TA551|Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda
391 T1218.009 Regsvcs/Regasm Defense Evasion no
392 T1218.005 Mshta Defense Evasion Inception|Kimsuky|APT32|MuddyWater|FIN7 Mustang Panda|TA551|Sidewinder|Inception|Kimsuky|APT32|MuddyWater|FIN7
393 T1218.004 InstallUtil Defense Evasion no Mustang Panda|menuPass
394 T1218.001 Compiled HTML File Defense Evasion APT41|Silence|Lazarus Group|Dark Caracal|OilRig APT41|Silence|Dark Caracal|OilRig|Lazarus Group
395 T1218.003 CMSTP Defense Evasion Cobalt Group|MuddyWater
396 T1218.011 Rundll32 Defense Evasion APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28 APT38|HAFNIUM|TA551|UNC2452|APT41|Gamaredon Group|APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28
397 T1547 Boot or Logon Autostart Execution Persistence|Privilege Escalation no
398 T1546 Event Triggered Execution Privilege Escalation|Persistence no
399 T1098.003 Add Office 365 Global Administrator Role Persistence no
400 T1098.002 Exchange Email Delegate Permissions Persistence Magic Hound APT28|APT29|UNC2452|Magic Hound
401 T1098.001 Additional Azure Service Principal Credentials Additional Cloud Credentials Persistence no APT29|UNC2452
402 T1543.004 Launch Daemon Persistence|Privilege Escalation no
403 T1543.003 Windows Service Persistence|Privilege Escalation Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|Honeybee|FIN7|Threat Group-3390|APT19|APT3|Lazarus Group|Carbanak TeamTNT|APT38|PROMETHIUM|Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|FIN7|APT19|Threat Group-3390|Honeybee|APT3|Lazarus Group|Carbanak
404 T1543.002 Systemd Service Persistence|Privilege Escalation Rocke TeamTNT|Rocke
405 T1543.001 Launch Agent Persistence|Privilege Escalation no
406 T1037.005 Startup Items Persistence|Privilege Escalation no
407 T1037.004 Rc.common RC Scripts Persistence|Privilege Escalation no
408 T1055.012 Process Hollowing Defense Evasion|Privilege Escalation Threat Group-3390|menuPass|Gorgon Group|Patchwork
409 T1055.013 Process Doppelgänging Defense Evasion|Privilege Escalation Leafminer
410 T1055.011 Extra Window Memory Injection Defense Evasion|Privilege Escalation no
412 T1055.009 Proc Memory Defense Evasion|Privilege Escalation no
413 T1055.008 Ptrace System Calls Defense Evasion|Privilege Escalation no
414 T1055.005 Thread Local Storage Defense Evasion|Privilege Escalation no
415 T1055.004 Asynchronous Procedure Call Defense Evasion|Privilege Escalation no FIN8
416 T1055.003 Thread Execution Hijacking Defense Evasion|Privilege Escalation no
417 T1055.002 Portable Executable Injection Defense Evasion|Privilege Escalation Rocke|Gorgon Group
418 T1055.001 Dynamic-link Library Injection Defense Evasion|Privilege Escalation TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda BackdoorDiplomacy|Leviathan|Wizard Spider|TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda
419 T1037.003 Network Logon Script Persistence|Privilege Escalation no
420 T1543 Create or Modify System Process Persistence|Privilege Escalation no
421 T1037.002 Logon Script (Mac) Persistence|Privilege Escalation no
423 T1542.003 Bootkit Persistence|Defense Evasion APT41|Lazarus Group|APT28
424 T1542.002 Component Firmware Persistence|Defense Evasion Equation
425 T1542.001 System Firmware Persistence|Defense Evasion no
426 T1505.003 Web Shell Persistence Tropic Trooper|Soft Cell|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda BackdoorDiplomacy|APT38|APT29|APT28|Tonto Team|Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda
427 T1505.002 Transport Agent Persistence no
428 T1505.001 SQL Stored Procedures Persistence no Sandworm Team
429 T1053.003 Cron Execution|Persistence|Privilege Escalation Rocke APT38|Rocke
430 T1053.004 Launchd Execution|Persistence|Privilege Escalation no
431 T1053.001 At (Linux) Execution|Persistence|Privilege Escalation no
432 T1053.005 Scheduled Task Execution|Persistence|Privilege Escalation Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|Machete|Soft Cell|Silence|TEMP.Veles|APT33|APT39|Dragonfly 2.0|Patchwork|OilRig|Rancor|Cobalt Group|FIN8|menuPass|FIN10|APT32|FIN7|Stealth Falcon|FIN6|APT3|APT29 APT37|APT38|Naikon|CostaRicto|Mustang Panda|Higaisa|UNC2452|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|Rancor|OilRig|Patchwork|Dragonfly 2.0|Cobalt Group|FIN8|menuPass|FIN10|FIN7|APT32|Stealth Falcon|FIN6|APT3|APT29
433 T1053.002 At (Windows) Execution|Persistence|Privilege Escalation BRONZE BUTLER|Threat Group-3390|APT18
434 T1542 Pre-OS Boot Defense Evasion|Persistence no
435 T1137.001 Office Template Macros Persistence MuddyWater
439 T1137.006 Add-ins Persistence Naikon
440 T1137.002 Office Test Persistence APT28
441 T1531 Account Access Removal Impact no
442 T1539 Steal Web Session Cookie Credential Access no Evilnum
443 T1529 System Shutdown/Reboot Impact Lazarus Group|APT38|APT37
444 T1518 Software Discovery Discovery BRONZE BUTLER|Tropic Trooper|Inception Mustang Panda|Windshift|MuddyWater|Windigo|Sidewinder|Operation Wocao|BRONZE BUTLER|Tropic Trooper|Inception
445 T1534 T1547.013 Internal Spearphishing XDG Autostart Entries Lateral Movement Persistence|Privilege Escalation Gamaredon Group no
446 T1534 Internal Spearphishing Lateral Movement Leviathan|Gamaredon Group
447 T1528 Steal Application Access Token Credential Access APT28
448 T1535 Unused/Unsupported Cloud Regions Defense Evasion no
449 T1525 Implant Container Image Implant Internal Image Persistence no
450 T1538 Cloud Service Dashboard Discovery no
451 T1530 Data from Cloud Storage Object Collection no Fox Kitten
452 T1578 Modify Cloud Compute Infrastructure Defense Evasion no
453 T1537 Transfer Data to Cloud Account Exfiltration no
454 T1526 Cloud Service Discovery Discovery no
455 T1505 Server Software Component Persistence no
456 T1499 Endpoint Denial of Service Impact no Sandworm Team
457 T1497 Virtualization/Sandbox Evasion Defense Evasion|Discovery no Darkhotel
458 T1498 Network Denial of Service Impact no APT28
459 T1496 Resource Hijacking Impact Blue Mockingbird|Rocke|APT41|Lazarus Group TeamTNT|Blue Mockingbird|Rocke|APT41
460 T1495 Firmware Corruption Impact no
461 T1491 Defacement Impact no
462 T1490 Inhibit System Recovery Impact no
463 T1489 Service Stop Impact Lazarus Group Indrik Spider|Wizard Spider|Lazarus Group
464 T1486 Data Encrypted for Impact Impact APT41|TA505|APT38 FIN7|Indrik Spider|APT41|TA505|APT38
465 T1485 Data Destruction Impact Sandworm Team|Lazarus Group|APT38
466 T1484 Group Policy Modification Domain Policy Modification Defense Evasion|Privilege Escalation no
467 T1482 Domain Trust Discovery Discovery Wizard Spider FIN8|APT29|Chimera|UNC2452
468 T1480 Execution Guardrails Defense Evasion no
469 T1221 Template Injection Defense Evasion Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|DarkHydrus|Dragonfly 2.0
470 T1222 File and Directory Permissions Modification Defense Evasion no
471 T1221 T1220 Template Injection XSL Script Processing Defense Evasion Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus Higaisa|Cobalt Group
472 T1220 T1217 XSL Script Processing Browser Bookmark Discovery Defense Evasion Discovery Cobalt Group APT38|Chimera|Fox Kitten
T1197 BITS Jobs Defense Evasion|Persistence Patchwork|APT41|Leviathan
T1217 Browser Bookmark Discovery Discovery no
T1213 Data from Information Repositories Collection Turla
T1189 Drive-by Compromise Initial Access Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|BRONZE BUTLER|Leafminer|Dark Caracal|APT19|APT32|Lazarus Group|Threat Group-3390|Elderwood|APT37|Patchwork|PLATINUM
T1203 Exploitation for Client Execution Execution Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|Lazarus Group|BRONZE BUTLER|Cobalt Group|APT37|Patchwork|Leviathan|Elderwood|TA459|APT29
473 T1212 Exploitation for Credential Access Credential Access no
474 T1189 Drive-by Compromise Initial Access Transparent Tribe|Andariel|Leviathan|Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|APT19|Lazarus Group|Threat Group-3390|BRONZE BUTLER|APT32|Dark Caracal|Dragonfly 2.0|Leafminer|Patchwork|APT37|Elderwood|PLATINUM
475 T1211 Exploitation for Defense Evasion Defense Evasion APT28
476 T1190 T1197 Exploit Public-Facing Application BITS Jobs Initial Access Defense Evasion|Persistence Blue Mockingbird|Rocke|APT39|BlackTech|APT41|Soft Cell|Night Dragon|Axiom APT39|Patchwork|APT41|Leviathan
477 T1210 T1203 Exploitation of Remote Services Exploitation for Client Execution Lateral Movement Execution Threat Group-3390|APT28 Andariel|Transparent Tribe|APT3|Tonto Team|Mustang Panda|Darkhotel|Higaisa|HAFNIUM|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Cobalt Group|Lazarus Group|Patchwork|Elderwood|APT29|TA459|APT37|Leviathan
478 T1202 T1201 Indirect Command Execution Password Policy Discovery Defense Evasion Discovery no Chimera|Turla|OilRig
479 T1200 T1195 Hardware Additions Supply Chain Compromise Initial Access DarkVishnya no
480 T1201 T1199 Password Policy Discovery Trusted Relationship Discovery Initial Access Turla|OilRig APT29|Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass
T1219 Remote Access Software Command And Control Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak
T1207 Rogue Domain Controller Defense Evasion no
T1199 Trusted Relationship Initial Access APT28|menuPass
481 T1218 Signed Binary Proxy Execution Defense Evasion no
482 T1204 User Execution Execution no
483 T1213 Data from Information Repositories Collection APT28|Fox Kitten|FIN6|Turla
484 T1190 Exploit Public-Facing Application Initial Access BackdoorDiplomacy|menuPass|Volatile Cedar|UNC2452|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom
485 T1210 Exploitation of Remote Services Lateral Movement Tonto Team|FIN7|Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28
486 T1200 Hardware Additions Initial Access DarkVishnya
487 T1202 Indirect Command Execution Defense Evasion no
488 T1219 Remote Access Software Command And Control TeamTNT|Mustang Panda|MuddyWater|Evilnum|GOLD SOUTHFIELD|Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Cobalt Group|Thrip|Carbanak
489 T1207 Rogue Domain Controller Defense Evasion no
490 T1216 Signed Script Proxy Execution Defense Evasion no
T1195 Supply Chain Compromise Initial Access Elderwood
491 T1205 Traffic Signaling Defense Evasion|Persistence|Command And Control no
492 T1176 Browser Extensions Persistence Kimsuky|Stolen Pencil
T1175 Component Object Model and Distributed COM Lateral Movement|Execution no
493 T1187 Forced Authentication Credential Access DarkHydrus|Dragonfly 2.0
494 T1185 T1175 Man in the Browser Component Object Model and Distributed COM Collection Lateral Movement|Execution no
495 T1134 T1185 Access Token Manipulation Browser Session Hijacking Defense Evasion|Privilege Escalation Collection Blue Mockingbird no
496 T1136 T1140 Create Account Deobfuscate/Decode Files or Information Persistence Defense Evasion no APT39|APT29|ZIRCONIUM|Higaisa|UNC2452|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|Honeybee|Gorgon Group|Threat Group-3390|menuPass|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER
497 T1140 T1134 Deobfuscate/Decode Files or Information Access Token Manipulation Defense Evasion Defense Evasion|Privilege Escalation Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|menuPass|Honeybee|Threat Group-3390|APT19|Gorgon Group|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER FIN6|Blue Mockingbird
498 T1149 LC_MAIN Hijacking Defense Evasion no
499 T1135 T1136 Network Share Discovery Create Account Discovery Persistence APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug Sandworm Team|Indrik Spider
500 T1135 Network Share Discovery Discovery Tonto Team|APT38|Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug
501 T1137 Office Application Startup Persistence Gamaredon Group|APT32
502 T1153 Source Execution no
503 T1133 External Remote Services Persistence|Initial Access Sandworm Team|APT41|Soft Cell|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18 TeamTNT|Leviathan|APT28|APT29|UNC2452|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|Ke3chang|OilRig|Dragonfly 2.0|FIN5|Threat Group-3390|APT18
504 T1132 Data Encoding Command And Control no
505 T1129 Shared Modules Execution no
506 T1127 Trusted Developer Utilities Proxy Execution Defense Evasion no
507 T1125 Video Capture Collection Silence|FIN7
508 T1124 System Time Discovery Discovery The White Company|Lazarus Group|BRONZE BUTLER|Turla Darkhotel|ZIRCONIUM|Higaisa|Sidewinder|Chimera|Operation Wocao|The White Company|Lazarus Group|BRONZE BUTLER|Turla
509 T1123 Audio Capture Collection APT37
510 T1120 Peripheral Device Discovery Discovery Turla|APT37|Gamaredon Group|Equation|APT28 OilRig|BackdoorDiplomacy|Operation Wocao|Turla|APT37|Gamaredon Group|Equation|APT28
511 T1119 Automated Collection Collection Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6 Mustang Panda|Sidewinder|Chimera|menuPass|Operation Wocao|Gamaredon Group|Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6
512 T1115 Clipboard Data Collection APT39|APT38 Operation Wocao|APT39|APT38
513 T1114 Email Collection Collection no Magic Hound|Silent Librarian
514 T1113 Screen Capture Collection Gamaredon Group|APT39|Silence|MuddyWater|Dragonfly 2.0|OilRig|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28 GOLD SOUTHFIELD|Gamaredon Group|APT39|Silence|MuddyWater|Dragonfly 2.0|OilRig|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28
515 T1112 Modify Registry Defense Evasion Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Honeybee|Patchwork|Gorgon Group|FIN8 Operation Wocao|Kimsuky|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Patchwork|Gorgon Group|Threat Group-3390|Dragonfly 2.0|APT19|Honeybee|FIN8
516 T1111 Two-Factor Authentication Interception Credential Access no Chimera|Operation Wocao
517 T1110 Brute Force Credential Access DarkVishnya|APT39|OilRig|FIN5|Turla APT38|APT28|Fox Kitten|DarkVishnya|APT39|OilRig|FIN5|Turla
518 T1108 Redundant Access Defense Evasion|Persistence no
519 T1106 Native API Execution Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|Gorgon Group|APT37 APT38|Higaisa|menuPass|Operation Wocao|Chimera|Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|APT37|Gorgon Group
520 T1105 Ingress Tool Transfer Command And Control Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|Soft Cell|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Turla|Gorgon Group|OilRig|Dragonfly 2.0|APT37|FIN8|PLATINUM|Leviathan|Elderwood|Magic Hound|APT3|APT32|BRONZE BUTLER|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28 TeamTNT|Nomadic Octopus|IndigoZebra|Andariel|BackdoorDiplomacy|Tonto Team|HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|UNC2452|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Gorgon Group|OilRig|Turla|Cobalt Group|Dragonfly 2.0|FIN8|PLATINUM|APT37|Elderwood|Leviathan|APT32|Magic Hound|BRONZE BUTLER|APT3|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28
521 T1104 Multi-Stage Channels Command And Control APT41|MuddyWater|APT3
522 T1102 Web Service Command And Control Gamaredon Group|Rocke|Inception|FIN6 TeamTNT|FIN8|Fox Kitten|Turla|APT32|Gamaredon Group|Rocke|Inception|FIN6
523 T1098 Account Manipulation Persistence APT3|Dragonfly 2.0|Lazarus Group Sandworm Team|APT3|Dragonfly 2.0|Lazarus Group
524 T1095 Non-Application Layer Protocol Command And Control APT29|PLATINUM|APT3 BackdoorDiplomacy|HAFNIUM|Operation Wocao|FIN6|APT29|PLATINUM|APT3
525 T1092 Communication Through Removable Media Command And Control APT28
526 T1091 Replication Through Removable Media Lateral Movement|Initial Access Tropic Trooper|Darkhotel|APT28 Mustang Panda|Tropic Trooper|Darkhotel|APT28
527 T1090 Proxy Command And Control Sandworm Team|Blue Mockingbird|Wizard Spider|APT41|Turla Windigo|Fox Kitten|Operation Wocao|Sandworm Team|Blue Mockingbird|APT41|Turla
528 T1087 Account Discovery Discovery no APT29|UNC2452
529 T1083 File and Directory Discovery Discovery Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dark Caracal|Dragonfly 2.0|Magic Hound|Sowbug|BRONZE BUTLER|APT3|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang APT38|APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|UNC2452|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dark Caracal|Dragonfly 2.0|APT3|Sowbug|Magic Hound|BRONZE BUTLER|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang
530 T1082 System Information Discovery Discovery Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|Honeybee|APT19|APT37|APT32|Magic Hound|OilRig|APT3|Sowbug|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang TeamTNT|APT38|APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|UNC2452|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT32|APT37|Honeybee|APT19|Magic Hound|Sowbug|OilRig|APT3|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang
531 T1080 Taint Shared Content Lateral Movement BRONZE BUTLER|Darkhotel Gamaredon Group|BRONZE BUTLER|Darkhotel
532 T1078 Valid Accounts Defense Evasion|Persistence|Privilege Escalation|Initial Access Sandworm Team|Wizard Spider|Silence|APT41|Soft Cell|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|Leviathan|APT33|OilRig|FIN5|menuPass|APT28|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak FIN7|Leviathan|APT29|Silent Librarian|UNC2452|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|APT33|FIN5|OilRig|APT28|menuPass|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak
533 T1074 Data Staged Collection Wizard Spider
534 T1072 Software Deployment Tools Execution|Lateral Movement Silence|APT32|Threat Group-1314
535 T1071 Application Layer Protocol Command And Control Rocke|Magic Hound|Dragonfly 2.0 TeamTNT|Rocke|Magic Hound|Dragonfly 2.0
536 T1070 Indicator Removal on Host Defense Evasion no APT29|UNC2452
537 T1069 Permission Groups Discovery Discovery TA505|APT3 APT29|UNC2452|TA505|APT3
538 T1068 Exploitation for Privilege Escalation Privilege Escalation Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28 Tonto Team|ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28
539 T1064 Scripting Defense Evasion|Execution no
540 T1062 Hypervisor Persistence no
541 T1061 Graphical User Interface Execution no
542 T1059 Command and Scripting Interpreter Execution APT32|Molerats|Whitefly|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang APT37|Windigo|Fox Kitten|APT32|Whitefly|APT39|Dragonfly 2.0|FIN7|APT19|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang
543 T1057 Process Discovery Discovery Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang TeamTNT|Andariel|APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|UNC2452|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang
544 T1056 Input Capture Collection|Credential Access no APT39
545 T1055 Process Injection Defense Evasion|Privilege Escalation APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM Operation Wocao|APT32|Sharpshooter|Silence|APT41|Kimsuky|Cobalt Group|Turla|APT37|Honeybee|PLATINUM
546 T1053 Scheduled Task/Job Execution|Persistence|Privilege Escalation no
547 T1052 Exfiltration Over Physical Medium Exfiltration no
548 T1051 Shared Webroot Lateral Movement no
549 T1049 System Network Connections Discovery Discovery Tropic Trooper|APT41|APT38|Soft Cell|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang TeamTNT|Andariel|BackdoorDiplomacy|Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang
550 T1048 Exfiltration Over Alternative Protocol Exfiltration no
551 T1047 Windows Management Instrumentation Execution Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|Soft Cell|APT32|MuddyWater|OilRig|Threat Group-3390|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda Sandworm Team|FIN7|Indrik Spider|Naikon|Mustang Panda|Windshift|UNC2452|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|Threat Group-3390|OilRig|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda
552 T1046 Network Service Scanning Discovery Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|Leafminer|OilRig|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390 TeamTNT|BackdoorDiplomacy|Naikon|CostaRicto|Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|OilRig|Cobalt Group|Leafminer|menuPass|Suckfly|FIN6|Threat Group-3390
553 T1043 Commonly Used Port Command And Control Machete|OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|Dragonfly 2.0|FIN7|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390 OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|FIN7|APT19|Dragonfly 2.0|FIN8|APT37|APT3|Magic Hound|Lazarus Group|Threat Group-3390
554 T1041 Exfiltration Over C2 Channel Exfiltration Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|Soft Cell|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang Leviathan|ZIRCONIUM|Higaisa|Chimera|APT39|Operation Wocao|Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|GALLIUM|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang
555 T1040 Network Sniffing Credential Access|Discovery Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28 Kimsuky|Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28
556 T1039 Data from Network Shared Drive Collection Sowbug|BRONZE BUTLER|menuPass APT28|Chimera|Fox Kitten|Gamaredon Group|BRONZE BUTLER|Sowbug|menuPass
557 T1037 Boot or Logon Initialization Scripts Persistence|Privilege Escalation Rocke
558 T1036 Masquerading Defense Evasion Windshift|APT32|BRONZE BUTLER|menuPass|Dragonfly 2.0 APT28|Nomadic Octopus|OilRig|APT29|ZIRCONIUM|TA551|UNC2452|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM|Dragonfly 2.0
559 T1034 Path Interception Persistence|Privilege Escalation no
560 T1033 System Owner/User Discovery Discovery Frankenstein|APT41|Soft Cell|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3 APT38|Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|APT37|Dragonfly 2.0|APT19|APT32|Magic Hound|OilRig|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3
561 T1030 Data Transfer Size Limits Exfiltration Threat Group-3390 APT28|Threat Group-3390
562 T1029 Scheduled Transfer Exfiltration no Higaisa
563 T1027 Obfuscated Files or Information Defense Evasion Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|Machete|Soft Cell|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Cobalt Group|Patchwork|Leafminer|APT37|Threat Group-3390|Honeybee|Dark Caracal|menuPass|APT19|BlackOasis|FIN8|Leviathan|Elderwood|MuddyWater|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28 TeamTNT|BackdoorDiplomacy|Transparent Tribe|APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Patchwork|menuPass|APT37|Threat Group-3390|Cobalt Group|Dark Caracal|Leafminer|Honeybee|APT19|BlackOasis|Leviathan|FIN8|MuddyWater|FIN7|Elderwood|OilRig|Magic Hound|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28
564 T1026 Multiband Communication Command And Control Lazarus Group
565 T1025 Data from Removable Media Collection Machete|Turla|Gamaredon Group|APT28 Turla|Gamaredon Group|APT28
566 T1021 Remote Services Lateral Movement no
567 T1020 Automated Exfiltration Exfiltration Tropic Trooper|Frankenstein|Honeybee Sidewinder|Gamaredon Group|Tropic Trooper|Frankenstein|Honeybee
568 T1018 Remote System Discovery Discovery Sandworm Team|Rocke|Wizard Spider|Silence|Soft Cell|APT39|APT32|Deep Panda|Threat Group-3390|Dragonfly 2.0|Leafminer|Ke3chang|FIN8|APT3|FIN5|BRONZE BUTLER|menuPass|FIN6|Turla Indrik Spider|Naikon|APT29|UNC2452|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Deep Panda|Ke3chang|Threat Group-3390|Dragonfly 2.0|Leafminer|FIN8|FIN5|APT3|BRONZE BUTLER|menuPass|FIN6|Turla
569 T1016 System Network Configuration Discovery Discovery Sandworm Team|Tropic Trooper|Frankenstein|APT41|Soft Cell|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang TeamTNT|ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|Threat Group-3390|menuPass|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang
570 T1014 Rootkit Defense Evasion Rocke|APT41|APT28|Winnti Group TeamTNT|Rocke|APT41|APT28|Winnti Group
571 T1012 Query Registry Discovery APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla ZIRCONIUM|Chimera|Fox Kitten|APT39|Operation Wocao|APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla
572 T1011 Exfiltration Over Other Network Medium Exfiltration no
573 T1010 Application Window Discovery Discovery Lazarus Group
574 T1008 Fallback Channels Command And Control APT41|OilRig|Lazarus Group FIN7|APT41|OilRig|Lazarus Group
575 T1007 System Service Discovery Discovery BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang Indrik Spider|Chimera|Operation Wocao|BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang
576 T1006 Direct Volume Access Defense Evasion no
577 T1005 Data from Local System Collection Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|Soft Cell|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang FIN7|APT41|APT38|Andariel|APT29|Windigo|UNC2452|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang
578 T1003 OS Credential Dumping Credential Access APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom Tonto Team|APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom
579 T1001 Data Obfuscation Command And Control Axiom Operation Wocao|Axiom
T1204.003 Malicious Image Execution no
T1580 Cloud Infrastructure Discovery Discovery no
T1547.014 Active Setup Persistence|Privilege Escalation no
T1595 Active Scanning Reconnaissance no
T1558.004 AS-REP Roasting Credential Access no
T1053.006 Systemd Timers Execution|Persistence|Privilege Escalation no
T1016.001 Internet Connection Discovery Discovery no
T1547.012 Print Processors Persistence|Privilege Escalation no
T1592 Gather Victim Host Information Reconnaissance no
T1218.012 Verclsid Defense Evasion no
T1590 Gather Victim Network Information Reconnaissance no
T1590.005 IP Addresses Reconnaissance no
T1588.002 Tool Resource Development no
T1557.002 ARP Cache Poisoning Credential Access|Collection no
T1542.005 TFTP Boot Defense Evasion|Persistence no
T1020.001 Traffic Duplication Exfiltration no
dist/escu/app.manifest
Vendored
+1 -1
View File
@@ -5,7 +5,7 @@
"id": {
"group": null,
"name": "DA-ESS-ContentUpdate",
"version": "3.36.0"
"version": "3.37.0"
},
"author": [
{
dist/escu/default/analyticstories.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# On Date: 2022-03-29T17:44:17 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/app.conf
Vendored
+2 -2
View File
@@ -4,7 +4,7 @@
is_configured = false
state = enabled
state_change_requires_restart = false
build = 6178
build = 6915
[triggers]
reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple
[launcher]
author = Splunk
version = 3.36.0
version = 3.37.0
description = Explore the Analytic Stories included with ES Content Updates.
[ui]
dist/escu/default/collections.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# On Date: 2022-03-29T17:44:17 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/content-version.conf
Vendored
+1 -1
View File
@@ -1,2 +1,2 @@
[content-version]
version = 3.36.0
version = 3.37.0
dist/escu/default/data/ui/panels/workbench_panel_all_backup_logs_for_host___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_get_backup_logs_for_endpoint___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_get_certificate_logs_for_a_domain___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_get_dns_server_history_for_a_host___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_get_dns_traffic_ratio___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_get_email_info___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_get_emails_from_specific_sender___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_get_history_of_email_sources___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_endpoint___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_user___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_get_notable_history___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_get_outbound_emails_to_hidden_cobra_threat_actors___response_task.xml
Vendored
-9
View File
@@ -1,9 +0,0 @@
<panel>
<table>
<search>
<query>| from datamodel Email.All_Email | search recipient=misswang8107@gmail.com OR src_user=redhat@gmail.com | stats count earliest(_time) as firstTime, latest(_time) as lastTime values(dest) values(src) by src_user recipient | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`</query>
</search>
<option name="drilldown">cell</option>
<option name="wrap">false</option>
</table>
</panel>
dist/escu/default/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_get_process_file_activity___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_get_process_info___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_get_process_information_for_port_activity___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_get_process_responsible_for_the_dns_traffic___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_get_sysmon_wmi_activity_for_host___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_get_web_session_information_via_session_id___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_investigate_network_traffic_from_src_ip___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_app___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_ip_address___response_task.xml
Vendored
-9
View File
@@ -1,9 +0,0 @@
<panel>
<table>
<search>
<query>`okta` src_ip={src_ip} | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason</query>
</search>
<option name="drilldown">cell</option>
<option name="wrap">false</option>
</table>
</panel>
dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_hash_attempts___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_ticket_attempts___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_investigate_previous_unseen_user___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_investigate_successful_remote_desktop_authentications___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_investigate_suspicious_strings_in_http_header___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_investigate_user_activities_in_okta___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/data/ui/panels/workbench_panel_investigate_web_posts_from_src___response_task.xml
Vendored
-6
View File
@@ -1,9 +1,3 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
<panel>
<table>
<search>
dist/escu/default/es_investigations.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# On Date: 2022-03-29T17:44:17 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/macros.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# On Date: 2022-03-29T17:44:17 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/savedsearches.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# On Date: 2022-03-29T17:44:17 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/transforms.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# On Date: 2022-03-29T17:44:17 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/workflow_actions.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T10:12:28 UTC
# On Date: 2022-03-29T17:44:17 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
docs/_pages/detections.md
+26 -25
View File
@@ -104,7 +104,7 @@ sidebar:
| [Cloud Provisioning Activity From Previously Unseen Country](/cloud/cloud_provisioning_activity_from_previously_unseen_country/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly |
| [Cloud Provisioning Activity From Previously Unseen IP Address](/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly |
| [Cloud Provisioning Activity From Previously Unseen Region](/cloud/cloud_provisioning_activity_from_previously_unseen_region/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly |
| [Cmdline Tool Not Executed In CMD Shell](/endpoint/cmdline_tool_not_executed_in_cmd_shell/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript/JScript](/tags/#javascript/jscript) | TTP |
| [Cmdline Tool Not Executed In CMD Shell](/endpoint/cmdline_tool_not_executed_in_cmd_shell/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript) | TTP |
| [Cobalt Strike Named Pipes](/endpoint/cobalt_strike_named_pipes/) | [Process Injection](/tags/#process-injection) | TTP |
| [Common Ransomware Extensions](/endpoint/common_ransomware_extensions/) | [Data Destruction](/tags/#data-destruction) | Hunting |
| [Common Ransomware Notes](/endpoint/common_ransomware_notes/) | [Data Destruction](/tags/#data-destruction) | Hunting |
@@ -133,7 +133,7 @@ sidebar:
| [Deleting Of Net Users](/endpoint/deleting_of_net_users/) | [Account Access Removal](/tags/#account-access-removal) | TTP |
| [Deleting Shadow Copies](/endpoint/deleting_shadow_copies/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
| [Detect API activity from users without MFA]() | None | Hunting |
| [Detect ARP Poisoning](/network/detect_arp_poisoning/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP |
| [Detect ARP Poisoning](/network/detect_arp_poisoning/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP |
| [Detect AWS API Activities From Unapproved Accounts](/deprecated/detect_aws_api_activities_from_unapproved_accounts/) | [Cloud Accounts](/tags/#cloud-accounts) | Hunting |
| [Detect AWS Console Login by New User]() | None | Hunting |
| [Detect AWS Console Login by User from New City](/cloud/detect_aws_console_login_by_user_from_new_city/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | Hunting |
@@ -159,7 +159,7 @@ sidebar:
| [Detect HTML Help Spawn Child Process](/endpoint/detect_html_help_spawn_child_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | TTP |
| [Detect HTML Help URL in Command Line](/endpoint/detect_html_help_url_in_command_line/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | TTP |
| [Detect HTML Help Using InfoTech Storage Handlers](/endpoint/detect_html_help_using_infotech_storage_handlers/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | TTP |
| [Detect IPv6 Network Infrastructure Threats](/network/detect_ipv6_network_infrastructure_threats/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP |
| [Detect IPv6 Network Infrastructure Threats](/network/detect_ipv6_network_infrastructure_threats/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP |
| [Detect Large Outbound ICMP Packets](/network/detect_large_outbound_icmp_packets/) | [Non-Application Layer Protocol](/tags/#non-application-layer-protocol) | TTP |
| [Detect Long DNS TXT Record Response](/deprecated/detect_long_dns_txt_record_response/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | TTP |
| [Detect MSHTA Url in Command Line](/endpoint/detect_mshta_url_in_command_line/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP |
@@ -175,7 +175,7 @@ sidebar:
| [Detect Outbound SMB Traffic](/network/detect_outbound_smb_traffic/) | [File Transfer Protocols](/tags/#file-transfer-protocols), [Application Layer Protocol](/tags/#application-layer-protocol) | TTP |
| [Detect Outlook exe writing a zip file](/endpoint/detect_outlook_exe_writing_a_zip_file/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP |
| [Detect Path Interception By Creation Of program exe](/endpoint/detect_path_interception_by_creation_of_program_exe/) | [Path Interception by Unquoted Path](/tags/#path-interception-by-unquoted-path), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP |
| [Detect Port Security Violation](/network/detect_port_security_violation/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP |
| [Detect Port Security Violation](/network/detect_port_security_violation/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP |
| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell) | Hunting |
| [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP |
| [Detect RClone Command-Line Usage](/endpoint/detect_rclone_command-line_usage/) | [Automated Exfiltration](/tags/#automated-exfiltration) | TTP |
@@ -191,7 +191,7 @@ sidebar:
| [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | Hunting |
| [Detect Renamed RClone](/endpoint/detect_renamed_rclone/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Hunting |
| [Detect Renamed WinRAR](/endpoint/detect_renamed_winrar/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data) | Hunting |
| [Detect Rogue DHCP Server](/network/detect_rogue_dhcp_server/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle) | TTP |
| [Detect Rogue DHCP Server](/network/detect_rogue_dhcp_server/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle) | TTP |
| [Detect Rundll32 Application Control Bypass - advpack](/endpoint/detect_rundll32_application_control_bypass_-_advpack/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
| [Detect Rundll32 Application Control Bypass - setupapi](/endpoint/detect_rundll32_application_control_bypass_-_setupapi/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
| [Detect Rundll32 Application Control Bypass - syssetup](/endpoint/detect_rundll32_application_control_bypass_-_syssetup/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
@@ -242,7 +242,7 @@ sidebar:
| [Disable Schedule Task](/endpoint/disable_schedule_task/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
| [Disable Security Logs Using MiniNt Registry](/endpoint/disable_security_logs_using_minint_registry/) | [Modify Registry](/tags/#modify-registry) | TTP |
| [Disable Show Hidden Files](/endpoint/disable_show_hidden_files/) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Hide Artifacts](/tags/#hide-artifacts), [Impair Defenses](/tags/#impair-defenses) | TTP |
| [Disable UAC Remote Restriction](/endpoint/disable_uac_remote_restriction/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
| [Disable UAC Remote Restriction](/endpoint/disable_uac_remote_restriction/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
| [Disable Windows App Hotkeys](/endpoint/disable_windows_app_hotkeys/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
| [Disable Windows Behavior Monitoring](/endpoint/disable_windows_behavior_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
| [Disable Windows SmartScreen Protection](/endpoint/disable_windows_smartscreen_protection/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
@@ -255,7 +255,7 @@ sidebar:
| [Disabling FolderOptions Windows Feature](/endpoint/disabling_folderoptions_windows_feature/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
| [Disabling Net User Account](/endpoint/disabling_net_user_account/) | [Account Access Removal](/tags/#account-access-removal) | TTP |
| [Disabling NoRun Windows App](/endpoint/disabling_norun_windows_app/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
| [Disabling SystemRestore In Registry](/endpoint/disabling_systemrestore_in_registry/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
| [Disabling Task Manager](/endpoint/disabling_task_manager/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
| [Domain Account Discovery With Net App](/endpoint/domain_account_discovery_with_net_app/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | TTP |
@@ -288,7 +288,7 @@ sidebar:
| [Enable WDigest UseLogonCredential Registry](/endpoint/enable_wdigest_uselogoncredential_registry/) | [Modify Registry](/tags/#modify-registry), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
| [Enumerate Users Local Group Using Telegram](/endpoint/enumerate_users_local_group_using_telegram/) | [Account Discovery](/tags/#account-discovery) | TTP |
| [Esentutl SAM Copy](/endpoint/esentutl_sam_copy/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | Hunting |
| [Eventvwr UAC Bypass](/endpoint/eventvwr_uac_bypass/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
| [Eventvwr UAC Bypass](/endpoint/eventvwr_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
| [Excel Spawning PowerShell](/endpoint/excel_spawning_powershell/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
| [Excel Spawning Windows Script Host](/endpoint/excel_spawning_windows_script_host/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
| [Excessive Attempt To Disable Services](/endpoint/excessive_attempt_to_disable_services/) | [Service Stop](/tags/#service-stop) | Anomaly |
@@ -317,12 +317,12 @@ sidebar:
| [First Time Seen Child Process of Zoom](/endpoint/first_time_seen_child_process_of_zoom/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | Anomaly |
| [First Time Seen Running Windows Service](/endpoint/first_time_seen_running_windows_service/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | Anomaly |
| [First time seen command line argument](/deprecated/first_time_seen_command_line_argument/) | [PowerShell](/tags/#powershell), [Windows Command Shell](/tags/#windows-command-shell) | Hunting |
| [FodHelper UAC Bypass](/endpoint/fodhelper_uac_bypass/) | [Modify Registry](/tags/#modify-registry), [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
| [FodHelper UAC Bypass](/endpoint/fodhelper_uac_bypass/) | [Modify Registry](/tags/#modify-registry), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
| [Fsutil Zeroing File](/endpoint/fsutil_zeroing_file/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP |
| [GCP Detect accounts with high risk roles by project](/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project/) | [Valid Accounts](/tags/#valid-accounts) | Hunting |
| [GCP Detect gcploit framework](/cloud/gcp_detect_gcploit_framework/) | [Valid Accounts](/tags/#valid-accounts) | TTP |
| [GCP Detect high risk permissions by resource and account](/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account/) | [Valid Accounts](/tags/#valid-accounts) | Hunting |
| [GCP GCR container uploaded](/deprecated/gcp_gcr_container_uploaded/) | [Implant Container Image](/tags/#implant-container-image) | Hunting |
| [GCP GCR container uploaded](/deprecated/gcp_gcr_container_uploaded/) | [Implant Internal Image](/tags/#implant-internal-image) | Hunting |
| [GCP Kubernetes cluster pod scan detection](/cloud/gcp_kubernetes_cluster_pod_scan_detection/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | Hunting |
| [GCP Kubernetes cluster scan detection](/deprecated/gcp_kubernetes_cluster_scan_detection/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | TTP |
| [GPUpdate with no Command Line Arguments with Network](/endpoint/gpupdate_with_no_command_line_arguments_with_network/) | [Process Injection](/tags/#process-injection) | TTP |
@@ -392,7 +392,7 @@ sidebar:
| [Impacket Lateral Movement Commandline Parameters](/endpoint/impacket_lateral_movement_commandline_parameters/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service) | TTP |
| [Interactive Session on Remote Endpoint with PowerShell](/endpoint/interactive_session_on_remote_endpoint_with_powershell/) | [Remote Services](/tags/#remote-services), [Windows Remote Management](/tags/#windows-remote-management) | TTP |
| [Java Class File download by Java User Agent](/endpoint/java_class_file_download_by_java_user_agent/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP |
| [Jscript Execution Using Cscript App](/endpoint/jscript_execution_using_cscript_app/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript/JScript](/tags/#javascript/jscript) | TTP |
| [Jscript Execution Using Cscript App](/endpoint/jscript_execution_using_cscript_app/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript) | TTP |
| [Kerberoasting spn request with RC4 encryption](/endpoint/kerberoasting_spn_request_with_rc4_encryption/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Kerberoasting](/tags/#kerberoasting) | TTP |
| [Kerberos Pre-Authentication Flag Disabled in UserAccountControl](/endpoint/kerberos_pre-authentication_flag_disabled_in_useraccountcontrol/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [AS-REP Roasting](/tags/#as-rep-roasting) | TTP |
| [Kerberos Pre-Authentication Flag Disabled with PowerShell](/endpoint/kerberos_pre-authentication_flag_disabled_with_powershell/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [AS-REP Roasting](/tags/#as-rep-roasting) | TTP |
@@ -431,8 +431,8 @@ sidebar:
| [Linux Doas Tool Execution](/endpoint/linux_doas_tool_execution/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | Anomaly |
| [Linux Edit Cron Table Parameter](/endpoint/linux_edit_cron_table_parameter/) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job) | Hunting |
| [Linux File Created In Kernel Driver Directory](/endpoint/linux_file_created_in_kernel_driver_directory/) | [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | Anomaly |
| [Linux File Creation In Init Boot Directory](/endpoint/linux_file_creation_in_init_boot_directory/) | [Rc.common](/tags/#rc.common), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts) | Anomaly |
| [Linux File Creation In Profile Directory](/endpoint/linux_file_creation_in_profile_directory/) | [.bash_profile and .bashrc](/tags/#.bash_profile-and-.bashrc), [Event Triggered Execution](/tags/#event-triggered-execution) | Anomaly |
| [Linux File Creation In Init Boot Directory](/endpoint/linux_file_creation_in_init_boot_directory/) | [RC Scripts](/tags/#rc-scripts), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts) | Anomaly |
| [Linux File Creation In Profile Directory](/endpoint/linux_file_creation_in_profile_directory/) | [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution) | Anomaly |
| [Linux Insert Kernel Module Using Insmod Utility](/endpoint/linux_insert_kernel_module_using_insmod_utility/) | [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | Anomaly |
| [Linux Install Kernel Module Using Modprobe Utility](/endpoint/linux_install_kernel_module_using_modprobe_utility/) | [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | Anomaly |
| [Linux Java Spawning Shell](/endpoint/linux_java_spawning_shell/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP |
@@ -441,11 +441,11 @@ sidebar:
| [Linux Possible Access To Credential Files](/endpoint/linux_possible_access_to_credential_files/) | [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping) | Anomaly |
| [Linux Possible Access To Sudoers File](/endpoint/linux_possible_access_to_sudoers_file/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | Anomaly |
| [Linux Possible Append Command To At Allow Config File](/endpoint/linux_possible_append_command_to_at_allow_config_file/) | [At (Linux)](/tags/#at-(linux)), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly |
| [Linux Possible Append Command To Profile Config File](/endpoint/linux_possible_append_command_to_profile_config_file/) | [.bash_profile and .bashrc](/tags/#.bash_profile-and-.bashrc), [Event Triggered Execution](/tags/#event-triggered-execution) | Anomaly |
| [Linux Possible Append Command To Profile Config File](/endpoint/linux_possible_append_command_to_profile_config_file/) | [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution) | Anomaly |
| [Linux Possible Append Cronjob Entry on Existing Cronjob File](/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file/) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job) | Hunting |
| [Linux Possible Cronjob Modification With Editor](/endpoint/linux_possible_cronjob_modification_with_editor/) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job) | Hunting |
| [Linux Possible Ssh Key File Creation](/endpoint/linux_possible_ssh_key_file_creation/) | [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation) | Anomaly |
| [Linux Preload Hijack Library Calls](/endpoint/linux_preload_hijack_library_calls/) | [LD_PRELOAD](/tags/#ld_preload), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP |
| [Linux Preload Hijack Library Calls](/endpoint/linux_preload_hijack_library_calls/) | [Dynamic Linker Hijacking](/tags/#dynamic-linker-hijacking), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP |
| [Linux Service File Created In Systemd Directory](/endpoint/linux_service_file_created_in_systemd_directory/) | [Systemd Timers](/tags/#systemd-timers), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly |
| [Linux Service Restarted](/endpoint/linux_service_restarted/) | [Systemd Timers](/tags/#systemd-timers), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly |
| [Linux Service Started Or Enabled](/endpoint/linux_service_started_or_enabled/) | [Systemd Timers](/tags/#systemd-timers), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly |
@@ -464,8 +464,8 @@ sidebar:
| [Log4Shell JNDI Payload Injection with Outbound Connection](/web/log4shell_jndi_payload_injection_with_outbound_connection/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | Anomaly |
| [Logon Script Event Trigger Execution](/endpoint/logon_script_event_trigger_execution/) | [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Logon Script (Windows)](/tags/#logon-script-(windows)) | TTP |
| [MS Exchange Mailbox Replication service writing Active Server Pages](/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP |
| [MS Scripting Process Loading Ldap Module](/endpoint/ms_scripting_process_loading_ldap_module/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript/JScript](/tags/#javascript/jscript) | Anomaly |
| [MS Scripting Process Loading WMI Module](/endpoint/ms_scripting_process_loading_wmi_module/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript/JScript](/tags/#javascript/jscript) | Anomaly |
| [MS Scripting Process Loading Ldap Module](/endpoint/ms_scripting_process_loading_ldap_module/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript) | Anomaly |
| [MS Scripting Process Loading WMI Module](/endpoint/ms_scripting_process_loading_wmi_module/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript) | Anomaly |
| [MSBuild Suspicious Spawned By Script Process](/endpoint/msbuild_suspicious_spawned_by_script_process/) | [MSBuild](/tags/#msbuild), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | TTP |
| [MSHTML Module Load in Office Product](/endpoint/mshtml_module_load_in_office_product/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP |
| [MSI Module Loaded by Non-System Binary](/endpoint/msi_module_loaded_by_non-system_binary/) | [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow) | Hunting |
@@ -494,14 +494,14 @@ sidebar:
| [Multiple Users Failing To Authenticate From Host Using NTLM](/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly |
| [Multiple Users Failing To Authenticate From Process](/endpoint/multiple_users_failing_to_authenticate_from_process/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly |
| [Multiple Users Remotely Failing To Authenticate From Host](/endpoint/multiple_users_remotely_failing_to_authenticate_from_host/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly |
| [NET Profiler UAC bypass](/endpoint/net_profiler_uac_bypass/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
| [NET Profiler UAC bypass](/endpoint/net_profiler_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
| [NLTest Domain Trust Discovery](/endpoint/nltest_domain_trust_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP |
| [Net Localgroup Discovery](/endpoint/net_localgroup_discovery/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | Hunting |
| [Network Connection Discovery With Arp](/endpoint/network_connection_discovery_with_arp/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | Hunting |
| [Network Connection Discovery With Net](/endpoint/network_connection_discovery_with_net/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | Hunting |
| [Network Connection Discovery With Netstat](/endpoint/network_connection_discovery_with_netstat/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | Hunting |
| [Network Discovery Using Route Windows App](/endpoint/network_discovery_using_route_windows_app/) | [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Internet Connection Discovery](/tags/#internet-connection-discovery) | Hunting |
| [New container uploaded to AWS ECR](/cloud/new_container_uploaded_to_aws_ecr/) | [Implant Container Image](/tags/#implant-container-image) | Hunting |
| [New container uploaded to AWS ECR](/cloud/new_container_uploaded_to_aws_ecr/) | [Implant Internal Image](/tags/#implant-internal-image) | Hunting |
| [Nishang PowershellTCPOneLine](/endpoint/nishang_powershelltcponeline/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP |
| [No Windows Updates in a time frame]() | None | Hunting |
| [Non Chrome Process Accessing Chrome Default Dir](/endpoint/non_chrome_process_accessing_chrome_default_dir/) | [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers) | Anomaly |
@@ -632,8 +632,8 @@ sidebar:
| [Ryuk Test Files Detected](/endpoint/ryuk_test_files_detected/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | TTP |
| [Ryuk Wake on LAN Command](/endpoint/ryuk_wake_on_lan_command/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell) | TTP |
| [SAM Database File Access Attempt](/endpoint/sam_database_file_access_attempt/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | Hunting |
| [SLUI RunAs Elevated](/endpoint/slui_runas_elevated/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
| [SLUI Spawning a Process](/endpoint/slui_spawning_a_process/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
| [SLUI RunAs Elevated](/endpoint/slui_runas_elevated/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
| [SLUI Spawning a Process](/endpoint/slui_spawning_a_process/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
| [SMB Traffic Spike](/network/smb_traffic_spike/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | Anomaly |
| [SMB Traffic Spike - MLTK](/network/smb_traffic_spike_-_mltk/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | Anomaly |
| [SQL Injection with Long URLs](/web/sql_injection_with_long_urls/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP |
@@ -651,7 +651,7 @@ sidebar:
| [Schtasks used for forcing a reboot](/endpoint/schtasks_used_for_forcing_a_reboot/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP |
| [Screensaver Event Trigger Execution](/endpoint/screensaver_event_trigger_execution/) | [Event Triggered Execution](/tags/#event-triggered-execution), [Screensaver](/tags/#screensaver) | TTP |
| [Script Execution via WMI](/endpoint/script_execution_via_wmi/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP |
| [Sdclt UAC Bypass](/endpoint/sdclt_uac_bypass/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
| [Sdclt UAC Bypass](/endpoint/sdclt_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
| [Sdelete Application Execution](/endpoint/sdelete_application_execution/) | [Data Destruction](/tags/#data-destruction), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP |
| [SearchProtocolHost with no Command Line with Network](/endpoint/searchprotocolhost_with_no_command_line_with_network/) | [Process Injection](/tags/#process-injection) | TTP |
| [SecretDumps Offline NTDS Dumping Tool](/endpoint/secretdumps_offline_ntds_dumping_tool/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
@@ -664,10 +664,11 @@ sidebar:
| [Shim Database Installation With Suspicious Parameters](/endpoint/shim_database_installation_with_suspicious_parameters/) | [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP |
| [Short Lived Scheduled Task](/endpoint/short_lived_scheduled_task/) | [Scheduled Task](/tags/#scheduled-task) | TTP |
| [Short Lived Windows Accounts](/endpoint/short_lived_windows_accounts/) | [Local Account](/tags/#local-account), [Create Account](/tags/#create-account) | TTP |
| [SilentCleanup UAC Bypass](/endpoint/silentcleanup_uac_bypass/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
| [SilentCleanup UAC Bypass](/endpoint/silentcleanup_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
| [Single Letter Process On Endpoint](/endpoint/single_letter_process_on_endpoint/) | [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file) | TTP |
| [Spectre and Meltdown Vulnerable Systems]() | None | TTP |
| [Spike in File Writes]() | None | Anomaly |
| [Splunk DoS via Malformed S2S Request](/application/splunk_dos_via_malformed_s2s_request/) | [Network Denial of Service](/tags/#network-denial-of-service) | TTP |
| [Splunk Enterprise Information Disclosure]() | None | TTP |
| [Spoolsv Spawning Rundll32](/endpoint/spoolsv_spawning_rundll32/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP |
| [Spoolsv Suspicious Loaded Modules](/endpoint/spoolsv_suspicious_loaded_modules/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP |
@@ -731,7 +732,7 @@ sidebar:
| [TOR Traffic](/network/tor_traffic/) | [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | TTP |
| [Time Provider Persistence Registry](/endpoint/time_provider_persistence_registry/) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP |
| [Trickbot Named Pipe](/endpoint/trickbot_named_pipe/) | [Process Injection](/tags/#process-injection) | TTP |
| [UAC Bypass MMC Load Unsigned Dll](/endpoint/uac_bypass_mmc_load_unsigned_dll/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
| [UAC Bypass MMC Load Unsigned Dll](/endpoint/uac_bypass_mmc_load_unsigned_dll/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
| [UAC Bypass With Colorui COM Object](/endpoint/uac_bypass_with_colorui_com_object/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp) | TTP |
| [USN Journal Deletion](/endpoint/usn_journal_deletion/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP |
| [Uncommon Processes On Endpoint](/deprecated/uncommon_processes_on_endpoint/) | [Malicious File](/tags/#malicious-file) | Hunting |
@@ -758,7 +759,7 @@ sidebar:
| [WMI Recon Running Process Or Services](/endpoint/wmi_recon_running_process_or_services/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | TTP |
| [WMI Temporary Event Subscription](/endpoint/wmi_temporary_event_subscription/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP |
| [WMIC XSL Execution via URL](/endpoint/wmic_xsl_execution_via_url/) | [XSL Script Processing](/tags/#xsl-script-processing) | TTP |
| [WSReset UAC Bypass](/endpoint/wsreset_uac_bypass/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
| [WSReset UAC Bypass](/endpoint/wsreset_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
| [Wbemprox COM Object Execution](/endpoint/wbemprox_com_object_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp) | TTP |
| [Web Fraud - Account Harvesting](/deprecated/web_fraud_-_account_harvesting/) | [Create Account](/tags/#create-account) | TTP |
| [Web Fraud - Anomalous User Clickspeed](/deprecated/web_fraud_-_anomalous_user_clickspeed/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly |
docs/_pages/stories.md
+13 -14
View File
@@ -36,12 +36,12 @@ sidebar:
| [Collection and Staging](collection_and_staging) | [Masquerading](/tags/#masquerading), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Email Collection](/tags/#email-collection), [Local Email Collection](/tags/#local-email-collection), [Remote Email Collection](/tags/#remote-email-collection) | [Collection](/tags/#collection), [Defense Evasion](/tags/#defense-evasion) |
| [Command and Control](command_and_control) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [DNS](/tags/#dns), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols), [Drive-by Compromise](/tags/#drive-by-compromise) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) |
| [Common Phishing Frameworks](common_phishing_frameworks) | [Spearphishing via Service](/tags/#spearphishing-via-service) | [Initial Access](/tags/#initial-access) |
| [Container Implantation Monitoring and Investigation](container_implantation_monitoring_and_investigation) | [Implant Container Image](/tags/#implant-container-image) | [Persistence](/tags/#persistence) |
| [Container Implantation Monitoring and Investigation](container_implantation_monitoring_and_investigation) | [Implant Internal Image](/tags/#implant-internal-image) | [Persistence](/tags/#persistence) |
| [Credential Dumping](credential_dumping) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager), [NTDS](/tags/#ntds), [Modify Registry](/tags/#modify-registry), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution) |
| [DHS Report TA18-074A](dhs_report_ta18-074a) | [PowerShell](/tags/#powershell), [Windows Command Shell](/tags/#windows-command-shell), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job), [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file), [Modify Registry](/tags/#modify-registry), [File Transfer Protocols](/tags/#file-transfer-protocols), [Application Layer Protocol](/tags/#application-layer-protocol) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [DNS Amplification Attacks](dns_amplification_attacks) | [Network Denial of Service](/tags/#network-denial-of-service), [Reflection Amplification](/tags/#reflection-amplification) | [Impact](/tags/#impact) |
| [DNS Hijacking](dns_hijacking) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [DNS](/tags/#dns), [Drive-by Compromise](/tags/#drive-by-compromise) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) |
| [DarkSide Ransomware](darkside_ransomware) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp), [Process Injection](/tags/#process-injection), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [LSASS Memory](/tags/#lsass-memory), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Automated Exfiltration](/tags/#automated-exfiltration), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [DarkSide Ransomware](darkside_ransomware) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp), [Process Injection](/tags/#process-injection), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [LSASS Memory](/tags/#lsass-memory), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Automated Exfiltration](/tags/#automated-exfiltration), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Data Destruction](data_destruction) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Masquerading](/tags/#masquerading), [Data Destruction](/tags/#data-destruction), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Modify Registry](/tags/#modify-registry), [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Data Exfiltration](data_exfiltration) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Local Email Collection](/tags/#local-email-collection), [Phishing](/tags/#phishing), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | [Collection](/tags/#collection), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) |
| [Data Protection](data_protection) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Drive-by Compromise](/tags/#drive-by-compromise) | [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) |
@@ -54,23 +54,23 @@ sidebar:
| [Dynamic DNS](dynamic_dns) | [Web Protocols](/tags/#web-protocols), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Drive-by Compromise](/tags/#drive-by-compromise) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) |
| [Emotet Malware DHS Report TA18-201A ](emotet_malware__dhs_report_ta18-201a_) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing), [Software Deployment Tools](/tags/#software-deployment-tools), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [F5 TMUI RCE CVE-2020-5902](f5_tmui_rce_cve-2020-5902) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
| [FIN7](fin7) | [System Owner/User Discovery](/tags/#system-owner/user-discovery), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript/JScript](/tags/#javascript/jscript), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Visual Basic](/tags/#visual-basic), [Process Injection](/tags/#process-injection), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation), [XSL Script Processing](/tags/#xsl-script-processing) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [FIN7](fin7) | [System Owner/User Discovery](/tags/#system-owner/user-discovery), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Visual Basic](/tags/#visual-basic), [Process Injection](/tags/#process-injection), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation), [XSL Script Processing](/tags/#xsl-script-processing) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [GCP Cross Account Activity](gcp_cross_account_activity) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [HAFNIUM Group](hafnium_group) | [LSASS Memory](/tags/#lsass-memory), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell), [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [OS Credential Dumping](/tags/#os-credential-dumping), [NTDS](/tags/#ntds), [Email Collection](/tags/#email-collection), [Remote Email Collection](/tags/#remote-email-collection) | [Collection](/tags/#collection), [Credential Access](/tags/#credential-access), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence) |
| [Hermetic Wiper](hermetic_wiper) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Masquerading](/tags/#masquerading), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Data Destruction](/tags/#data-destruction), [Modify Registry](/tags/#modify-registry), [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Hidden Cobra Malware](hidden_cobra_malware) | [PowerShell](/tags/#powershell), [Windows Command Shell](/tags/#windows-command-shell), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Network Share Connection Removal](/tags/#network-share-connection-removal), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services), [File Transfer Protocols](/tags/#file-transfer-protocols), [Application Layer Protocol](/tags/#application-layer-protocol), [DNS](/tags/#dns), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Lateral Movement](/tags/#lateral-movement) |
| [Host Redirection](host_redirection) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [DNS](/tags/#dns) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration) |
| [IcedID](icedid) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [Process Injection](/tags/#process-injection), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file), [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Modify Registry](/tags/#modify-registry), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Regsvr32](/tags/#regsvr32), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data from Local System](/tags/#data-from-local-system), [Scheduled Task](/tags/#scheduled-task) | [Collection](/tags/#collection), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [IcedID](icedid) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [Process Injection](/tags/#process-injection), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Modify Registry](/tags/#modify-registry), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Regsvr32](/tags/#regsvr32), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data from Local System](/tags/#data-from-local-system), [Scheduled Task](/tags/#scheduled-task) | [Collection](/tags/#collection), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Information Sabotage](information_sabotage) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | [Exfiltration](/tags/#exfiltration) |
| [Ingress Tool Transfer](ingress_tool_transfer) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence) |
| [JBoss Vulnerability](jboss_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) |
| [Kubernetes Scanning Activity](kubernetes_scanning_activity) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) |
| [Kubernetes Sensitive Object Access Activity]() | None | None |
| [Kubernetes Sensitive Role Activity]() | None | None |
| [Linux Persistence Techniques](linux_persistence_techniques) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [At (Linux)](/tags/#at-(linux)), [Linux and Mac File and Directory Permissions Modification](/tags/#linux-and-mac-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Setuid and Setgid](/tags/#setuid-and-setgid), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Rc.common](/tags/#rc.common), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [.bash_profile and .bashrc](/tags/#.bash_profile-and-.bashrc), [Event Triggered Execution](/tags/#event-triggered-execution), [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation), [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping), [LD_PRELOAD](/tags/#ld_preload), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Systemd Timers](/tags/#systemd-timers) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Linux Persistence Techniques](linux_persistence_techniques) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [At (Linux)](/tags/#at-(linux)), [Linux and Mac File and Directory Permissions Modification](/tags/#linux-and-mac-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Setuid and Setgid](/tags/#setuid-and-setgid), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [RC Scripts](/tags/#rc-scripts), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution), [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation), [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping), [Dynamic Linker Hijacking](/tags/#dynamic-linker-hijacking), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Systemd Timers](/tags/#systemd-timers) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Linux Post-Exploitation](linux_post-exploitation) | [Unix Shell](/tags/#unix-shell) | [Execution](/tags/#execution) |
| [Linux Privilege Escalation](linux_privilege_escalation) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [At (Linux)](/tags/#at-(linux)), [Linux and Mac File and Directory Permissions Modification](/tags/#linux-and-mac-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Setuid and Setgid](/tags/#setuid-and-setgid), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Rc.common](/tags/#rc.common), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [.bash_profile and .bashrc](/tags/#.bash_profile-and-.bashrc), [Event Triggered Execution](/tags/#event-triggered-execution), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation), [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping), [LD_PRELOAD](/tags/#ld_preload), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Systemd Timers](/tags/#systemd-timers) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Living Off The Land](living_off_the_land) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Control Panel](/tags/#control-panel), [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping), [Compiled HTML File](/tags/#compiled-html-file), [Mshta](/tags/#mshta), [Regsvcs/Regasm](/tags/#regsvcs/regasm), [Regsvr32](/tags/#regsvr32), [Rundll32](/tags/#rundll32), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [LSASS Memory](/tags/#lsass-memory), [Security Account Manager](/tags/#security-account-manager), [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Unix Shell](/tags/#unix-shell), [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Process Injection](/tags/#process-injection), [Modify Registry](/tags/#modify-registry), [Scheduled Task/Job](/tags/#scheduled-task/job), [At (Windows)](/tags/#at-(windows)), [Scheduled Task](/tags/#scheduled-task), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service), [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [InstallUtil](/tags/#installutil) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Linux Privilege Escalation](linux_privilege_escalation) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [At (Linux)](/tags/#at-(linux)), [Linux and Mac File and Directory Permissions Modification](/tags/#linux-and-mac-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Setuid and Setgid](/tags/#setuid-and-setgid), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [RC Scripts](/tags/#rc-scripts), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation), [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping), [Dynamic Linker Hijacking](/tags/#dynamic-linker-hijacking), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Systemd Timers](/tags/#systemd-timers) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Living Off The Land](living_off_the_land) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Control Panel](/tags/#control-panel), [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping), [Compiled HTML File](/tags/#compiled-html-file), [Mshta](/tags/#mshta), [Regsvcs/Regasm](/tags/#regsvcs/regasm), [Regsvr32](/tags/#regsvr32), [Rundll32](/tags/#rundll32), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [LSASS Memory](/tags/#lsass-memory), [Security Account Manager](/tags/#security-account-manager), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Unix Shell](/tags/#unix-shell), [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Process Injection](/tags/#process-injection), [Modify Registry](/tags/#modify-registry), [Scheduled Task/Job](/tags/#scheduled-task/job), [At (Windows)](/tags/#at-(windows)), [Scheduled Task](/tags/#scheduled-task), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service), [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [InstallUtil](/tags/#installutil) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Log4Shell CVE-2021-44228](log4shell_cve-2021-44228) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell), [Windows Command Shell](/tags/#windows-command-shell), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Command And Control](/tags/#command-and-control), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access) |
| [Malicious PowerShell](malicious_powershell) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [OS Credential Dumping](/tags/#os-credential-dumping), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [Process Injection](/tags/#process-injection), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Impair Defenses](/tags/#impair-defenses) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
| [Masquerading - Rename System Utilities](masquerading_-_rename_system_utilities) | [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Masquerading](/tags/#masquerading), [Rundll32](/tags/#rundll32), [Data Destruction](/tags/#data-destruction), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [MSBuild](/tags/#msbuild), [InstallUtil](/tags/#installutil) | [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact) |
@@ -91,9 +91,9 @@ sidebar:
| [ProxyShell](proxyshell) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) |
| [Ransomware](ransomware) | [Scheduled Task](/tags/#scheduled-task), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp), [Data Destruction](/tags/#data-destruction), [User Execution](/tags/#user-execution), [Automated Exfiltration](/tags/#automated-exfiltration), [Domain Account](/tags/#domain-account), [Local Groups](/tags/#local-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Local Account](/tags/#local-account), [Account Discovery](/tags/#account-discovery), [Domain Groups](/tags/#domain-groups), [Permission Groups Discovery](/tags/#permission-groups-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Service Stop](/tags/#service-stop), [Account Access Removal](/tags/#account-access-removal), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Visual Basic](/tags/#visual-basic), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Modify Registry](/tags/#modify-registry), [Scheduled Task/Job](/tags/#scheduled-task/job), [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Msiexec](/tags/#msiexec), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [InstallUtil](/tags/#installutil), [Tool](/tags/#tool), [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance), [Resource Development](/tags/#resource-development) |
| [Ransomware Cloud](ransomware_cloud) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) |
| [Remcos](remcos) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript/JScript](/tags/#javascript/jscript), [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Regsvr32](/tags/#regsvr32), [Modify Registry](/tags/#modify-registry), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Component Object Model](/tags/#component-object-model), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Screen Capture](/tags/#screen-capture), [Visual Basic](/tags/#visual-basic), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Collection](/tags/#collection), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
| [Remcos](remcos) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript), [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Regsvr32](/tags/#regsvr32), [Modify Registry](/tags/#modify-registry), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Component Object Model](/tags/#component-object-model), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Screen Capture](/tags/#screen-capture), [Visual Basic](/tags/#visual-basic), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Collection](/tags/#collection), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
| [Revil Ransomware](revil_ransomware) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [User Execution](/tags/#user-execution), [Modify Registry](/tags/#modify-registry), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Router and Infrastructure Security](router_and_infrastructure_security) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning), [TFTP Boot](/tags/#tftp-boot), [Pre-OS Boot](/tags/#pre-os-boot), [Automated Exfiltration](/tags/#automated-exfiltration), [Traffic Duplication](/tags/#traffic-duplication) | [Collection](/tags/#collection), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Exfiltration](/tags/#exfiltration), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) |
| [Router and Infrastructure Security](router_and_infrastructure_security) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning), [TFTP Boot](/tags/#tftp-boot), [Pre-OS Boot](/tags/#pre-os-boot), [Automated Exfiltration](/tags/#automated-exfiltration), [Traffic Duplication](/tags/#traffic-duplication) | [Collection](/tags/#collection), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Exfiltration](/tags/#exfiltration), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) |
| [Ryuk Ransomware](ryuk_ransomware) | [Windows Command Shell](/tags/#windows-command-shell), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Data Destruction](/tags/#data-destruction), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Service Stop](/tags/#service-stop), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [SQL Injection](sql_injection) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
| [SamSam Ransomware](samsam_ransomware) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Masquerading](/tags/#masquerading), [OS Credential Dumping](/tags/#os-credential-dumping), [Active Scanning](/tags/#active-scanning), [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file), [Data Destruction](/tags/#data-destruction), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [System Information Discovery](/tags/#system-information-discovery) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Reconnaissance](/tags/#reconnaissance) |
@@ -101,8 +101,7 @@ sidebar:
| [Silver Sparrow](silver_sparrow) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Launch Agent](/tags/#launch-agent), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Data Staged](/tags/#data-staged) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Spearphishing Attachments](spearphishing_attachments) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Spearphishing Link](/tags/#spearphishing-link) | [Credential Access](/tags/#credential-access), [Initial Access](/tags/#initial-access) |
| [Spectre And Meltdown Vulnerabilities]() | None | None |
| [Splunk Enterprise Vulnerability]() | None | None |
| [Splunk Enterprise Vulnerability CVE-2018-11409]() | None | None |
| [Splunk Vulnerabilities](splunk_vulnerabilities) | [Network Denial of Service](/tags/#network-denial-of-service) | [Impact](/tags/#impact) |
| [Suspicious AWS EC2 Activities](suspicious_aws_ec2_activities) | [Cloud Accounts](/tags/#cloud-accounts), [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Suspicious AWS Login Activities](suspicious_aws_login_activities) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions), [Cloud Accounts](/tags/#cloud-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Suspicious AWS S3 Activities](suspicious_aws_s3_activities) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) |
@@ -122,7 +121,7 @@ sidebar:
| [Suspicious Regsvr32 Activity](suspicious_regsvr32_activity) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32), [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion) |
| [Suspicious Rundll32 Activity](suspicious_rundll32_activity) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Masquerading](/tags/#masquerading), [Rundll32](/tags/#rundll32), [Rename System Utilities](/tags/#rename-system-utilities), [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion) |
| [Suspicious WMI Use](suspicious_wmi_use) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription), [Event Triggered Execution](/tags/#event-triggered-execution), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [XSL Script Processing](/tags/#xsl-script-processing) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Suspicious Windows Registry Activities](suspicious_windows_registry_activities) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Change Default File Association](/tags/#change-default-file-association), [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Port Monitors](/tags/#port-monitors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Suspicious Windows Registry Activities](suspicious_windows_registry_activities) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Change Default File Association](/tags/#change-default-file-association), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Port Monitors](/tags/#port-monitors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Suspicious Zoom Child Processes](suspicious_zoom_child_processes) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Execution](/tags/#execution), [Privilege Escalation](/tags/#privilege-escalation) |
| [Trickbot](trickbot) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Process Injection](/tags/#process-injection), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Scheduled Task/Job](/tags/#scheduled-task/job), [Rundll32](/tags/#rundll32), [Gather Victim Network Information](/tags/#gather-victim-network-information), [IP Addresses](/tags/#ip-addresses), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
| [Trusted Developer Utilities Proxy Execution](trusted_developer_utilities_proxy_execution) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
@@ -133,13 +132,13 @@ sidebar:
| [Web Fraud Detection](web_fraud_detection) | [Create Account](/tags/#create-account), [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [WhisperGate](whispergate) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Data Destruction](/tags/#data-destruction), [Masquerading](/tags/#masquerading), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Virtualization/Sandbox Evasion](/tags/#virtualization/sandbox-evasion), [Time Based Evasion](/tags/#time-based-evasion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Visual Basic](/tags/#visual-basic), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil), [Tool](/tags/#tool), [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe), [Process Injection](/tags/#process-injection), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Resource Development](/tags/#resource-development) |
| [Windows DNS SIGRed CVE-2020-1350](windows_dns_sigred_cve-2020-1350) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) |
| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Compile After Delivery](/tags/#compile-after-delivery), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Modify Registry](/tags/#modify-registry), [Hide Artifacts](/tags/#hide-artifacts), [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact), [Privilege Escalation](/tags/#privilege-escalation) |
| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Compile After Delivery](/tags/#compile-after-delivery), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Modify Registry](/tags/#modify-registry), [Hide Artifacts](/tags/#hide-artifacts), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact), [Privilege Escalation](/tags/#privilege-escalation) |
| [Windows Discovery Techniques](windows_discovery_techniques) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) |
| [Windows File Extension and Association Abuse](windows_file_extension_and_association_abuse) | [Rename System Utilities](/tags/#rename-system-utilities), [Change Default File Association](/tags/#change-default-file-association), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Windows Log Manipulation](windows_log_manipulation) | [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact) |
| [Windows Persistence Techniques](windows_persistence_techniques) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Active Setup](/tags/#active-setup), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution), [Path Interception by Unquoted Path](/tags/#path-interception-by-unquoted-path), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Impair Defenses](/tags/#impair-defenses), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Logon Script (Windows)](/tags/#logon-script-(windows)), [Port Monitors](/tags/#port-monitors), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Application Shimming](/tags/#application-shimming), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Scheduled Task/Job](/tags/#scheduled-task/job), [Scheduled Task](/tags/#scheduled-task), [Screensaver](/tags/#screensaver), [Time Providers](/tags/#time-providers), [Print Processors](/tags/#print-processors) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Windows Privilege Escalation](windows_privilege_escalation) | [Malicious File](/tags/#malicious-file), [Active Setup](/tags/#active-setup), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution), [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Impair Defenses](/tags/#impair-defenses), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Kerberoasting](/tags/#kerberoasting), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Logon Script (Windows)](/tags/#logon-script-(windows)), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Accessibility Features](/tags/#accessibility-features), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Access Token Manipulation](/tags/#access-token-manipulation), [Token Impersonation/Theft](/tags/#token-impersonation/theft), [Screensaver](/tags/#screensaver), [Time Providers](/tags/#time-providers), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Print Processors](/tags/#print-processors) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Windows Registry Abuse](windows_registry_abuse) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials), [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Modify Registry](/tags/#modify-registry), [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Hide Artifacts](/tags/#hide-artifacts), [Bypass User Access Control](/tags/#bypass-user-access-control), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Defacement](/tags/#defacement), [Port Monitors](/tags/#port-monitors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Application Shimming](/tags/#application-shimming), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Screensaver](/tags/#screensaver), [Time Providers](/tags/#time-providers), [Data Destruction](/tags/#data-destruction), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Windows Registry Abuse](windows_registry_abuse) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials), [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Modify Registry](/tags/#modify-registry), [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Hide Artifacts](/tags/#hide-artifacts), [Bypass User Account Control](/tags/#bypass-user-account-control), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Defacement](/tags/#defacement), [Port Monitors](/tags/#port-monitors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Application Shimming](/tags/#application-shimming), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Screensaver](/tags/#screensaver), [Time Providers](/tags/#time-providers), [Data Destruction](/tags/#data-destruction), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Windows Service Abuse](windows_service_abuse) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [XMRig](xmrig) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Masquerading](/tags/#masquerading), [OS Credential Dumping](/tags/#os-credential-dumping), [Active Scanning](/tags/#active-scanning), [Account Access Removal](/tags/#account-access-removal), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Account Discovery](/tags/#account-discovery), [Service Stop](/tags/#service-stop), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Scheduled Task/Job](/tags/#scheduled-task/job), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
| [sAMAccountName Spoofing and Domain Controller Impersonation](samaccountname_spoofing_and_domain_controller_impersonation) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
docs/_posts/2017-09-19-open_redirect_in_splunk_web.md
+1 -1
View File
@@ -52,7 +52,7 @@ No extra steps needed to implement this search.
None identified
#### Associated Analytic story
* [Splunk Enterprise Vulnerability](/stories/splunk_enterprise_vulnerability)
* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities)
#### Kill Chain Phase
docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md
+1 -1
View File
@@ -42,9 +42,9 @@ This search looks for DNS requests for faux domains similar to the domains that
#### Macros
The SPL above uses the following Macros:
* [brand_abuse_dns](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_dns.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [brand_abuse_dns](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_dns.yml)
Note that `monitor_dns_for_brand_abuse_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md
+1 -1
View File
@@ -44,8 +44,8 @@ This search looks for Web requests to faux domains similar to the one that you w
#### Macros
The SPL above uses the following Macros:
* [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `monitor_web_traffic_for_brand_abuse_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md
+1 -1
View File
@@ -55,8 +55,8 @@ This search looks for AWS CloudTrail events where an instance is started in a pa
#### Macros
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `ec2_instance_started_in_previously_unseen_region_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md
+1 -1
View File
@@ -50,8 +50,8 @@ This search looks for EC2 instances being created with previously unseen AMIs.
#### Macros
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `ec2_instance_started_with_previously_unseen_ami_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md
+1 -1
View File
@@ -63,8 +63,8 @@ This search detects new API calls that have either never been seen before or tha
#### Macros
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `detect_new_api_calls_from_user_roles_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md
+1 -1
View File
@@ -68,8 +68,8 @@ This search will detect users creating spikes in API activity related to securit
#### Macros
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_group_api_calls](https://github.com/splunk/security_content/blob/develop/macros/security_group_api_calls.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `detect_spike_in_security_group_activity_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md
+1 -1
View File
@@ -44,8 +44,8 @@ This search looks for AWS CloudTrail events where a user logged into the AWS acc
#### Macros
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `detect_api_activity_from_users_without_mfa_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2018-06-14-splunk_enterprise_information_disclosure.md
+1 -1
View File
@@ -58,7 +58,7 @@ The REST endpoint that exposes system information is also necessary for the prop
Retrieving server information may be a legitimate API request. Verify that the attempt is a valid request for information.
#### Associated Analytic story
* [Splunk Enterprise Vulnerability CVE-2018-11409](/stories/splunk_enterprise_vulnerability_cve-2018-11409)
* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities)
#### Kill Chain Phase
docs/_posts/2018-10-23-wmi_permanent_event_subscription.md
+1 -1
View File
@@ -56,8 +56,8 @@ This search looks for the creation of WMI permanent event subscriptions.
#### Macros
The SPL above uses the following Macros:
* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml)
Note that `wmi_permanent_event_subscription_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2018-10-23-wmi_temporary_event_subscription.md
+1 -1
View File
@@ -55,8 +55,8 @@ This search looks for the creation of WMI temporary event subscriptions.
#### Macros
The SPL above uses the following Macros:
* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml)
Note that `wmi_temporary_event_subscription_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2018-12-03-remote_wmi_command_attempt.md
+1 -1
View File
@@ -53,8 +53,8 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
Note that `remote_wmi_command_attempt_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2019-04-25-suspicious_file_write.md
+1 -1
View File
@@ -42,9 +42,9 @@ The search looks for files created with names that have been linked to malicious
#### Macros
The SPL above uses the following Macros:
* [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml)
Note that `suspicious_file_write_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2019-10-11-prohibited_software_on_endpoint.md
+1 -1
View File
@@ -43,8 +43,8 @@ This search looks for applications on the endpoint that you have marked as prohi
#### Macros
The SPL above uses the following Macros:
* [prohibited_softwares](https://github.com/splunk/security_content/blob/develop/macros/prohibited_softwares.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [prohibited_softwares](https://github.com/splunk/security_content/blob/develop/macros/prohibited_softwares.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `prohibited_software_on_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-01-28-sdclt_uac_bypass.md
+3 -3
View File
@@ -1,6 +1,6 @@
---
title: "Sdclt UAC Bypass"
excerpt: "Bypass User Access Control
excerpt: "Bypass User Account Control
, Abuse Elevation Control Mechanism
"
categories:
@@ -9,7 +9,7 @@ last_modified_at: 2020-01-28
toc: true
toc_label: ""
tags:
- Bypass User Access Control
- Bypass User Account Control
- Abuse Elevation Control Mechanism
- Defense Evasion
- Privilege Escalation
@@ -42,7 +42,7 @@ This search is to detect a suspicious sdclt.exe registry modification. This tech
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Access Control | Defense Evasion, Privilege Escalation |
| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Defense Evasion, Privilege Escalation |
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
docs/_posts/2020-01-28-silentcleanup_uac_bypass.md
+3 -3
View File
@@ -1,6 +1,6 @@
---
title: "SilentCleanup UAC Bypass"
excerpt: "Bypass User Access Control
excerpt: "Bypass User Account Control
, Abuse Elevation Control Mechanism
"
categories:
@@ -9,7 +9,7 @@ last_modified_at: 2020-01-28
toc: true
toc_label: ""
tags:
- Bypass User Access Control
- Bypass User Account Control
- Abuse Elevation Control Mechanism
- Defense Evasion
- Privilege Escalation
@@ -42,7 +42,7 @@ This search is to detect a suspicious modification of registry that may related
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Access Control | Defense Evasion, Privilege Escalation |
| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Defense Evasion, Privilege Escalation |
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
docs/_posts/2020-01-28-wsreset_uac_bypass.md
+3 -3
View File
@@ -1,6 +1,6 @@
---
title: "WSReset UAC Bypass"
excerpt: "Bypass User Access Control
excerpt: "Bypass User Account Control
, Abuse Elevation Control Mechanism
"
categories:
@@ -9,7 +9,7 @@ last_modified_at: 2020-01-28
toc: true
toc_label: ""
tags:
- Bypass User Access Control
- Bypass User Account Control
- Abuse Elevation Control Mechanism
- Defense Evasion
- Privilege Escalation
@@ -42,7 +42,7 @@ This search is to detect a suspicious modification of registry related to UAC by
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Access Control | Defense Evasion, Privilege Escalation |
| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Defense Evasion, Privilege Escalation |
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md
+1 -1
View File
@@ -52,8 +52,8 @@ This search looks for EC2 instances being created with previously unseen instanc
#### Macros
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `ec2_instance_started_with_previously_unseen_instance_type_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md
+3 -3
View File
@@ -1,6 +1,6 @@
---
title: "GCP GCR container uploaded"
excerpt: "Implant Container Image
excerpt: "Implant Internal Image
"
categories:
- Deprecated
@@ -8,7 +8,7 @@ last_modified_at: 2020-02-20
toc: true
toc_label: ""
tags:
- Implant Container Image
- Implant Internal Image
- Persistence
- Splunk Enterprise
- Splunk Enterprise Security
@@ -36,7 +36,7 @@ This search show information on uploaded containers including source user, accou
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1525](https://attack.mitre.org/techniques/T1525/) | Implant Container Image | Persistence |
| [T1525](https://attack.mitre.org/techniques/T1525/) | Implant Internal Image | Persistence |
#### Search
docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md
+3 -3
View File
@@ -1,6 +1,6 @@
---
title: "New container uploaded to AWS ECR"
excerpt: "Implant Container Image
excerpt: "Implant Internal Image
"
categories:
- Cloud
@@ -8,7 +8,7 @@ last_modified_at: 2020-02-20
toc: true
toc_label: ""
tags:
- Implant Container Image
- Implant Internal Image
- Persistence
- Splunk Enterprise
- Splunk Enterprise Security
@@ -38,7 +38,7 @@ This searches show information on uploaded containers including source user, ima
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1525](https://attack.mitre.org/techniques/T1525/) | Implant Container Image | Persistence |
| [T1525](https://attack.mitre.org/techniques/T1525/) | Implant Internal Image | Persistence |
#### Search
docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md
+1 -1
View File
@@ -57,8 +57,8 @@ Detect the usage of comsvcs.dll for dumping the lsass process.
#### Macros
The SPL above uses the following Macros:
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `dump_lsass_via_comsvcs_dll_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-03-16-detect_rare_executables.md
+1 -1
View File
@@ -52,8 +52,8 @@ This search will return a table of rare processes, the names of the systems runn
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml)
Note that `detect_rare_executables_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
+1 -1
View File
@@ -56,8 +56,8 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no
#### Macros
The SPL above uses the following Macros:
* [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `first_time_seen_child_process_of_zoom_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-07-06-windows_event_log_cleared.md
+1 -1
View File
@@ -55,8 +55,8 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve
#### Macros
The SPL above uses the following Macros:
* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
Note that `windows_event_log_cleared_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-07-21-attempt_to_stop_security_service.md
+1 -1
View File
@@ -60,8 +60,8 @@ This search looks for attempts to stop security-related services on the endpoint
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
Note that `attempt_to_stop_security_service_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md
+1 -1
View File
@@ -61,8 +61,8 @@ This search looks for successful AWS CloudTrail activity by user accounts that a
#### Macros
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `detect_aws_api_activities_from_unapproved_accounts_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md
+6 -6
View File
@@ -63,14 +63,14 @@ This search looks for DNS requests for phishing domains that are leveraging Evil
#### Macros
The SPL above uses the following Macros:
* [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml)
* [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml)
* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml)
* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml)
* [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml)
* [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml)
* [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml)
* [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml)
* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml)
* [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml)
Note that `detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-07-21-detect_new_user_aws_console_login.md
+1 -1
View File
@@ -58,8 +58,8 @@ This search looks for AWS CloudTrail events wherein a console login event by a u
#### Macros
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `detect_new_user_aws_console_login_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md
+1 -1
View File
@@ -52,9 +52,9 @@ This search looks for web connections to dynamic DNS providers.
#### Macros
The SPL above uses the following Macros:
* [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml)
Note that `detect_web_traffic_to_dynamic_domain_providers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md
+1 -1
View File
@@ -64,9 +64,9 @@ This search looks for EC2 instances being modified by users who have not previou
#### Macros
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [ec2_modification_api_calls](https://github.com/splunk/security_content/blob/develop/macros/ec2_modification_api_calls.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `ec2_instance_modified_with_previously_unseen_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md
+1 -1
View File
@@ -63,8 +63,8 @@ This search looks for EC2 instances being created by users who have not created
#### Macros
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `ec2_instance_started_with_previously_unseen_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md
+1 -1
View File
@@ -57,8 +57,8 @@ This search looks for PowerShell processes started with parameters used to bypas
#### Macros
The SPL above uses the following Macros:
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `malicious_powershell_process_-_execution_policy_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md
+1 -1
View File
@@ -60,8 +60,8 @@ This search looks for emails that have attachments with suspicious file extensio
#### Macros
The SPL above uses the following Macros:
* [suspicious_email_attachments](https://github.com/splunk/security_content/blob/develop/macros/suspicious_email_attachments.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [suspicious_email_attachments](https://github.com/splunk/security_content/blob/develop/macros/suspicious_email_attachments.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `suspicious_email_attachment_extensions_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md
+1 -1
View File
@@ -53,9 +53,9 @@ This search looks for applications on the endpoint that you have marked as uncom
#### Macros
The SPL above uses the following Macros:
* [uncommon_processes](https://github.com/splunk/security_content/blob/develop/macros/uncommon_processes.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [uncommon_processes](https://github.com/splunk/security_content/blob/develop/macros/uncommon_processes.yml)
Note that `uncommon_processes_on_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
docs/_posts/2020-08-11-detect_arp_poisoning.md
+3 -3
View File
@@ -2,7 +2,7 @@
title: "Detect ARP Poisoning"
excerpt: "Hardware Additions
, Network Denial of Service
, Man-in-the-Middle
, Adversary-in-the-Middle
, ARP Cache Poisoning
"
categories:
@@ -13,7 +13,7 @@ toc_label: ""
tags:
- Hardware Additions
- Network Denial of Service
- Man-in-the-Middle
- Adversary-in-the-Middle
- ARP Cache Poisoning
- Initial Access
- Impact
@@ -53,7 +53,7 @@ By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organiza
| [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact |
| [T1557](https://attack.mitre.org/techniques/T1557/) | Man-in-the-Middle | Collection, Credential Access |
| [T1557](https://attack.mitre.org/techniques/T1557/) | Adversary-in-the-Middle | Collection, Credential Access |
| [T1557.002](https://attack.mitre.org/techniques/T1557/002/) | ARP Cache Poisoning | Collection, Credential Access |
docs/_posts/2020-08-11-detect_rogue_dhcp_server.md
+3 -3
View File
@@ -2,7 +2,7 @@
title: "Detect Rogue DHCP Server"
excerpt: "Hardware Additions
, Network Denial of Service
, Man-in-the-Middle
, Adversary-in-the-Middle
"
categories:
- Network
@@ -12,7 +12,7 @@ toc_label: ""
tags:
- Hardware Additions
- Network Denial of Service
- Man-in-the-Middle
- Adversary-in-the-Middle
- Initial Access
- Impact
- Collection
@@ -49,7 +49,7 @@ By enabling DHCP Snooping as a Layer 2 Security measure on the organization's ne
| [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact |
| [T1557](https://attack.mitre.org/techniques/T1557/) | Man-in-the-Middle | Collection, Credential Access |
| [T1557](https://attack.mitre.org/techniques/T1557/) | Adversary-in-the-Middle | Collection, Credential Access |
#### Search

Some files were not shown because too many files have changed in this diff Show More