admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
github-actions[bot]
2021-06-22 20:00:56 +00:00
committed by GitHub
parent 42611adb84 960a398f80
commit de29411e99
24 changed files with 868 additions and 2246 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/doc_gen.py
+3 -2
View File
@@ -43,7 +43,8 @@ def generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_de
manifest_files = []
for root, dirs, files in walk(REPO_PATH + '/stories'):
for file in files:
if file.endswith(".yml"):
print(root)
if file.endswith(".yml") and root == './stories':
manifest_files.append((path.join(root, file)))
stories = []
@@ -167,7 +168,7 @@ def generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_de
def generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, messages, VERBOSE):
types = ["endpoint", "application", "cloud", "network", "web", "experimental", "deprecated"]
types = ["endpoint", "application", "cloud", "network", "web", "experimental"]
manifest_files = []
for t in types:
for root, dirs, files in walk(REPO_PATH + '/detections/' + t):
bin/generate.py
+17
View File
@@ -25,11 +25,21 @@ def load_objects(file_path, VERBOSE, REPO_PATH):
files.append(load_file(file))
return files
def process_deprecated(file,file_path):
DESCRIPTION_ANNOTATION = "WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. "
if 'deprecated' in file_path:
file['deprecated'] = True
file['description'] = DESCRIPTION_ANNOTATION + file['description']
return file
def load_file(file_path):
with open(file_path, 'r', encoding="utf-8") as stream:
try:
file = list(yaml.safe_load_all(stream))[0]
# mark any files that have been deprecated
file = process_deprecated(file,file_path)
except yaml.YAMLError as exc:
print(exc)
sys.exit("ERROR: reading {0}".format(file_path))
@@ -76,6 +86,7 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen
@return: the savedsearches.conf file located in package/default/
'''
utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH),
@@ -567,10 +578,16 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
workbench_panels_objects = generate_workbench_panels(objects["response_tasks"], objects["stories"], TEMPLATE_PATH, OUTPUT_PATH)
# calculate deprecation totals
deprecated = []
for d in objects['detections']:
if 'deprecated' in d:
deprecated.append(d)
if VERBOSE:
print("{0} stories have been successfully written to {1}".format(len(objects["stories"]), story_path))
print("{0} detections have been successfully written to {1}".format(len(objects["detections"]), detection_path))
print("{0} detections have been marked deprecated on {1}".format(len(deprecated), detection_path))
print("{0} response tasks have been successfully written to {1}".format(len(objects["response_tasks"]), detection_path))
print("{0} baselines have been successfully written to {1}".format(len(objects["baselines"]), detection_path))
print("{0} macros have been successfully written to {1}".format(len(objects["macros"]), macros_path))
bin/jinja2_templates/savedsearches.j2
+4
View File
@@ -58,7 +58,11 @@ cron_schedule = {{ detection.deployment.scheduling.cron_schedule }}
dispatch.earliest_time = {{ detection.deployment.scheduling.earliest_time }}
dispatch.latest_time = {{ detection.deployment.scheduling.latest_time }}
action.correlationsearch.enabled = 1
{% if detection.deprecated is defined %}
action.correlationsearch.label = ESCU - Deprecated - {{ detection.name }} - Rule
{% else %}
action.correlationsearch.label = ESCU - {{ detection.name }} - Rule
{% endif %}
action.correlationsearch.annotations = {{ detection.savedsearch_annotations | tojson }}
{% if detection.deployment.scheduling.schedule_window is defined %}
schedule_window = {{ detection.deployment.scheduling.schedule_window }}
bin/reporting.py
+5 -2
View File
@@ -41,7 +41,10 @@ def main(args):
detections.extend(load_objects("detections/web/*.yml", REPO_PATH))
detections_all = detections.copy()
detections_all.extend(load_objects("detections/deprecated/*.yml", REPO_PATH))
#lets exclude all deprecated detections from our reporting
# detections_all.extend(load_objects("detections/deprecated/*.yml", REPO_PATH))
detections_all.extend(load_objects("detections/experimental/*/*.yml", REPO_PATH))
count_detections_all = len(detections_all)
@@ -56,7 +59,7 @@ def main(args):
for test in tests:
counter_tests=counter_tests+1
detection_coverage = "{:.0%}".format(counter_tests/counter_detection)
TEMPLATE_PATH = os.path.join(os.path.dirname(__file__), 'jinja2_templates')
contentctl.py
+2 -2
View File
@@ -73,7 +73,7 @@ def generate(args):
print("ERROR: contentctl failed to find folder for deployment {0}".format(output))
sys.exit(1)
print("contentctl is generating a new splunk_app under ".format(output))
print("contentctl is generating a new splunk_app under {}".format(output))
generator.main(security_content_path, args.output, args.product, args.verbose)
@@ -112,7 +112,7 @@ def main(args):
generate_parser.add_argument("-o", "--output", required=False, type=str, default="dist/escu",
help="Path where to store the deployment package, defaults to `dist/escu`")
generate_parser.add_argument("--product", required=False, type=str, default="ESCU",
help="Type of package to create, choose between `ESCU`, or `SAAWS`. Defaults to `ESCU`")
help="Type of package to create, choose between `ESCU`, or `SAAWS`. Defaults to `ESCU`")
generate_parser.set_defaults(func=generate)
# # parse them
dist/escu/default/analytic_stories.conf
Vendored
+58 -268
View File
@@ -26,26 +26,6 @@ Herein lies the rub. In between the time between when the temporary credentials
This Analytic Story includes searches that will help you monitor your AWS CloudTrail logs for evidence of suspicious cross-account activity. For example, while accessing multiple AWS accounts and roles may be perfectly valid behavior, it may be suspicious when an account requests privileges of an account it has not accessed in the past. After identifying suspicious activities, you can use the provided investigative searches to help you probe more deeply.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[AWS Cryptomining]
category = Cloud Security
creation_date = 2018-03-08
modification_date = 2018-03-08
id = ced74200-8465-4bc3-bd2c-9a782eec6750
version = 1
reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
detection_searches = ["ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen AMI - Rule", "ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule"]
mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP", "ID.AM"]}
investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
support_searches = ["ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 AMIs", "ESCU - Previously Seen EC2 Instance Types", "ESCU - Previously Seen EC2 Launches By User"]
data_models = []
providing_technologies = none
description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior.
narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \
Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS). It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \
When malicious miners appropriate a cloud instance, often spinning up hundreds of new instances, the costs can become astronomical for the account holder. So, it is critically important to monitor your systems for suspicious activities that could indicate that your network has been infiltrated. \
This Analytic Story is focused on detecting suspicious new instances in your EC2 environment to help prevent such a disaster. It contains detection searches that will detect when a previously unused instance type or AMI is used. It also contains support searches to build lookup files to ensure proper execution of the detection searches.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[AWS IAM Privilege Escalation]
category = Cloud Security
creation_date = 2021-03-08
@@ -71,8 +51,8 @@ modification_date = 2018-05-21
id = 2e8948a5-5239-406b-b56b-6c50ff268af4
version = 2
reference = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"]
detection_searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule"]
mappings = {"cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1562.007"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC"]}
detection_searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule"]
mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1562.007"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC"]}
investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
support_searches = ["ESCU - Baseline of Network ACL Activity by ARN", "ESCU - Baseline of blocked outbound traffic from AWS"]
data_models = []
@@ -98,24 +78,6 @@ description = This story is focused around detecting Security Hub alerts generat
narrative = AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager.
product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[AWS Suspicious Provisioning Activities]
category = Cloud Security
creation_date = 2018-03-16
modification_date = 2018-03-16
id = 3338b567-3804-4261-9889-cf0ca4753c7f
version = 1
reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
detection_searches = ["ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule"]
mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]}
investigative_searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From City - Response Task", "ESCU - Get All AWS Activity From Country - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get All AWS Activity From Region - Response Task"]
support_searches = ["ESCU - Previously Seen AWS Provisioning Activity Sources"]
data_models = []
providing_technologies = none
description = Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network.
narrative = Because most enterprise AWS activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary. \
This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[AWS User Monitoring]
category = Cloud Security
creation_date = 2018-03-12
@@ -123,8 +85,8 @@ modification_date = 2018-03-12
id = 2e8948a5-5239-406b-b56b-6c50f1269af3
version = 1
reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"]
detection_searches = ["ESCU - AWS Excessive Security Scanning - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect new API calls from user roles - Rule"]
mappings = {"cis20": ["CIS 1", "CIS 13", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1526"], "nist": ["DE.CM", "DE.DP", "ID.AM", "PR.AC", "PR.DS"]}
detection_searches = ["ESCU - AWS Excessive Security Scanning - Rule"]
mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["DE.CM", "PR.AC", "PR.DS"]}
investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"]
support_searches = ["ESCU - Baseline of API Calls per User ARN", "ESCU - Baseline of Security Group Activity by ARN", "ESCU - Create a list of approved AWS service accounts", "ESCU - Previously seen API call per user roles in CloudTrail"]
data_models = []
@@ -243,11 +205,11 @@ modification_date = 2017-12-19
id = 91c676cf-0b23-438d-abee-f6335e1fce78
version = 1
reference = ["https://www.zerofox.com/blog/what-is-digital-risk-monitoring/", "https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/", "https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/"]
detection_searches = ["ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule"]
mappings = {"cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives", "Delivery"], "nist": ["PR.IP"]}
detection_searches = ["ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule"]
mappings = {"cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["PR.IP"]}
investigative_searches = ["ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
support_searches = ["ESCU - DNSTwist Domain Names"]
data_models = ["Email", "Network_Resolution", "Web"]
data_models = ["Email", "Web"]
providing_technologies = none
description = Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name.
narrative = While you can educate your users and customers about the risks and threats posed by typosquatting, phishing, and corporate espionage, human error is a persistent fact of life. Of course, your adversaries are all too aware of this reality and will happily leverage it for nefarious purposes whenever possible3phishing with lookalike addresses, embedding faux command-and-control domains in malware, and hosting malicious content on domains that closely mimic your corporate servers. This is where brand monitoring comes in.\
@@ -299,8 +261,8 @@ modification_date = 2021-01-26
id = cecdc1e7-0af2-4a55-8967-b9ea62c0317d
version = 1
reference = ["https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps", "https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf", "https://us-cert.cisa.gov/ncas/alerts/aa21-008a"]
detection_searches = ["ESCU - AWS SAML Access by Provider User and Principal - Rule", "ESCU - AWS SAML Update identity provider - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule"]
mappings = {"cis20": ["CIS 16", "CIS 2", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1003.001", "T1078", "T1136.003", "T1546.012", "T1556"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.IP", "PR.PT"]}
detection_searches = ["ESCU - AWS SAML Access by Provider User and Principal - Rule", "ESCU - AWS SAML Update identity provider - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule"]
mappings = {"cis20": ["CIS 2", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1003.001", "T1078", "T1136.003", "T1546.012", "T1556"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.PT"]}
investigative_searches = []
support_searches = []
data_models = ["Endpoint"]
@@ -342,8 +304,8 @@ modification_date = 2019-01-09
id = bd91a2bc-d20b-4f44-a982-1bea98e86390
version = 1
reference = ["https://www.intego.com/mac-security-blog/osxcoldroot-and-the-rat-invasion/", "https://objective-see.com/blog/blog_0x2A.html", "https://www.bleepingcomputer.com/news/security/coldroot-rat-still-undetectable-despite-being-uploaded-on-github-two-years-ago/"]
detection_searches = ["ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Processes Tapping Keyboard Events - Rule"]
mappings = {"cis20": ["CIS 4", "CIS 8"], "kill_chain_phases": ["Command and Control", "Installation"], "nist": ["DE.CM", "DE.DP", "PR.PT"]}
detection_searches = ["ESCU - Processes Tapping Keyboard Events - Rule"]
mappings = {"cis20": ["CIS 4", "CIS 8"], "kill_chain_phases": ["Command and Control"], "nist": ["DE.DP"]}
investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"]
support_searches = []
data_models = []
@@ -380,8 +342,8 @@ modification_date = 2018-06-01
id = 943773c6-c4de-4f38-89a8-0b92f98804d8
version = 1
reference = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"]
detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"]
mappings = {"cis20": ["CIS 1", "CIS 11", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exfiltration", "Exploitation"], "mitre_attack": ["T1048", "T1048.003", "T1071.001", "T1071.004", "T1095", "T1189"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.IP", "PR.PT"]}
detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"]
mappings = {"cis20": ["CIS 11", "CIS 12", "CIS 13", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exfiltration", "Exploitation"], "mitre_attack": ["T1048", "T1048.003", "T1071.001", "T1071.004", "T1095", "T1189"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.DS", "PR.PT"]}
investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
support_searches = ["ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Baseline of blocked outbound traffic from AWS"]
data_models = ["Endpoint", "Network_Resolution", "Network_Traffic"]
@@ -391,24 +353,6 @@ narrative = Threat actors typically architect and implement an infrastructure to
Because this communication is so critical for an adversary, they often use techniques designed to hide the true nature of the communications. There are many different techniques used to establish and communicate over these channels. This Analytic Story provides searches that look for a variety of the techniques used for these channels, as well as indications that these channels are active, by examining logs associated with border control devices and network-access control lists.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Common Phishing Frameworks]
category = Adversary Tactics
creation_date = 2019-04-29
modification_date = 2019-04-29
id = 9a64ab44-9214-4639-8163-7eaa2621bd61
version = 1
reference = ["https://github.com/kgretzky/evilginx2", "https://attack.mitre.org/techniques/T1192/", "https://breakdev.org/evilginx-advanced-phishing-with-two-factor-authentication-bypass/"]
detection_searches = ["ESCU - Detect DNS requests to Phishing Sites leveraging EvilGinx2 - Rule"]
mappings = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Delivery"], "mitre_attack": ["T1566.003"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP"]}
investigative_searches = ["ESCU - Domain Certificate Investigation - Response Task", "ESCU - Get Certificate logs for a domain - Response Task"]
support_searches = []
data_models = ["Network_Resolution"]
providing_technologies = none
description = Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email.
narrative = As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Because phishing is a technique that relies on human psychology, you will never be able to eliminate this vulnerability 100%. But you can use automated detection to significantly reduce the risks.\
This Analytic Story focuses on detecting signs of MiTM attacks enabled by [EvilGinx2](https://github.com/kgretzky/evilginx2), a toolkit that sets up a transparent proxy between the targeted site and the user. In this way, the attacker is able to intercept credentials and two-factor identification tokens. It employs a proxy template to allow a registered domain to impersonate targeted sites, such as Linkedin, Amazon, Okta, Github, Twitter, Instagram, Reddit, Office 365, and others. It can even register SSL certificates and camouflage them via a URL shortener, making them difficult to detect. Searches in this story look for signs of MiTM attacks enabled by EvilGinx2.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Container Implantation Monitoring and Investigation]
category = Cloud Security
creation_date = 2020-02-20
@@ -416,7 +360,7 @@ modification_date = 2020-02-20
id = aa0e28b1-0521-4b6f-9d2a-7b87e34af246
version = 1
reference = ["https://github.com/splunk/cloud-datamodel-security-research"]
detection_searches = ["ESCU - GCP GCR container uploaded - Rule", "ESCU - New container uploaded to AWS ECR - Rule"]
detection_searches = ["ESCU - New container uploaded to AWS ECR - Rule"]
mappings = {"mitre_attack": ["T1525"]}
investigative_searches = []
support_searches = []
@@ -490,8 +434,8 @@ modification_date = 2020-02-04
id = 8169f17b-ef68-4b59-aa28-586907301221
version = 1
reference = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"]
detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS record changed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule"]
mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1048.003", "T1071.004", "T1189"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]}
detection_searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule"]
mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1189"], "nist": ["DE.AE", "DE.CM", "PR.DS", "PR.PT"]}
investigative_searches = ["ESCU - DNS Hijack Enrichment - Response Task", "ESCU - Get DNS Server History for a host - Response Task"]
support_searches = ["ESCU - Discover DNS records"]
data_models = ["Network_Resolution"]
@@ -549,11 +493,11 @@ modification_date = 2017-09-14
id = 91c676cf-0b23-438d-abee-f6335e1fce33
version = 1
reference = ["https://www.cisecurity.org/controls/data-protection/", "https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/"]
detection_searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule"]
mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1048.003", "T1189"], "nist": ["DE.AE", "DE.CM", "PR.DS", "PR.PT"]}
detection_searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule"]
mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1189"], "nist": ["DE.AE", "DE.CM", "PR.DS", "PR.PT"]}
investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
support_searches = []
data_models = ["Change_Analysis", "Network_Resolution"]
data_models = ["Network_Resolution"]
providing_technologies = none
description = Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration.
narrative = Attackers can leverage a variety of resources to compromise or exfiltrate enterprise data. Common exfiltration techniques include remote-access channels via low-risk, high-payoff active-collections operations and close-access operations using insiders and removable media. While this Analytic Story is not a comprehensive listing of all the methods by which attackers can exfiltrate data, it provides a useful starting point.
@@ -634,11 +578,11 @@ modification_date = 2018-09-06
id = 8169f17b-ef68-4b59-aae8-586907301221
version = 2
reference = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"]
detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule"]
mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["T1048", "T1071.001", "T1189"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.DS", "PR.IP", "PR.PT"]}
detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule"]
mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["T1048", "T1189"], "nist": ["DE.AE", "DE.CM", "PR.DS", "PR.PT"]}
investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
support_searches = []
data_models = ["Endpoint", "Network_Resolution", "Web"]
data_models = ["Endpoint", "Network_Resolution"]
providing_technologies = none
description = Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists.
narrative = Dynamic DNS services (DDNS) are legitimate low-cost or free services that allow users to rapidly update domain resolutions to IP infrastructure. While their usage can be benign, malicious actors can abuse DDNS to host harmful payloads or interactive-command-and-control infrastructure. These attackers will manually update or automate domain resolution changes by routing dynamic domains to IP addresses that circumvent firewall blocks and deny lists and frustrate a network defender's analytic and investigative processes. These searches will look for DNS queries made from within your infrastructure to suspicious dynamic domains and then investigate more deeply, when appropriate. While this list of top-level dynamic domains is not exhaustive, it can be dynamically updated as new suspicious dynamic domains are identified.
@@ -651,7 +595,7 @@ modification_date = 2020-01-27
id = bb9f5ed2-916e-4364-bb6d-91c310efcf52
version = 1
reference = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"]
detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"]
detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"]
mappings = {"cis20": ["CIS 12", "CIS 2", "CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exploitation", "Installation"], "mitre_attack": ["T1021.002", "T1059.003", "T1072", "T1547.001", "T1566.001"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"]
support_searches = ["ESCU - Baseline of SMB Traffic - MLTK"]
@@ -687,7 +631,7 @@ modification_date = 2020-09-01
id = 0432039c-ef41-4b03-b157-450c25dad1e6
version = 1
reference = ["https://cloud.google.com/iam/docs/understanding-service-accounts"]
detection_searches = ["ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - GCP Detect gcploit framework - Rule", "ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - gcp detect oauth token abuse - Rule"]
detection_searches = ["ESCU - GCP Detect gcploit framework - Rule"]
mappings = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]}
investigative_searches = ["ESCU - Get Notable History - Response Task"]
support_searches = []
@@ -725,8 +669,8 @@ modification_date = 2020-01-22
id = baf7580b-d4b4-4774-8173-7d198e9da335
version = 2
reference = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"]
detection_searches = ["ESCU - Create or delete windows shares using net exe - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious File Write - Rule"]
mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1021.001", "T1021.002", "T1048.003", "T1059.001", "T1059.003", "T1070.005", "T1071.002", "T1071.004"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]}
detection_searches = ["ESCU - Create or delete windows shares using net exe - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule"]
mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1021.001", "T1021.002", "T1048.003", "T1070.005", "T1071.002", "T1071.004"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"]
support_searches = ["ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"]
data_models = ["Endpoint", "Network_Resolution", "Network_Traffic"]
@@ -738,23 +682,6 @@ In June of 2018, The Department of Homeland Security, together with the FBI and
Among other searches in this Analytic Story is a detection search that looks for the creation or deletion of hidden shares, such as, "adnim$," which the Hidden Cobra malware creates on the target system. Another looks for the creation of three malicious files associated with the malware. You can also use a search in this story to investigate activity that indicates that malware is sending email back to the attackers.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Host Redirection]
category = Abuse
creation_date = 2017-09-14
modification_date = 2017-09-14
id = 2e8948a5-5239-406b-b56b-6c50fe268af4
version = 1
reference = ["https://blog.malwarebytes.com/cybercrime/2016/09/hosts-file-hijacks/"]
detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Windows hosts file modification - Rule"]
mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003", "T1071.004"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task"]
support_searches = []
data_models = ["Network_Resolution"]
providing_technologies = none
description = Detect evidence of tactics used to redirect traffic from a host to a destination other than the one intended--potentially one that is part of an adversary's attack infrastructure. An example is redirecting communications regarding patches and updates or misleading users into visiting a malicious website.
narrative = Attackers will often attempt to manipulate client communications for nefarious purposes. In some cases, an attacker may endeavor to modify a local host file to redirect communications with resources (such as antivirus or system-update services) to prevent clients from receiving patches or updates. In other cases, an attacker might use this tactic to have the client connect to a site that looks like the intended site, but instead installs malware or collects information from the victim. Additionally, an attacker may redirect a victim in order to execute a MITM attack and observe communications.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Ingress Tool Transfer]
category = Adversary Tactics
creation_date = 2021-03-24
@@ -810,7 +737,7 @@ modification_date = 2020-04-15
id = a9ef59cf-e981-4e66-9eef-bb049f695c09
version = 1
reference = ["https://github.com/splunk/cloud-datamodel-security-research"]
detection_searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule"]
detection_searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule"]
mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]}
investigative_searches = ["ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - GCP Kubernetes activity by src ip - Response Task", "ESCU - Get Notable History - Response Task"]
support_searches = []
@@ -827,7 +754,7 @@ modification_date = 2020-05-20
id = 2574e6d9-7254-4751-8925-0447deeec8ea
version = 1
reference = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"]
detection_searches = ["ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule", "ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule"]
detection_searches = ["ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule"]
mappings = {"kill_chain_phases": ["Lateral Movement"]}
investigative_searches = ["ESCU - Get Notable History - Response Task"]
support_searches = []
@@ -837,23 +764,6 @@ description = This story addresses detection and response of accounts acccesing
narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive objects within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes sensitive objects.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Kubernetes Sensitive Role Activity]
category = Cloud Security
creation_date = 2020-05-20
modification_date = 2020-05-20
id = 2574e6d9-7254-4751-8925-0447deeec8ew
version = 1
reference = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"]
detection_searches = ["ESCU - Kubernetes AWS detect RBAC authorization by account - Rule", "ESCU - Kubernetes AWS detect most active service accounts by pod - Rule", "ESCU - Kubernetes AWS detect sensitive role access - Rule", "ESCU - Kubernetes Azure detect RBAC authorization by account - Rule", "ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule", "ESCU - Kubernetes Azure detect sensitive role access - Rule", "ESCU - Kubernetes GCP detect RBAC authorizations by account - Rule", "ESCU - Kubernetes GCP detect most active service accounts by pod - Rule", "ESCU - Kubernetes GCP detect sensitive role access - Rule"]
mappings = {"kill_chain_phases": ["Lateral Movement"]}
investigative_searches = ["ESCU - Get Notable History - Response Task"]
support_searches = []
data_models = []
providing_technologies = none
description = This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces.
narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive roles within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes role activities
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Lateral Movement]
category = Adversary Tactics
creation_date = 2020-02-04
@@ -882,7 +792,7 @@ modification_date = 2017-08-23
id = 2c8ff66e-0b57-42af-8ad7-912438a403fc
version = 4
reference = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"]
detection_searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule"]
detection_searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation", "Installation"], "mitre_attack": ["T1027", "T1059.001"], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
support_searches = []
@@ -908,7 +818,7 @@ modification_date = 2021-04-26
id = f0258af4-a6ae-11eb-b3c2-acde48001122
version = 1
reference = ["https://attack.mitre.org/techniques/T1036/003/"]
detection_searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious Rundll32 Rename - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule"]
detection_searches = ["ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious Rundll32 Rename - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1036.003", "T1127", "T1127.001", "T1218.011"], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
investigative_searches = []
support_searches = []
@@ -1017,7 +927,7 @@ modification_date = 2017-01-05
id = 2b1800dd-92f9-47ec-a981-fdf1351e5f65
version = 1
reference = ["https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb490939(v=technet.10)", "https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html"]
detection_searches = ["ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule"]
detection_searches = ["ESCU - Processes launching netsh - Rule"]
mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004"], "nist": ["DE.CM", "PR.PT"]}
investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"]
@@ -1052,8 +962,8 @@ modification_date = 2020-01-22
id = bb9f5ed2-916e-4364-bb6d-97c370efcf52
version = 2
reference = ["https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia", "https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/"]
detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"]
mappings = {"cis20": ["CIS 2", "CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1059.001", "T1059.003", "T1543.003", "T1569.002"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]}
detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"]
mappings = {"cis20": ["CIS 2", "CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1543.003", "T1569.002"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
support_searches = ["ESCU - Previously Seen Running Windows Services - Initial", "ESCU - Previously Seen Running Windows Services - Update", "ESCU - Previously seen command line arguments"]
data_models = ["Endpoint"]
@@ -1072,8 +982,8 @@ modification_date = 2020-01-22
id = 988C59C5-0A1C-45B6-A555-0C62276E327E
version = 1
reference = ["https://www.infosecurity-magazine.com/news/scope-of-mudcarp-attacks-highlight-1/", "http://blog.amossys.fr/badflick-is-not-so-bad.html"]
detection_searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1059.001", "T1059.003", "T1547.001"], "nist": ["DE.AE", "DE.CM", "PR.IP", "PR.PT"]}
detection_searches = ["ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1059.001", "T1547.001"], "nist": ["DE.AE", "DE.CM", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"]
data_models = ["Endpoint"]
@@ -1202,7 +1112,7 @@ modification_date = 2020-11-06
id = 507edc74-13d5-4339-878e-b9744ded1f35
version = 1
reference = ["https://www.splunk.com/en_us/blog/security/detecting-ryuk-using-splunk-attack-range.html", "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://us-cert.cisa.gov/ncas/alerts/aa20-302a"]
detection_searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Ryuk Test Files Detected - Rule", "ESCU - Ryuk Wake on LAN Command - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - Windows connhost exe started forcefully - Rule"]
detection_searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Ryuk Test Files Detected - Rule", "ESCU - Ryuk Wake on LAN Command - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Security Account Manager Stopped - Rule"]
mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Lateral Movement", "Privilege Escalation", "Reconnaissance"], "mitre_attack": ["T1021.001", "T1053.005", "T1059.003", "T1482", "T1485", "T1486", "T1489", "T1490", "T1562.001"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get Notable History - Response Task"]
support_searches = []
@@ -1293,86 +1203,6 @@ Following is a typical series of events, according to an [article by Trend Micro
This Analytic Story focuses on detecting signs that a malicious payload has been injected into your environment. For example, one search detects outlook.exe writing a .zip file. Another looks for suspicious .lnk files launching processes.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Spectre And Meltdown Vulnerabilities]
category = Vulnerability
creation_date = 2018-01-08
modification_date = 2018-01-08
id = 6d3306f6-bb2b-4219-8609-8efad64032f2
version = 1
reference = ["https://meltdownattack.com/"]
detection_searches = ["ESCU - Spectre and Meltdown Vulnerable Systems - Rule"]
mappings = {"cis20": ["CIS 4"], "nist": ["DE.CM", "ID.RA", "PR.IP", "RS.MI"]}
investigative_searches = ["ESCU - Get Notable History - Response Task"]
support_searches = ["ESCU - Systems Ready for Spectre-Meltdown Windows Patch"]
data_models = ["Vulnerabilities"]
providing_technologies = none
description = Assess and mitigate your systems' vulnerability to Spectre and Meltdown exploitation with the searches in this Analytic Story.
narrative = Meltdown and Spectre exploit critical vulnerabilities in modern CPUs that allow unintended access to data in memory. This Analytic Story will help you identify the systems can be patched for these vulnerabilities, as well as those that still need to be patched.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Splunk Enterprise Vulnerability]
category = Vulnerability
creation_date = 2017-09-19
modification_date = 2017-09-19
id = 4e692b96-de2d-4bd1-9105-37e2368a8db1
version = 1
reference = ["http://www.splunk.com/view/SP-CAAAPQ6#announce", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4859"]
detection_searches = ["ESCU - Open Redirect in Splunk Web - Rule"]
mappings = {"cis20": ["CIS 18", "CIS 3", "CIS 4"], "kill_chain_phases": ["Delivery"], "nist": ["DE.CM", "ID.RA", "PR.AC", "PR.IP", "PR.PT", "RS.MI"]}
investigative_searches = ["ESCU - Get Notable History - Response Task"]
support_searches = []
data_models = []
providing_technologies = none
description = Keeping your Splunk deployment up to date is critical and may help you reduce the risk of CVE-2016-4859, an open-redirection vulnerability within some older versions of Splunk Enterprise. The detection search will help ensure that users are being properly authenticated and not being redirected to malicious domains.
narrative = This Analytic Story is associated with CVE-2016-4859, an open-redirect vulnerability in the following versions of Splunk Enterprise:\
\
1. Splunk Enterprise 6.4.x, prior to 6.4.3\
1. Splunk Enterprise 6.3.x, prior to 6.3.6\
1. Splunk Enterprise 6.2.x, prior to 6.2.10\
1. Splunk Enterprise 6.1.x, prior to 6.1.11\
1. Splunk Enterprise 6.0.x, prior to 6.0.12\
1. Splunk Enterprise 5.0.x, prior to 5.0.16\
1. Splunk Light, prior to 6.4.3CVE-2016-4859 allows attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. (Credit: Noriaki Iwasaki, Cyber Defense Institute, Inc.).\
It is important to ensure that your Splunk deployment is being kept up to date and is properly configured. This detection search allows analysts to monitor internal logs to ensure users are properly authenticated and cannot be redirected to any malicious third-party websites.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Splunk Enterprise Vulnerability CVE-2018-11409]
category = Vulnerability
creation_date = 2018-06-14
modification_date = 2018-06-14
id = 1fc34cbc-34e9-43ba-87ab-6811c9e95400
version = 1
reference = ["https://nvd.nist.gov/vuln/detail/CVE-2018-11409", "https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings", "https://www.exploit-db.com/exploits/44865/"]
detection_searches = ["ESCU - Splunk Enterprise Information Disclosure - Rule"]
mappings = {"cis20": ["CIS 18", "CIS 3", "CIS 4"], "kill_chain_phases": ["Delivery"], "nist": ["DE.CM", "ID.RA", "PR.AC", "PR.IP", "PR.PT", "RS.MI"]}
investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"]
support_searches = []
data_models = []
providing_technologies = none
description = Reduce the risk of CVE-2018-11409, an information disclosure vulnerability within some older versions of Splunk Enterprise, with searches designed to help ensure that your Splunk system does not leak information to authenticated users.
narrative = Although there have been no reports of it being exploited, Splunk Enterprise versions through 7.0.1 reportedly have a vulnerability that may expose information through a REST endpoint (read more here: https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings). NIST has included it in its vulnerability database (read more here: https://nvd.nist.gov/vuln/detail/CVE-2018-11409). The REST endpoint that exposes system information is also necessary for the proper operation of Splunk clustering and instrumentation. Customers should upgrade to the latest version to reduce the risk of this vulnerability.\
Splunk Enterprise exposes partial information about the host operating system, hardware, and Splunk license. Splunk Enterprise before 6.6.0 exposes this information without authentication. Splunk Enterprise 6.6.0 and later exposes this information only to authenticated Splunk users. Based on the information exposure, Splunk characterizes this issue as a low severity impact.\
Read more in Splunk's official response: https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings.\
A detection search within this Analytic Story looks for vulnerabilities described in CVE-2018-11409: Information Exposure (https://nvd.nist.gov/vuln/detail/CVE-2018-11409). If it turns up activities that may be specific, you can use the included investigative searches to return information regarding web activity and network traffic by src_ip.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Suspicious AWS EC2 Activities]
category = Cloud Security
creation_date = 2018-02-09
modification_date = 2018-02-09
id = 2e8948a5-5239-406b-b56b-6c50f1268af3
version = 1
reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
detection_searches = ["ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule"]
mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP", "ID.AM"]}
investigative_searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
support_searches = ["ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK", "ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User"]
data_models = []
providing_technologies = none
description = Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it.
narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and risk auditing within your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Console, AWS command-line interface, and AWS SDKs and APIs to ensure that your EC2 instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your AWS EC2 instances and helps you respond and investigate those activities.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Suspicious AWS Login Activities]
category = Cloud Security
creation_date = 2019-05-01
@@ -1380,8 +1210,8 @@ modification_date = 2019-05-01
id = 2e8948a5-5239-406b-b56b-6c59f1268af3
version = 1
reference = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"]
detection_searches = ["ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect new user AWS Console Login - Rule"]
mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP"]}
detection_searches = ["ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule"]
mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.AE", "DE.DP"]}
investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task"]
support_searches = ["ESCU - Previously seen users in CloudTrail", "ESCU - Update previously seen users in CloudTrail"]
data_models = ["Authentication"]
@@ -1507,8 +1337,8 @@ modification_date = 2020-02-03
id = f4368ddf-d59f-4192-84f6-778ac5a3ffc7
version = 2
reference = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"]
detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["T1036.003", "T1059.001", "T1059.003"], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1036.003", "T1059.003"], "nist": ["DE.CM", "PR.PT"]}
investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"]
data_models = ["Endpoint"]
@@ -1524,8 +1354,8 @@ modification_date = 2017-09-18
id = 3c3835c0-255d-4f9e-ab84-e29ec9ec9b56
version = 1
reference = ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/", "http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680", "https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454"]
detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule"]
mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["T1048", "T1048.003", "T1071.004", "T1189"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]}
detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule"]
mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["T1048", "T1048.003", "T1071.004", "T1189"], "nist": ["DE.AE", "DE.CM", "PR.DS", "PR.PT"]}
investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
support_searches = ["ESCU - Baseline of DNS Query Length - MLTK"]
data_models = ["Endpoint", "Network_Resolution"]
@@ -1541,11 +1371,11 @@ modification_date = 2020-01-27
id = 2b1800dd-92f9-47ec-a981-fdf1351e5d55
version = 1
reference = ["https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/"]
detection_searches = ["ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"]
mappings = {"cis20": ["CIS 12", "CIS 3", "CIS 7"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.AE", "PR.IP"]}
detection_searches = ["ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"]
mappings = {"cis20": ["CIS 12", "CIS 3", "CIS 7"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566.001"], "nist": ["DE.AE", "PR.IP"]}
investigative_searches = ["ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task"]
support_searches = ["ESCU - DNSTwist Domain Names"]
data_models = ["Email", "UEBA"]
data_models = ["Email"]
providing_technologies = none
description = Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story.
narrative = It is a common practice for attackers of all types to leverage targeted spearphishing campaigns and mass mailers to deliver weaponized email messages and attachments. Fortunately, there are a number of ways to monitor email data in Splunk to detect suspicious content.\
@@ -1661,7 +1491,7 @@ modification_date = 2018-10-23
id = c8ddc5be-69bc-4202-b3ab-4010b27d7ad5
version = 2
reference = ["https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"]
detection_searches = ["ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule"]
detection_searches = ["ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047", "T1546.003"], "nist": ["PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"]
support_searches = []
@@ -1680,11 +1510,11 @@ modification_date = 2018-05-31
id = 2b1800dd-92f9-47dd-a981-fdf1351e5d55
version = 1
reference = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/wiki/Technique/T1112"]
detection_searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.001", "T1546.011", "T1546.012", "T1547.001", "T1547.010", "T1548.002", "T1564.001"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]}
detection_searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule"]
mappings = {"cis20": ["CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011", "T1546.012", "T1547.001", "T1547.010", "T1548.002"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.PT"]}
investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
support_searches = []
data_models = ["Endpoint"]
data_models = []
providing_technologies = none
description = Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system.
narrative = Attackers are developing increasingly sophisticated techniques for hijacking target servers, while evading detection. One such technique that has become progressively more common is registry modification.\
@@ -1775,24 +1605,6 @@ Retrieval of script code\
The objective of this step is to confirm the executed script code is benign or malicious.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Unusual AWS EC2 Modifications]
category = Cloud Security
creation_date = 2018-04-09
modification_date = 2018-04-09
id = 73de57ef-0dfc-411f-b1e7-fa24428aeae0
version = 1
reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
detection_searches = ["ESCU - EC2 Instance Modified With Previously Unseen User - Rule"]
mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]}
investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task"]
support_searches = ["ESCU - Previously Seen EC2 Modifications By User"]
data_models = []
providing_technologies = none
description = Identify unusual changes to your AWS EC2 instances that may indicate malicious activity. Modifications to your EC2 instances by previously unseen users is an example of an activity that may warrant further investigation.
narrative = A common attack technique is to infiltrate a cloud instance and make modifications. The adversary can then secure access to your infrastructure or hide their activities. So it's important to stay alert to changes that may indicate that your environment has been compromised. \
Searches within this Analytic Story can help you detect the presence of a threat by monitoring for EC2 instances that have been created or changed--either by users that have never previously performed these activities or by known users who modify or create instances in a way that have not been done before. This story also provides investigative searches that help you go deeper once you detect suspicious behavior.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Unusual Processes]
category = Malware
creation_date = 2020-02-04
@@ -1800,8 +1612,8 @@ modification_date = 2020-02-04
id = f4368e3f-d59f-4192-84f6-748ac5a3ddb6
version = 2
reference = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"]
detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WinRM Spawning a Process - Rule"]
mappings = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Denial of Service", "Exploitation", "Installation", "Privilege Escalation"], "mitre_attack": ["T1016", "T1036.003", "T1190", "T1204.002", "T1218.011"], "nist": ["DE.CM", "ID.AM", "PR.DS", "PR.PT"]}
detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WinRM Spawning a Process - Rule"]
mappings = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Denial of Service", "Exploitation", "Installation", "Privilege Escalation"], "mitre_attack": ["T1016", "T1036.003", "T1190", "T1218.011"], "nist": ["DE.CM", "ID.AM", "PR.DS", "PR.PT"]}
investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
support_searches = ["ESCU - Baseline of Command Line Length - MLTK"]
data_models = ["Endpoint"]
@@ -1829,28 +1641,6 @@ description = Leverage searches that detect cleartext network protocols that may
narrative = Various legacy protocols operate by default in the clear, without the protections of encryption. This potentially leaks sensitive information that can be exploited by passively sniffing network traffic. Depending on the protocol, this information could be highly sensitive, or could allow for session hijacking. In addition, these protocols send authentication information, which would allow for the harvesting of usernames and passwords that could potentially be used to authenticate and compromise secondary systems.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Web Fraud Detection]
category = Abuse
creation_date = 2018-10-08
modification_date = 2018-10-08
id = 31337aaa-bc22-4752-b599-ef112dq1dq7a
version = 1
reference = ["https://www.fbi.gov/scams-and-safety/common-fraud-schemes/internet-fraud", "https://www.fbi.gov/news/stories/2017-internet-crime-report-released-050718"]
detection_searches = ["ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Web Fraud - Password Sharing Across Accounts - Rule"]
mappings = {"cis20": ["CIS 16", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078", "T1136"], "nist": ["DE.AE", "DE.CM", "DE.DP"]}
investigative_searches = ["ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Web Session Information via session id - Response Task"]
support_searches = []
data_models = []
providing_technologies = none
description = Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets.
narrative = The Federal Bureau of Investigations (FBI) defines Internet fraud as the use of Internet services or software with Internet access to defraud victims or to otherwise take advantage of them. According to the Bureau, Internet crime schemes are used to steal millions of dollars each year from victims and continue to plague the Internet through various methods. The agency includes phishing scams, data breaches, Denial of Service (DOS) attacks, email account compromise, malware, spoofing, and ransomware in this category.\
These crimes are not the fraud itself, but rather the attack techniques commonly employed by fraudsters in their pursuit of data that enables them to commit malicious actssuch as obtaining and using stolen credit cards. They represent a serious problem that is steadily increasing and not likely to go away anytime soon.\
When developing a strategy for preventing fraud in your environment, its important to look across all of your web services for evidence that attackers are abusing enterprise resources to enumerate systems, harvest data for secondary fraudulent activity, or abuse terms of service.This Analytic Story looks for evidence of common Internet attack techniques that could be indicative of web fraud in your environmentincluding account harvesting, anomalous user clickspeed, and password sharing across accounts, to name just a few.\
The account-harvesting search focuses on web pages used for user-account registration. It detects the creation of a large number of user accounts using the same email domain name, a type of activity frequently seen in advance of a fraud campaign.\
The anomalous clickspeed search looks for users who are moving through your website at a faster-than-normal speed or with a perfect click cadence (high periodicity or low standard deviation), which could indicate that the user is a script, not an actual human.\
Another search detects incidents wherein a single password is used across multiple accounts, which may indicate that a fraudster has infiltrated your environment and embedded a common password within a script.
product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
[Windows DNS SIGRed CVE-2020-1350]
category = Adversary Tactics
creation_date = 2020-07-28
@@ -1875,7 +1665,7 @@ modification_date = 2018-05-31
id = 56e24a28-5003-4047-b2db-e8f3c4618064
version = 1
reference = ["https://attack.mitre.org/wiki/Defense_Evasion"]
detection_searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule"]
detection_searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule"]
mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Privilege Escalation"], "mitre_attack": ["T1112", "T1222.001", "T1548.002", "T1562.001", "T1564.001"], "nist": ["DE.CM", "PR.PT"]}
investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
support_searches = []
@@ -1892,8 +1682,8 @@ modification_date = 2018-01-26
id = 30552a76-ac78-48e4-b3c0-de4e34e9563d
version = 1
reference = ["https://blog.malwarebytes.com/cybercrime/2013/12/file-extensions-2/", "https://attack.mitre.org/wiki/Technique/T1042"]
detection_searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Suspicious Changes to File Associations - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003", "T1546.001"], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
detection_searches = ["ESCU - Execution of File with Multiple Extensions - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003"], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
support_searches = []
data_models = ["Endpoint"]
@@ -1931,8 +1721,8 @@ modification_date = 2018-05-31
id = 30874d4f-20a1-488f-85ec-5d52ef74e3f9
version = 2
reference = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"]
detection_searches = ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation", "Privilege Escalation"], "mitre_attack": ["T1053", "T1053.005", "T1222.001", "T1543.003", "T1546.011", "T1547.001", "T1547.010", "T1564.001", "T1574.009", "T1574.011"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
detection_searches = ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation", "Privilege Escalation"], "mitre_attack": ["T1053", "T1053.005", "T1222.001", "T1543.003", "T1546.011", "T1547.001", "T1547.010", "T1574.009", "T1574.011"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
support_searches = []
data_models = ["Endpoint"]
@@ -1948,8 +1738,8 @@ modification_date = 2020-02-04
id = 644e22d3-598a-429c-a007-16fdb802cae5
version = 2
reference = ["https://attack.mitre.org/tactics/TA0004/"]
detection_searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule"]
mappings = {"cis20": ["CIS 2", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1068", "T1204.002", "T1546.008", "T1546.012"], "nist": ["DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.PT"]}
detection_searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule"]
mappings = {"cis20": ["CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1068", "T1546.008", "T1546.012"], "nist": ["DE.CM", "PR.AC", "PR.PT"]}
investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
support_searches = []
data_models = ["Endpoint"]
dist/escu/default/es_investigations.conf
Vendored
-77
View File
@@ -6,13 +6,6 @@ disabled = 0
panels = ["panel://workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task", "panel://workbench_panel_get_notable_history___response_task"]
[panel_group://workbench_panel_group_aws_cryptomining]
label = AWS Cryptomining
description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior.
disabled = 0
panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"]
[panel_group://workbench_panel_group_aws_iam_privilege_escalation]
label = AWS IAM Privilege Escalation
description = This analytic story contains detections that query your AWS Cloudtrail for activities related to privilege escalation.
@@ -34,13 +27,6 @@ disabled = 0
panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task"]
[panel_group://workbench_panel_group_aws_suspicious_provisioning_activities]
label = AWS Suspicious Provisioning Activities
description = Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network.
disabled = 0
panels = ["panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_all_aws_activity_from_city___response_task", "panel://workbench_panel_get_all_aws_activity_from_country___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_all_aws_activity_from_region___response_task"]
[panel_group://workbench_panel_group_aws_user_monitoring]
label = AWS User Monitoring
description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment.
@@ -139,13 +125,6 @@ disabled = 0
panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task"]
[panel_group://workbench_panel_group_common_phishing_frameworks]
label = Common Phishing Frameworks
description = Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email.
disabled = 0
panels = ["panel://workbench_panel_domain_certificate_investigation___response_task", "panel://workbench_panel_get_certificate_logs_for_a_domain___response_task"]
[panel_group://workbench_panel_group_container_implantation_monitoring_and_investigation]
label = Container Implantation Monitoring and Investigation
description = Use the searches in this story to monitor your Kubernetes registry repositories for upload, and deployment of potentially vulnerable, backdoor, or implanted containers. These searches provide information on source users, destination path, container names and repository names. The searches provide context to address Mitre T1525 which refers to container implantation upload to a company's repository either in Amazon Elastic Container Registry, Google Container Registry and Azure Container Registry.
@@ -272,13 +251,6 @@ disabled = 0
panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_outbound_emails_to_hidden_cobra_threat_actors___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task"]
[panel_group://workbench_panel_group_host_redirection]
label = Host Redirection
description = Detect evidence of tactics used to redirect traffic from a host to a destination other than the one intended--potentially one that is part of an adversary's attack infrastructure. An example is redirecting communications regarding patches and updates or misleading users into visiting a malicious website.
disabled = 0
panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_notable_history___response_task"]
[panel_group://workbench_panel_group_ingress_tool_transfer]
label = Ingress Tool Transfer
description = Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP.
@@ -307,13 +279,6 @@ disabled = 0
panels = ["panel://workbench_panel_get_notable_history___response_task"]
[panel_group://workbench_panel_group_kubernetes_sensitive_role_activity]
label = Kubernetes Sensitive Role Activity
description = This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces.
disabled = 0
panels = ["panel://workbench_panel_get_notable_history___response_task"]
[panel_group://workbench_panel_group_lateral_movement]
label = Lateral Movement
description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts.
@@ -468,34 +433,6 @@ disabled = 0
panels = ["panel://workbench_panel_get_notable_history___response_task"]
[panel_group://workbench_panel_group_spectre_and_meltdown_vulnerabilities]
label = Spectre And Meltdown Vulnerabilities
description = Assess and mitigate your systems' vulnerability to Spectre and Meltdown exploitation with the searches in this Analytic Story.
disabled = 0
panels = ["panel://workbench_panel_get_notable_history___response_task"]
[panel_group://workbench_panel_group_splunk_enterprise_vulnerability]
label = Splunk Enterprise Vulnerability
description = Keeping your Splunk deployment up to date is critical and may help you reduce the risk of CVE-2016-4859, an open-redirection vulnerability within some older versions of Splunk Enterprise. The detection search will help ensure that users are being properly authenticated and not being redirected to malicious domains.
disabled = 0
panels = ["panel://workbench_panel_get_notable_history___response_task"]
[panel_group://workbench_panel_group_splunk_enterprise_vulnerability_cve_2018_11409]
label = Splunk Enterprise Vulnerability CVE-2018-11409
description = Reduce the risk of CVE-2018-11409, an information disclosure vulnerability within some older versions of Splunk Enterprise, with searches designed to help ensure that your Splunk system does not leak information to authenticated users.
disabled = 0
panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_network_traffic_from_src_ip___response_task"]
[panel_group://workbench_panel_group_suspicious_aws_ec2_activities]
label = Suspicious AWS EC2 Activities
description = Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it.
disabled = 0
panels = ["panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"]
[panel_group://workbench_panel_group_suspicious_aws_login_activities]
label = Suspicious AWS Login Activities
description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins.
@@ -643,13 +580,6 @@ disabled = 0
panels = ["panel://workbench_panel_get_notable_history___response_task"]
[panel_group://workbench_panel_group_unusual_aws_ec2_modifications]
label = Unusual AWS EC2 Modifications
description = Identify unusual changes to your AWS EC2 instances that may indicate malicious activity. Modifications to your EC2 instances by previously unseen users is an example of an activity that may warrant further investigation.
disabled = 0
panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_notable_history___response_task"]
[panel_group://workbench_panel_group_unusual_processes]
label = Unusual Processes
description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation.
@@ -664,13 +594,6 @@ disabled = 0
panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"]
[panel_group://workbench_panel_group_web_fraud_detection]
label = Web Fraud Detection
description = Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets.
disabled = 0
panels = ["panel://workbench_panel_get_emails_from_specific_sender___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_web_session_information_via_session_id___response_task"]
[panel_group://workbench_panel_group_windows_dns_sigred_cve_2020_1350]
label = Windows DNS SIGRed CVE-2020-1350
description = Uncover activity consistent with CVE-2020-1350, or SIGRed. Discovered by Checkpoint researchers, this vulnerability affects Windows 2003 to 2019, and is triggered by a malicious DNS response (only affects DNS over TCP). An attacker can use the malicious payload to cause a buffer overflow on the vulnerable system, leading to compromise. The included searches in this Analytic Story are designed to identify the large response payload for SIG and KEY DNS records which can be used for the exploit.
dist/escu/default/macros.conf
Vendored
+4 -300
View File
@@ -295,22 +295,6 @@ description = customer specific splunk configurations(eg- index, source, sourcet
definition = index=zeek sourcetype="zeek:ssl:json"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[aws_cloud_provisioning_from_previously_unseen_city_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_cloud_provisioning_from_previously_unseen_country_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_cloud_provisioning_from_previously_unseen_ip_address_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_cloud_provisioning_from_previously_unseen_region_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_create_policy_version_to_allow_all_resources_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -335,10 +319,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_eks_kubernetes_cluster_sensitive_object_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_excessive_security_scanning_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -387,22 +367,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[abnormally_high_aws_instances_launched_by_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[abnormally_high_aws_instances_launched_by_user___mltk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[abnormally_high_aws_instances_terminated_by_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[abnormally_high_aws_instances_terminated_by_user___mltk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[abnormally_high_number_of_cloud_infrastructure_api_calls_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -511,10 +475,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[clients_connecting_to_multiple_dns_servers_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[clop_common_exec_parameter_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -547,10 +507,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[cloud_network_access_control_list_deleted_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[cloud_provisioning_activity_from_previously_unseen_city_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -635,14 +591,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[dns_query_requests_resolved_by_unauthorized_dns_servers_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[dns_record_changed_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[dsquery_domain_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -659,18 +607,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_api_activity_from_users_without_mfa_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_arp_poisoning_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_aws_api_activities_from_unapproved_accounts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_aws_console_login_by_new_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -719,10 +659,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_excessive_account_lockouts_from_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -767,10 +703,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_long_dns_txt_record_response_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_mshta_url_in_command_line_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -779,10 +711,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_mimikatz_via_powershell_and_eventcode_4703_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_new_local_admin_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -923,10 +851,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_spike_in_aws_api_activity_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -935,18 +859,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_spike_in_network_acl_activity_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_spike_in_s3_bucket_deletion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_spike_in_security_group_activity_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_spike_in_blocked_outbound_traffic_from_your_aws_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -955,10 +871,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_usb_device_insertion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_unauthorized_assets_by_mac_address_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -999,26 +911,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_new_api_calls_from_user_roles_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_new_user_aws_console_login_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_processes_used_for_system_network_configuration_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_web_traffic_to_dynamic_domain_providers_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detection_of_dns_tunnels_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detection_of_tools_built_by_nirsoft_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1095,26 +991,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ec2_instance_modified_with_previously_unseen_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ec2_instance_started_in_previously_unseen_region_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ec2_instance_started_with_previously_unseen_ami_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ec2_instance_started_with_previously_unseen_instance_type_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ec2_instance_started_with_previously_unseen_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[email_attachments_with_lots_of_spaces_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1183,18 +1059,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[execution_of_file_with_spaces_before_extension_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[execution_of_file_with_multiple_extensions_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[extended_period_without_successful_netbackup_backups_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[extract_sam_from_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1211,38 +1079,18 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[first_time_seen_command_line_argument_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[fodhelper_uac_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gcp_detect_accounts_with_high_risk_roles_by_project_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gcp_detect_gcploit_framework_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gcp_detect_high_risk_permissions_by_resource_and_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gcp_gcr_container_uploaded_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gcp_kubernetes_cluster_pod_scan_detection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gcp_kubernetes_cluster_scan_detection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gpupdate_with_no_command_line_arguments_with_network_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1279,10 +1127,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[identify_new_user_accounts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kerberoasting_spn_request_with_rc4_encryption_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1311,62 +1155,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_azure_detect_rbac_authorization_by_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_azure_detect_sensitive_object_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_azure_detect_sensitive_role_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_azure_detect_suspicious_kubectl_calls_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_azure_pod_scan_fingerprint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_azure_scan_fingerprint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_gcp_detect_rbac_authorizations_by_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_gcp_detect_sensitive_object_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_gcp_detect_sensitive_role_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_gcp_detect_service_accounts_forbidden_failure_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_gcp_detect_suspicious_kubectl_calls_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[large_volume_of_dns_any_queries_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1379,6 +1167,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[mailsniper_invoke_functions_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[malicious_powershell_process___connect_to_internet_with_hidden_window_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1391,10 +1183,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[malicious_powershell_process___multiple_suspicious_command_line_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[malicious_powershell_process_with_obfuscation_techniques_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1411,10 +1199,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[monitor_dns_for_brand_abuse_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[monitor_email_for_brand_abuse_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1579,14 +1363,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[open_redirect_in_splunk_web_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[osquery_pack___coldroot_detection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[overwriting_accessibility_binaries_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1623,10 +1399,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[processes_created_by_netsh_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[processes_launching_netsh_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1635,10 +1407,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[prohibited_software_on_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[protocol_or_port_mismatch_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1655,10 +1423,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[reg_exe_used_to_hide_files_directories_via_registry_keys_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[registry_keys_used_for_persistence_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1687,14 +1451,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[remote_registry_key_modifications_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[remote_wmi_command_attempt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[resize_shadowstorage_volume_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1763,10 +1519,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[scheduled_tasks_used_in_badrabbit_ransomware_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[schtasks_run_task_on_demand_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1815,18 +1567,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[spectre_and_meltdown_vulnerable_systems_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[spike_in_file_writes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_enterprise_information_disclosure_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[sunburst_correlation_dll_and_network_event_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1835,10 +1579,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_changes_to_file_associations_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_curl_network_connection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1851,18 +1591,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_email___uba_anomaly_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_email_attachment_extensions_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_file_write_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_gpupdate_no_command_line_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1951,10 +1683,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_writes_to_system_volume_information_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_writes_to_windows_recycle_bin_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1979,10 +1707,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[uncommon_processes_on_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[unified_messaging_service_spawning_a_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1991,14 +1715,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[unsigned_image_loaded_by_lsass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[unsuccessful_netbackup_backups_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[unusually_long_command_line_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -2091,14 +1807,6 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_connhost_exe_started_forcefully_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_hosts_file_modification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[winword_spawning_cmd_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -2139,7 +1847,3 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gcp_detect_oauth_token_abuse_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
dist/escu/default/savedsearches.conf
Vendored
+409 -425
View File
File diff suppressed because it is too large Load Diff
dist/escu/default/use_case_library.conf
Vendored
+32 -960
View File
File diff suppressed because it is too large Load Diff
dist/escu/lookups/mitre_enrichment.csv
Vendored
+334 -210
View File
@@ -1,59 +1,182 @@
mitre_id,technique,tactics,groups
T1205.001,Port Knocking,Defense Evasion|Persistence|Command And Control,no
T1553.006,Code Signing Policy Modification,Defense Evasion,Turla|APT39
T1614,System Location Discovery,Discovery,no
T1613,Container and Resource Discovery,Discovery,no
T1552.007,Container API,Credential Access,no
T1612,Build Image on Host,Defense Evasion,no
T1611,Escape to Host,Privilege Escalation,no
T1204.003,Malicious Image,Execution,no
T1053.007,Container Orchestration Job,Execution|Persistence|Privilege Escalation,no
T1610,Deploy Container,Defense Evasion|Execution,no
T1609,Container Administration Command,Execution,no
T1608.005,Link Target,Resource Development,Silent Librarian
T1608.004,Drive-by Target,Resource Development,APT32|Threat Group-3390
T1608.003,Install Digital Certificate,Resource Development,no
T1608.002,Upload Tool,Resource Development,Threat Group-3390
T1608.001,Upload Malware,Resource Development,APT32
T1608,Stage Capabilities,Resource Development,no
T1016.001,Internet Connection Discovery,Discovery,APT29|UNC2452|Turla
T1553.005,Mark-of-the-Web Bypass,Defense Evasion,TA505
T1555.005,Password Managers,Credential Access,Fox Kitten|Operation Wocao
T1484.002,Domain Trust Modification,Defense Evasion|Privilege Escalation,APT29|UNC2452
T1484.001,Group Policy Modification,Defense Evasion|Privilege Escalation,Indrik Spider
T1547.014,Active Setup,Persistence|Privilege Escalation,no
T1606.002,SAML Tokens,Credential Access,APT29|UNC2452
T1606.001,Web Cookies,Credential Access,APT29|UNC2452
T1606,Forge Web Credentials,Credential Access,no
T1555.004,Windows Credential Manager,Credential Access,Stealth Falcon|OilRig|Turla
T1059.008,Network Device CLI,Execution,no
T1602.002,Network Device Configuration Dump,Collection,no
T1542.005,TFTP Boot,Defense Evasion|Persistence,no
T1542.004,ROMMONkit,Defense Evasion|Persistence,no
T1602.001,SNMP (MIB Dump),Collection,no
T1602,Data from Configuration Repository,Collection,no
T1601.002,Downgrade System Image,Defense Evasion,no
T1601.001,Patch System Image,Defense Evasion,no
T1601,Modify System Image,Defense Evasion,no
T1600.002,Disable Crypto Hardware,Defense Evasion,no
T1600.001,Reduce Key Space,Defense Evasion,no
T1600,Weaken Encryption,Defense Evasion,no
T1556.004,Network Device Authentication,Credential Access|Defense Evasion|Persistence,no
T1599.001,Network Address Translation Traversal,Defense Evasion,no
T1599,Network Boundary Bridging,Defense Evasion,no
T1020.001,Traffic Duplication,Exfiltration,no
T1557.002,ARP Cache Poisoning,Credential Access|Collection,Cleaver
T1588.006,Vulnerabilities,Resource Development,Sandworm Team
T1053.006,Systemd Timers,Execution|Persistence|Privilege Escalation,no
T1562.008,Disable Cloud Logs,Defense Evasion,no
T1547.012,Print Processors,Persistence|Privilege Escalation,no
T1598.003,Spearphishing Link,Reconnaissance,Silent Librarian|Sidewinder|Sandworm Team|APT32|Kimsuky
T1598.002,Spearphishing Attachment,Reconnaissance,Sidewinder
T1598.001,Spearphishing Service,Reconnaissance,no
T1598,Phishing for Information,Reconnaissance,ZIRCONIUM|APT28
T1597.002,Purchase Technical Data,Reconnaissance,no
T1597.001,Threat Intel Vendors,Reconnaissance,no
T1597,Search Closed Sources,Reconnaissance,no
T1596.005,Scan Databases,Reconnaissance,no
T1596.004,CDNs,Reconnaissance,no
T1596.003,Digital Certificates,Reconnaissance,no
T1596.001,DNS/Passive DNS,Reconnaissance,no
T1596.002,WHOIS,Reconnaissance,no
T1596,Search Open Technical Databases,Reconnaissance,no
T1595.002,Vulnerability Scanning,Reconnaissance,Volatile Cedar|APT28|Sandworm Team
T1595.001,Scanning IP Blocks,Reconnaissance,no
T1595,Active Scanning,Reconnaissance,no
T1594,Search Victim-Owned Websites,Reconnaissance,Silent Librarian|Sandworm Team
T1593.002,Search Engines,Reconnaissance,no
T1593.001,Social Media,Reconnaissance,no
T1593,Search Open Websites/Domains,Reconnaissance,Sandworm Team
T1592.004,Client Configurations,Reconnaissance,HAFNIUM
T1592.003,Firmware,Reconnaissance,no
T1592.002,Software,Reconnaissance,Sandworm Team
T1592.001,Hardware,Reconnaissance,no
T1592,Gather Victim Host Information,Reconnaissance,no
T1591.004,Identify Roles,Reconnaissance,no
T1591.003,Identify Business Tempo,Reconnaissance,no
T1591.001,Determine Physical Locations,Reconnaissance,no
T1591.002,Business Relationships,Reconnaissance,Sandworm Team
T1591,Gather Victim Org Information,Reconnaissance,no
T1590.006,Network Security Appliances,Reconnaissance,no
T1590.005,IP Addresses,Reconnaissance,HAFNIUM
T1590.004,Network Topology,Reconnaissance,no
T1590.003,Network Trust Dependencies,Reconnaissance,no
T1590.002,DNS,Reconnaissance,no
T1590.001,Domain Properties,Reconnaissance,Sandworm Team
T1590,Gather Victim Network Information,Reconnaissance,HAFNIUM
T1589.003,Employee Names,Reconnaissance,Silent Librarian|Sandworm Team
T1589.002,Email Addresses,Reconnaissance,TA551|MuddyWater|HAFNIUM|APT32|Silent Librarian|Sandworm Team
T1589.001,Credentials,Reconnaissance,APT28|Magic Hound|Chimera
T1589,Gather Victim Identity Information,Reconnaissance,APT32
T1588.005,Exploits,Resource Development,no
T1588.004,Digital Certificates,Resource Development,Lazarus Group|Silent Librarian
T1588.003,Code Signing Certificates,Resource Development,Wizard Spider
T1588.002,Tool,Resource Development,MuddyWater|Silent Librarian|GALLIUM|Sandworm Team
T1588.001,Malware,Resource Development,Turla|APT1
T1588,Obtain Capabilities,Resource Development,no
T1587.004,Exploits,Resource Development,no
T1587.003,Digital Certificates,Resource Development,APT29|PROMETHIUM
T1587.002,Code Signing Certificates,Resource Development,PROMETHIUM|Patchwork
T1587.001,Malware,Resource Development,APT29|Lazarus Group|UNC2452|Sandworm Team|Turla|FIN7|Night Dragon|Cleaver
T1587,Develop Capabilities,Resource Development,Kimsuky
T1586.002,Email Accounts,Resource Development,Magic Hound|Kimsuky
T1586.001,Social Media Accounts,Resource Development,no
T1586,Compromise Accounts,Resource Development,no
T1585.002,Email Accounts,Resource Development,Magic Hound|Silent Librarian|Sandworm Team|APT1
T1585.001,Social Media Accounts,Resource Development,Fox Kitten|Sandworm Team|APT32|Cleaver
T1585,Establish Accounts,Resource Development,Fox Kitten|APT17
T1584.006,Web Services,Resource Development,Turla
T1584.005,Botnet,Resource Development,no
T1584.004,Server,Resource Development,Indrik Spider|Turla|APT16
T1584.003,Virtual Private Server,Resource Development,Turla
T1584.002,DNS Server,Resource Development,no
T1584.001,Domains,Resource Development,APT29|UNC2452|APT1
T1583.006,Web Services,Resource Development,ZIRCONIUM|MuddyWater|HAFNIUM|Lazarus Group|Turla|APT32|APT17|APT29
T1583.005,Botnet,Resource Development,no
T1583.004,Server,Resource Development,GALLIUM|Sandworm Team
T1583.003,Virtual Private Server,Resource Development,HAFNIUM|TEMP.Veles
T1583.002,DNS Server,Resource Development,no
T1584,Compromise Infrastructure,Resource Development,no
T1583.001,Domains,Resource Development,APT29|Mustang Panda|ZIRCONIUM|UNC2452|Lazarus Group|Silent Librarian|menuPass|Sandworm Team|APT32|Kimsuky|APT1|APT28
T1583,Acquire Infrastructure,Resource Development,no
T1564.007,VBA Stomping,Defense Evasion,no
T1558.004,AS-REP Roasting,Credential Access,no
T1580,Cloud Infrastructure Discovery,Discovery,no
T1218.012,Verclsid,Defense Evasion,no
T1205.001,Port Knocking,Defense Evasion|Persistence|Command And Control,PROMETHIUM
T1564.006,Run Virtual Instance,Defense Evasion,no
T1564.005,Hidden File System,Defense Evasion,Strider|Equation
T1556.003,Pluggable Authentication Modules,Credential Access|Defense Evasion,no
T1556.003,Pluggable Authentication Modules,Credential Access|Defense Evasion|Persistence,no
T1574.012,COR_PROFILER,Persistence|Privilege Escalation|Defense Evasion,Blue Mockingbird
T1562.007,Disable or Modify Cloud Firewall,Defense Evasion,no
T1098.004,SSH Authorized Keys,Persistence,no
T1480.001,Environmental Keying,Defense Evasion,APT41|Equation
T1059.007,JavaScript/JScript,Execution,APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer
T1059.007,JavaScript,Execution,MuddyWater|Turla|Higaisa|Sidewinder|Evilnum|Kimsuky|FIN6|APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer
T1578.004,Revert Cloud Instance,Defense Evasion,no
T1578.003,Delete Cloud Instance,Defense Evasion,no
T1578.001,Create Snapshot,Defense Evasion,no
T1578.002,Create Cloud Instance,Defense Evasion,no
T1127.001,MSBuild,Defense Evasion,Frankenstein
T1027.005,Indicator Removal from Tools,Defense Evasion,Soft Cell|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda
T1027.005,Indicator Removal from Tools,Defense Evasion,Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda
T1562.006,Indicator Blocking,Defense Evasion,no
T1573.002,Asymmetric Cryptography,Command And Control,Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6
T1573.001,Symmetric Cryptography,Command And Control,Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group
T1573.002,Asymmetric Cryptography,Command And Control,Operation Wocao|Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6
T1573.001,Symmetric Cryptography,Command And Control,Mustang Panda|Darkhotel|ZIRCONIUM|Higaisa|Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group
T1573,Encrypted Channel,Command And Control,Tropic Trooper
T1027.004,Compile After Delivery,Defense Evasion,Gamaredon Group|Rocke|MuddyWater
T1574.004,Dylib Hijacking,Persistence|Privilege Escalation|Defense Evasion,no
T1546.015,Component Object Model Hijacking,Privilege Escalation|Persistence,APT28
T1071.004,DNS,Command And Control,APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7
T1071.003,Mail Protocols,Command And Control,APT32|SilverTerrier|APT28
T1071.002,File Transfer Protocols,Command And Control,APT41|SilverTerrier|Machete|Honeybee
T1071.001,Web Protocols,Command And Control,Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|Machete|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Cobalt Group|APT19|Threat Group-3390|Rancor|Orangeworm|APT37|Ke3chang|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|APT32|OilRig|Magic Hound|Gamaredon Group|Stealth Falcon
T1572,Protocol Tunneling,Command And Control,OilRig|Cobalt Group|FIN6
T1048.003,Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol,Exfiltration,APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group
T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,no
T1071.004,DNS,Command And Control,Chimera|APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7
T1071.003,Mail Protocols,Command And Control,Turla|Kimsuky|APT32|SilverTerrier|APT28
T1071.002,File Transfer Protocols,Command And Control,Kimsuky|APT41|SilverTerrier|Honeybee
T1071.001,Web Protocols,Command And Control,APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|UNC2452|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Ke3chang|Orangeworm|APT19|Cobalt Group|Threat Group-3390|Rancor|APT37|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|Magic Hound|APT32|OilRig|Gamaredon Group|Stealth Falcon
T1572,Protocol Tunneling,Command And Control,Chimera|Fox Kitten|OilRig|Cobalt Group|FIN6
T1048.003,Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol,Exfiltration,Wizard Spider|FIN6|APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group
T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,APT29|UNC2452
T1048.001,Exfiltration Over Symmetric Encrypted Non-C2 Protocol,Exfiltration,no
T1001.003,Protocol Impersonation,Command And Control,Lazarus Group
T1001.002,Steganography,Command And Control,Axiom
T1001.003,Protocol Impersonation,Command And Control,Higaisa|Lazarus Group
T1001.002,Steganography,Command And Control,APT29|Axiom
T1001.001,Junk Data,Command And Control,APT28
T1132.002,Non-Standard Encoding,Command And Control,no
T1132.001,Standard Encoding,Command And Control,Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork
T1132.001,Standard Encoding,Command And Control,HAFNIUM|TA551|Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork
T1090.004,Domain Fronting,Command And Control,APT29
T1090.003,Multi-hop Proxy,Command And Control,Inception|FIN4|APT29
T1090.002,External Proxy,Command And Control,APT39|Silence|Soft Cell|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28
T1090.001,Internal Proxy,Command And Control,APT39|Strider
T1090.003,Multi-hop Proxy,Command And Control,APT28|Operation Wocao|Inception|FIN4|APT29
T1090.002,External Proxy,Command And Control,APT39|Silence|GALLIUM|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28
T1090.001,Internal Proxy,Command And Control,APT29|Higaisa|UNC2452|Operation Wocao|APT39|Strider
T1102.003,One-Way Communication,Command And Control,Leviathan
T1102.002,Bidirectional Communication,Command And Control,Sandworm Team|APT39|APT12|Turla|FIN7|APT37|Magic Hound|Carbanak
T1102.002,Bidirectional Communication,Command And Control,ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|FIN7|Turla|APT37|Magic Hound|Carbanak
T1102.001,Dead Drop Resolver,Command And Control,Rocke|APT41|BRONZE BUTLER|RTM|Patchwork
T1571,Non-Standard Port,Command And Control,Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7
T1074.002,Remote Data Staging,Collection,Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8
T1074.001,Local Data Staging,Collection,Machete|Soft Cell|TEMP.Veles|Patchwork|Dragonfly 2.0|Honeybee|Leviathan|APT3|FIN5|menuPass|FIN6|Lazarus Group|Threat Group-3390|APT28
T1074.002,Remote Data Staging,Collection,APT29|Chimera|UNC2452|Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8
T1074.001,Local Data Staging,Collection,Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|Honeybee|Dragonfly 2.0|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28
T1078.004,Cloud Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT33
T1564.004,NTFS File Attributes,Defense Evasion,APT32
T1564.003,Hidden Window,Defense Evasion,Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound
T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Tropic Trooper|FIN10|Stolen Pencil|APT32
T1078.002,Domain Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,TA505|APT3|Threat Group-1314
T1564.003,Hidden Window,Defense Evasion,Higaisa|Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound
T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,HAFNIUM|Turla|Operation Wocao|PROMETHIUM|Tropic Trooper|FIN10|Stolen Pencil|APT32
T1078.002,Domain Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Indrik Spider|Chimera|Operation Wocao|Sandworm Team|Wizard Spider|APT29|TA505|APT3|Threat Group-1314
T1078.001,Default Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,no
T1564.002,Hidden Users,Defense Evasion,no
T1574.006,LD_PRELOAD,Persistence|Privilege Escalation|Defense Evasion,Rocke
T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,BRONZE BUTLER|Naikon|APT41|Soft Cell|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390
T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,Whitefly|RTM|Threat Group-3390|menuPass
T1574.006,Dynamic Linker Hijacking,Persistence|Privilege Escalation|Defense Evasion,APT41|Rocke
T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,Mustang Panda|Higaisa|BlackTech|Sidewinder|Chimera|BRONZE BUTLER|Naikon|APT41|GALLIUM|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390
T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,Evilnum|APT41|Whitefly|RTM|Threat Group-3390|menuPass
T1574.008,Path Interception by Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,no
T1574.007,Path Interception by PATH Environment Variable,Persistence|Privilege Escalation|Defense Evasion,no
T1574.009,Path Interception by Unquoted Path,Persistence|Privilege Escalation|Defense Evasion,no
@@ -61,174 +184,174 @@ T1574.011,Services Registry Permissions Weakness,Persistence|Privilege Escalatio
T1574.005,Executable Installer File Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no
T1574.010,Services File Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no
T1574,Hijack Execution Flow,Persistence|Privilege Escalation|Defense Evasion,no
T1069.001,Local Groups,Discovery,Turla|OilRig|admin@338
T1570,Lateral Tool Transfer,Lateral Movement,APT32|Wizard Spider|Turla|FIN10
T1069.001,Local Groups,Discovery,Chimera|Operation Wocao|Turla|OilRig|admin@338
T1570,Lateral Tool Transfer,Lateral Movement,Chimera|GALLIUM|Operation Wocao|APT32|Wizard Spider|Turla|FIN10
T1568.003,DNS Calculation,Command And Control,APT12
T1204.002,Malicious File,Execution,Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|APT19|Dragonfly 2.0|BRONZE BUTLER|Cobalt Group|DarkHydrus|Gorgon Group|Patchwork|OilRig|Dark Caracal|MuddyWater|Lazarus Group|FIN7|APT32|Rancor|APT37|FIN8|APT28|Elderwood|TA459|APT29|Leviathan|menuPass|PLATINUM
T1204.001,Malicious Link,Execution,Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla
T1204.002,Malicious File,Execution,Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Dragonfly 2.0|Dark Caracal|Cobalt Group|DarkHydrus|OilRig|Rancor|BRONZE BUTLER|FIN7|APT19|Patchwork|APT32|Gorgon Group|MuddyWater|Lazarus Group|APT37|TA459|Leviathan|APT29|APT28|FIN8|Elderwood|PLATINUM|menuPass
T1204.001,Malicious Link,Execution,APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|Turla|APT33
T1195.003,Compromise Hardware Supply Chain,Initial Access,no
T1195.002,Compromise Software Supply Chain,Initial Access,Sandworm Team|APT41
T1195.002,Compromise Software Supply Chain,Initial Access,APT29|UNC2452|Cobalt Group|GOLD SOUTHFIELD|Dragonfly|Sandworm Team|APT41
T1195.001,Compromise Software Dependencies and Development Tools,Initial Access,no
T1568.001,Fast Flux DNS,Command And Control,TA505
T1052.001,Exfiltration over USB,Exfiltration,Tropic Trooper
T1569.002,Service Execution,Execution,Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang
T1568.001,Fast Flux DNS,Command And Control,menuPass|TA505
T1052.001,Exfiltration over USB,Exfiltration,Mustang Panda|Tropic Trooper
T1569.002,Service Execution,Execution,Chimera|Operation Wocao|Wizard Spider|Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang
T1569.001,Launchctl,Execution,no
T1569,System Services,Execution,no
T1568.002,Domain Generation Algorithms,Command And Control,APT41
T1568,Dynamic Resolution,Command And Control,no
T1568.002,Domain Generation Algorithms,Command And Control,TA551|APT41
T1568,Dynamic Resolution,Command And Control,APT29|UNC2452
T1011.001,Exfiltration Over Bluetooth,Exfiltration,no
T1567.002,Exfiltration to Cloud Storage,Exfiltration,Leviathan|Turla
T1567.002,Exfiltration to Cloud Storage,Exfiltration,ZIRCONIUM|HAFNIUM|Chimera|Leviathan|Turla
T1567.001,Exfiltration to Code Repository,Exfiltration,no
T1059.006,Python,Execution,Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete
T1059.005,Visual Basic,Execution,APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound
T1059.006,Python,Execution,ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete
T1059.005,Visual Basic,Execution,Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|Lazarus Group|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound
T1059.004,Unix Shell,Execution,Rocke|APT41
T1059.003,Windows Command Shell,Execution,TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|Soft Cell|Turla|Silence|APT32|APT39|Darkhotel|MuddyWater|APT18|APT38|Dark Caracal|Gorgon Group|Dragonfly 2.0|Rancor|Ke3chang|APT37|Leviathan|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|Threat Group-3390|menuPass|Gamaredon Group|Suckfly|Patchwork|Threat Group-1314|APT3|admin@338|APT1
T1059.003,Windows Command Shell,Execution,APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|UNC2452|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Dragonfly 2.0|Rancor|Gorgon Group|Ke3chang|Dark Caracal|Leviathan|APT37|APT28|FIN8|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|Threat Group-3390|menuPass|Gamaredon Group|Patchwork|Suckfly|Threat Group-1314|APT3|admin@338|APT1
T1059.002,AppleScript,Execution,no
T1059.001,PowerShell,Execution,Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|Soft Cell|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|DarkHydrus|APT28|Thrip|Gorgon Group|Cobalt Group|Dragonfly 2.0|Leviathan|TA459|FIN8|MuddyWater|Magic Hound|OilRig|BRONZE BUTLER|CopyKittens|APT32|FIN7|FIN10|Threat Group-3390|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda
T1567,Exfiltration Over Web Service,Exfiltration,no
T1059.001,PowerShell,Execution,Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Lazarus Group|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|APT28|Thrip|Cobalt Group|Turla|APT19|Dragonfly 2.0|Gorgon Group|DarkHydrus|Leviathan|TA459|MuddyWater|FIN8|OilRig|Magic Hound|BRONZE BUTLER|CopyKittens|APT32|FIN10|menuPass|Threat Group-3390|FIN7|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda
T1567,Exfiltration Over Web Service,Exfiltration,APT28
T1497.003,Time Based Evasion,Defense Evasion|Discovery,no
T1497.002,User Activity Based Checks,Defense Evasion|Discovery,FIN7
T1497.001,System Checks,Defense Evasion|Discovery,Frankenstein
T1497.002,User Activity Based Checks,Defense Evasion|Discovery,Darkhotel|FIN7
T1497.001,System Checks,Defense Evasion|Discovery,Darkhotel|Evilnum|Frankenstein
T1498.002,Reflection Amplification,Impact,no
T1498.001,Direct Network Flood,Impact,no
T1566.003,Spearphishing via Service,Initial Access,Magic Hound|Windshift|FIN6|OilRig|Dark Caracal
T1566.002,Spearphishing Link,Initial Access,Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Turla|APT28|Cobalt Group|Dragonfly 2.0|OilRig|APT33|Elderwood|Leviathan|Magic Hound|Patchwork|APT29|FIN8
T1566.001,Spearphishing Attachment,Initial Access,Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Turla|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|OilRig|Lazarus Group|APT19|Dragonfly 2.0|BRONZE BUTLER|APT32|FIN8|MuddyWater|APT28|TA459|Leviathan|Patchwork|PLATINUM|Elderwood|APT29|APT37|menuPass
T1566,Phishing,Initial Access,no
T1566.003,Spearphishing via Service,Initial Access,Ajax Security Team|Lazarus Group|Magic Hound|Windshift|FIN6|OilRig|Dark Caracal
T1566.002,Spearphishing Link,Initial Access,Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Cobalt Group|Turla|APT28|Dragonfly 2.0|OilRig|APT29|APT33|Leviathan|FIN8|Elderwood|Patchwork|Magic Hound
T1566.001,Spearphishing Attachment,Initial Access,Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|OilRig|BRONZE BUTLER|Cobalt Group|FIN7|APT19|Gorgon Group|Rancor|APT32|DarkHydrus|Lazarus Group|Dragonfly 2.0|MuddyWater|APT28|FIN8|Elderwood|APT37|menuPass|TA459|PLATINUM|APT29|Leviathan|Patchwork
T1566,Phishing,Initial Access,GOLD SOUTHFIELD|Dragonfly
T1565.003,Runtime Data Manipulation,Impact,APT38
T1565.002,Transmitted Data Manipulation,Impact,APT38
T1565.001,Stored Data Manipulation,Impact,FIN4|APT38
T1565,Data Manipulation,Impact,no
T1564.001,Hidden Files and Directories,Defense Evasion,Rocke|APT32|Tropic Trooper|APT28|Lazarus Group
T1564.001,Hidden Files and Directories,Defense Evasion,Mustang Panda|Rocke|APT32|Tropic Trooper|APT28|Lazarus Group
T1564,Hide Artifacts,Defense Evasion,no
T1563.002,RDP Hijacking,Lateral Movement,no
T1563.001,SSH Hijacking,Lateral Movement,no
T1563,Remote Service Session Hijacking,Lateral Movement,no
T1518.001,Security Software Discovery,Discovery,Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon
T1518.001,Security Software Discovery,Discovery,Windshift|Sidewinder|Operation Wocao|Wizard Spider|Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon
T1069.003,Cloud Groups,Discovery,no
T1069.002,Domain Groups,Discovery,Turla|Wizard Spider|Inception|OilRig|FIN6|Dragonfly 2.0|Ke3chang
T1069.002,Domain Groups,Discovery,Turla|Inception|OilRig|Dragonfly 2.0|Ke3chang
T1087.004,Cloud Account,Discovery,no
T1087.003,Email Account,Discovery,Sandworm Team|TA505
T1087.002,Domain Account,Discovery,Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang
T1087.001,Local Account,Discovery,Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338
T1087.002,Domain Account,Discovery,MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang
T1087.001,Local Account,Discovery,Chimera|Fox Kitten|Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338
T1553.004,Install Root Certificate,Defense Evasion,no
T1562.004,Disable or Modify System Firewall,Defense Evasion,Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak
T1562.003,HISTCONTROL,Defense Evasion,no
T1562.002,Disable Windows Event Logging,Defense Evasion,Threat Group-3390
T1562.001,Disable or Modify Tools,Defense Evasion,Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda
T1562.004,Disable or Modify System Firewall,Defense Evasion,APT29|UNC2452|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak
T1562.003,Impair Command History Logging,Defense Evasion,no
T1562.002,Disable Windows Event Logging,Defense Evasion,APT29|UNC2452|Threat Group-3390
T1562.001,Disable or Modify Tools,Defense Evasion,APT29|MuddyWater|UNC2452|Wizard Spider|FIN6|Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda
T1562,Impair Defenses,Defense Evasion,no
T1003.004,LSA Secrets,Credential Access,OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390
T1003.005,Cached Domain Credentials,Credential Access,OilRig|MuddyWater|Leafminer|APT33
T1561.002,Disk Structure Wipe,Impact,Sandworm Team|Lazarus Group|APT38|APT37
T1561.001,Disk Content Wipe,Impact,Lazarus Group
T1561,Disk Wipe,Impact,no
T1560.003,Archive via Custom Method,Collection,Lazarus Group|Kimsuky|CopyKittens|FIN6
T1560.003,Archive via Custom Method,Collection,Mustang Panda|Lazarus Group|Kimsuky|CopyKittens|FIN6
T1560.002,Archive via Library,Collection,Lazarus Group|Threat Group-3390
T1560.001,Archive via Utility,Collection,APT41|Soft Cell|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|APT3|Sowbug|menuPass|APT1|Ke3chang
T1560.001,Archive via Utility,Collection,APT29|Mustang Panda|HAFNIUM|UNC2452|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|APT1|Ke3chang
T1560,Archive Collected Data,Collection,menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang
T1499.004,Application or System Exploitation,Impact,no
T1499.003,Application Exhaustion Flood,Impact,no
T1499.002,Service Exhaustion Flood,Impact,no
T1499.001,OS Exhaustion Flood,Impact,no
T1491.002,External Defacement,Impact,no
T1491.002,External Defacement,Impact,Sandworm Team
T1491.001,Internal Defacement,Impact,Lazarus Group
T1114.003,Email Forwarding Rule,Collection,no
T1114.002,Remote Email Collection,Collection,APT1|FIN4|APT28|Dragonfly 2.0|Ke3chang|Leafminer
T1114.001,Local Email Collection,Collection,Magic Hound|APT1
T1114.003,Email Forwarding Rule,Collection,Silent Librarian|Kimsuky
T1114.002,Remote Email Collection,Collection,APT29|HAFNIUM|Chimera|UNC2452|APT1|FIN4|Dragonfly 2.0|APT28|Leafminer|Ke3chang
T1114.001,Local Email Collection,Collection,Chimera|Magic Hound|APT1
T1134.005,SID-History Injection,Defense Evasion|Privilege Escalation,no
T1134.004,Parent PID Spoofing,Defense Evasion|Privilege Escalation,no
T1134.003,Make and Impersonate Token,Defense Evasion|Privilege Escalation,no
T1134.002,Create Process with Token,Defense Evasion|Privilege Escalation,Turla|Lazarus Group
T1134.001,Token Impersonation/Theft,Defense Evasion|Privilege Escalation,APT28
T1213.002,Sharepoint,Collection,Ke3chang|APT28
T1213.002,Sharepoint,Collection,Chimera|Ke3chang|APT28
T1213.001,Confluence,Collection,no
T1555.003,Credentials from Web Browsers,Credential Access,Magic Hound|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats
T1555.003,Credentials from Web Browsers,Credential Access,Ajax Security Team|ZIRCONIUM|FIN6|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats
T1555.002,Securityd Memory,Credential Access,no
T1555.001,Keychain,Credential Access,no
T1559.002,Dynamic Data Exchange,Execution,Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7
T1559.002,Dynamic Data Exchange,Execution,Sidewinder|Sharpshooter|TA505|MuddyWater|Gallmaker|Cobalt Group|Patchwork|APT37|APT28|FIN7
T1559.001,Component Object Model,Execution,Gamaredon Group|MuddyWater
T1559,Inter-Process Communication,Execution,no
T1558.002,Silver Ticket,Credential Access,no
T1558.001,Golden Ticket,Credential Access,Ke3chang
T1558,Steal or Forge Kerberos Tickets,Credential Access,no
T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,no
T1557,Man-in-the-Middle,Credential Access|Collection,no
T1556.002,Password Filter DLL,Credential Access|Defense Evasion,Strider
T1556.001,Domain Controller Authentication,Credential Access|Defense Evasion,no
T1556,Modify Authentication Process,Credential Access|Defense Evasion,no
T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,Wizard Spider
T1557,Man-in-the-Middle,Credential Access|Collection,Kimsuky
T1556.002,Password Filter DLL,Credential Access|Defense Evasion|Persistence,Strider
T1556.001,Domain Controller Authentication,Credential Access|Defense Evasion|Persistence,Chimera
T1556,Modify Authentication Process,Credential Access|Defense Evasion|Persistence,no
T1056.004,Credential API Hooking,Collection|Credential Access,PLATINUM
T1056.003,Web Portal Capture,Collection|Credential Access,no
T1056.002,GUI Input Capture,Collection|Credential Access,FIN4
T1056.001,Keylogging,Collection|Credential Access,APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|Ke3chang|OilRig|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28
T1555,Credentials from Password Stores,Credential Access,APT39|OilRig|MuddyWater|Leafminer|APT33|Turla|Stealth Falcon
T1056.001,Keylogging,Collection|Credential Access,Ajax Security Team|Operation Wocao|APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28
T1555,Credentials from Password Stores,Credential Access,APT29|Evilnum|UNC2452|FIN6|APT39|OilRig|MuddyWater|Leafminer|APT33|Stealth Falcon
T1552.005,Cloud Instance Metadata API,Credential Access,no
T1003.008,/etc/passwd and /etc/shadow,Credential Access,no
T1003.007,Proc Filesystem,Credential Access,no
T1003.006,DCSync,Credential Access,no
T1558.003,Kerberoasting,Credential Access,no
T1003.006,DCSync,Credential Access,APT29|UNC2452|Operation Wocao
T1558.003,Kerberoasting,Credential Access,APT29|UNC2452|Operation Wocao|Wizard Spider
T1552.006,Group Policy Preferences,Credential Access,APT33
T1003.003,NTDS,Credential Access,FIN6|Dragonfly 2.0
T1003.002,Security Account Manager,Credential Access,Threat Group-3390|Ke3chang|Soft Cell|Night Dragon|Dragonfly 2.0|menuPass
T1003.001,LSASS Memory,Credential Access,Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|Soft Cell|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Lazarus Group|Leafminer|Magic Hound|MuddyWater|PLATINUM|FIN8|BRONZE BUTLER|OilRig|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver
T1110.004,Credential Stuffing,Credential Access,no
T1110.003,Password Spraying,Credential Access,APT33|Leafminer|Lazarus Group
T1110.002,Password Cracking,Credential Access,APT41|Dragonfly 2.0|APT3
T1110.001,Password Guessing,Credential Access,no
T1021.006,Windows Remote Management,Lateral Movement,Threat Group-3390
T1021.005,VNC,Lateral Movement,GCMAN
T1021.004,SSH,Lateral Movement,Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN
T1003.003,NTDS,Credential Access,Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6|Dragonfly 2.0
T1003.002,Security Account Manager,Credential Access,Wizard Spider|Threat Group-3390|Ke3chang|GALLIUM|Night Dragon|Dragonfly 2.0|menuPass
T1003.001,LSASS Memory,Credential Access,HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Leafminer|Magic Hound|Lazarus Group|PLATINUM|FIN8|MuddyWater|BRONZE BUTLER|OilRig|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver
T1110.004,Credential Stuffing,Credential Access,Chimera
T1110.003,Password Spraying,Credential Access,Silent Librarian|Chimera|APT28|APT33|Leafminer|Lazarus Group
T1110.002,Password Cracking,Credential Access,FIN6|APT41|Dragonfly 2.0|APT3
T1110.001,Password Guessing,Credential Access,APT28
T1021.006,Windows Remote Management,Lateral Movement,APT29|UNC2452|Chimera|Wizard Spider|Threat Group-3390
T1021.005,VNC,Lateral Movement,Fox Kitten|GCMAN
T1021.004,SSH,Lateral Movement,Fox Kitten|Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN
T1021.003,Distributed Component Object Model,Lateral Movement,no
T1021.002,SMB/Windows Admin Shares,Lateral Movement,Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang
T1021.001,Remote Desktop Protocol,Lateral Movement,Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|menuPass|FIN10|Patchwork|FIN6|Lazarus Group|APT1|Axiom
T1021.002,SMB/Windows Admin Shares,Lateral Movement,Fox Kitten|APT41|Operation Wocao|Wizard Spider|Chimera|Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang
T1021.001,Remote Desktop Protocol,Lateral Movement,Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|FIN10|menuPass|Patchwork|FIN6|Lazarus Group|APT1|Axiom
T1554,Compromise Client Software Binary,Persistence,no
T1036.006,Space after Filename,Defense Evasion,no
T1036.005,Match Legitimate Name or Location,Defense Evasion,Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1
T1036.004,Masquerade Task or Service,Defense Evasion,Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7
T1036.003,Rename System Utilities,Defense Evasion,menuPass|APT32|Soft Cell|PLATINUM
T1036.005,Match Legitimate Name or Location,Defense Evasion,APT29|Mustang Panda|Sidewinder|Darkhotel|Lazarus Group|Indrik Spider|UNC2452|Fox Kitten|Machete|Chimera|PROMETHIUM|Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1
T1036.004,Masquerade Task or Service,Defense Evasion,ZIRCONIUM|APT29|Higaisa|UNC2452|Fox Kitten|Kimsuky|Lazarus Group|PROMETHIUM|Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7
T1036.003,Rename System Utilities,Defense Evasion,menuPass|APT32|GALLIUM
T1036.002,Right-to-Left Override,Defense Evasion,BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic
T1036.001,Invalid Code Signature,Defense Evasion,Windshift
T1036.001,Invalid Code Signature,Defense Evasion,Windshift|APT37
T1553.003,SIP and Trust Provider Hijacking,Defense Evasion,no
T1553.002,Code Signing,Defense Evasion,Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|APT37|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel
T1553.002,Code Signing,Defense Evasion,APT29|GALLIUM|UNC2452|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel
T1553.001,Gatekeeper Bypass,Defense Evasion,no
T1553,Subvert Trust Controls,Defense Evasion,no
T1027.003,Steganography,Defense Evasion,BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37
T1027.002,Software Packing,Defense Evasion,TA505|Rocke|Soft Cell|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon
T1027.001,Binary Padding,Defense Evasion,Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee
T1027.003,Steganography,Defense Evasion,TA551|BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37
T1027.002,Software Packing,Defense Evasion,ZIRCONIUM|Lazarus Group|TA505|Rocke|GALLIUM|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon
T1027.001,Binary Padding,Defense Evasion,Mustang Panda|Higaisa|Gamaredon Group|APT32|Patchwork|Leviathan|BRONZE BUTLER|Moafee
T1222.002,Linux and Mac File and Directory Permissions Modification,Defense Evasion,Rocke|APT32
T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,no
T1552.004,Private Keys,Credential Access,Rocke
T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,Wizard Spider
T1552.004,Private Keys,Credential Access,APT29|UNC2452|Operation Wocao|Rocke
T1552.003,Bash History,Credential Access,no
T1552.002,Credentials in Registry,Credential Access,APT32
T1552.001,Credentials In Files,Credential Access,Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3
T1552.001,Credentials In Files,Credential Access,Fox Kitten|Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3
T1552,Unsecured Credentials,Credential Access,no
T1216.001,PubPrn,Defense Evasion,APT32
T1070.006,Timestomp,Defense Evasion,Rocke|TEMP.Veles|APT32|Lazarus Group|APT28
T1070.006,Timestomp,Defense Evasion,APT29|UNC2452|Chimera|Kimsuky|Rocke|TEMP.Veles|APT32|Lazarus Group|APT28
T1070.005,Network Share Connection Removal,Defense Evasion,Threat Group-3390
T1070.004,File Deletion,Defense Evasion,Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|FIN10|APT28|Threat Group-3390|Group5|Lazarus Group|APT18|APT29
T1070.004,File Deletion,Defense Evasion,APT39|Mustang Panda|Chimera|Evilnum|UNC2452|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Honeybee|Patchwork|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|FIN5|BRONZE BUTLER|OilRig|APT3|Magic Hound|APT28|FIN10|Threat Group-3390|Group5|Lazarus Group|APT18|APT29
T1070.003,Clear Command History,Defense Evasion,APT41
T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,no
T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,APT29|UNC2452
T1550.001,Application Access Token,Defense Evasion|Lateral Movement,APT28
T1550.003,Pass the Ticket,Defense Evasion|Lateral Movement,APT32|BRONZE BUTLER|APT29
T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,Soft Cell|APT32|Night Dragon|APT28|APT1
T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,no
T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,Chimera|Kimsuky|GALLIUM|APT32|Night Dragon|APT28|APT1
T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,APT29|UNC2452
T1548.004,Elevated Execution with Prompt,Privilege Escalation|Defense Evasion,no
T1548.003,Sudo and Sudo Caching,Privilege Escalation|Defense Evasion,no
T1548.002,Bypass User Access Control,Privilege Escalation|Defense Evasion,APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29
T1548.002,Bypass User Account Control,Privilege Escalation|Defense Evasion,Evilnum|APT37|MuddyWater|Cobalt Group|Honeybee|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29
T1548.001,Setuid and Setgid,Privilege Escalation|Defense Evasion,no
T1548,Abuse Elevation Control Mechanism,Privilege Escalation|Defense Evasion,no
T1136.003,Cloud Account,Persistence,no
T1070.002,Clear Linux or Mac System Logs,Defense Evasion,Rocke
T1070.001,Clear Windows Event Logs,Defense Evasion,APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28
T1136.002,Domain Account,Persistence,Soft Cell
T1136.001,Local Account,Persistence,APT39|APT41|Dragonfly 2.0|Leafminer|APT3
T1070.001,Clear Windows Event Logs,Defense Evasion,Chimera|Operation Wocao|APT41|APT38|APT32|Dragonfly 2.0|FIN8|FIN5|APT28
T1136.002,Domain Account,Persistence,HAFNIUM|GALLIUM
T1136.001,Local Account,Persistence,Fox Kitten|APT39|APT41|Dragonfly 2.0|Leafminer|APT3
T1547.011,Plist Modification,Persistence|Privilege Escalation,no
T1547.010,Port Monitors,Persistence|Privilege Escalation,no
T1547.009,Shortcut Modification,Persistence|Privilege Escalation,APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Leviathan|Lazarus Group
T1547.008,LSASS Driver,Persistence|Privilege Escalation,no
T1547.007,Re-opened Applications,Persistence|Privilege Escalation,no
T1547.006,Kernel Modules and Extensions,Persistence|Privilege Escalation,no
T1547.005,Security Support Provider,Persistence|Privilege Escalation,no
T1547.004,Winlogon Helper DLL,Persistence|Privilege Escalation,Tropic Trooper|Turla
T1547.005,Security Support Provider,Persistence|Privilege Escalation,Lazarus Group
T1547.004,Winlogon Helper DLL,Persistence|Privilege Escalation,Wizard Spider|Tropic Trooper|Turla
T1547.003,Time Providers,Persistence|Privilege Escalation,no
T1546.014,Emond,Privilege Escalation|Persistence,no
T1546.013,PowerShell Profile,Privilege Escalation|Persistence,Turla
@@ -236,38 +359,38 @@ T1546.012,Image File Execution Options Injection,Privilege Escalation|Persistenc
T1218.008,Odbcconf,Defense Evasion,Cobalt Group
T1546.011,Application Shimming,Privilege Escalation|Persistence,FIN7
T1547.002,Authentication Package,Persistence|Privilege Escalation,no
T1546.010,AppInit DLLs,Privilege Escalation|Persistence,no
T1546.010,AppInit DLLs,Privilege Escalation|Persistence,APT39
T1546.009,AppCert DLLs,Privilege Escalation|Persistence,Honeybee
T1218.007,Msiexec,Defense Evasion,TA505|Rancor
T1546.008,Accessibility Features,Privilege Escalation|Persistence,APT41|APT3|APT29|Deep Panda|Axiom
T1218.007,Msiexec,Defense Evasion,ZIRCONIUM|Molerats|Machete|TA505|Rancor
T1546.008,Accessibility Features,Privilege Escalation|Persistence,Fox Kitten|APT41|APT3|APT29|Deep Panda|Axiom
T1546.007,Netsh Helper DLL,Privilege Escalation|Persistence,no
T1546.006,LC_LOAD_DYLIB Addition,Privilege Escalation|Persistence,no
T1546.005,Trap,Privilege Escalation|Persistence,no
T1546.004,.bash_profile and .bashrc,Privilege Escalation|Persistence,no
T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,APT33|Blue Mockingbird|Turla|Leviathan|APT29
T1546.004,Unix Shell Configuration Modification,Privilege Escalation|Persistence,no
T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,Mustang Panda|UNC2452|APT33|Blue Mockingbird|Turla|Leviathan|APT29
T1546.002,Screensaver,Privilege Escalation|Persistence,no
T1546.001,Change Default File Association,Privilege Escalation|Persistence,Kimsuky
T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Machete|Kimsuky|APT33|APT39|APT32|APT18|Turla|Dark Caracal|Cobalt Group|Honeybee|Threat Group-3390|Dragonfly 2.0|Gorgon Group|Ke3chang|APT19|Leviathan|MuddyWater|APT37|BRONZE BUTLER|Magic Hound|APT3|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel
T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Dark Caracal|Threat Group-3390|Turla|Honeybee|APT19|Cobalt Group|Ke3chang|Dragonfly 2.0|Gorgon Group|Leviathan|APT37|MuddyWater|BRONZE BUTLER|APT3|Magic Hound|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel
T1218.002,Control Panel,Defense Evasion,no
T1218.010,Regsvr32,Defense Evasion,Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda
T1218.010,Regsvr32,Defense Evasion,TA551|Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda
T1218.009,Regsvcs/Regasm,Defense Evasion,no
T1218.005,Mshta,Defense Evasion,Inception|Kimsuky|APT32|MuddyWater|FIN7
T1218.004,InstallUtil,Defense Evasion,no
T1218.001,Compiled HTML File,Defense Evasion,APT41|Silence|Lazarus Group|Dark Caracal|OilRig
T1218.005,Mshta,Defense Evasion,Mustang Panda|TA551|Sidewinder|Lazarus Group|Inception|Kimsuky|APT32|MuddyWater|FIN7
T1218.004,InstallUtil,Defense Evasion,Mustang Panda|menuPass
T1218.001,Compiled HTML File,Defense Evasion,APT41|Silence|Lazarus Group|OilRig|Dark Caracal
T1218.003,CMSTP,Defense Evasion,Cobalt Group|MuddyWater
T1218.011,Rundll32,Defense Evasion,APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28
T1218.011,Rundll32,Defense Evasion,HAFNIUM|TA551|UNC2452|APT41|Gamaredon Group|APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28
T1547,Boot or Logon Autostart Execution,Persistence|Privilege Escalation,no
T1546,Event Triggered Execution,Privilege Escalation|Persistence,no
T1098.003,Add Office 365 Global Administrator Role,Persistence,no
T1098.002,Exchange Email Delegate Permissions,Persistence,Magic Hound
T1098.001,Additional Azure Service Principal Credentials,Persistence,no
T1098.002,Exchange Email Delegate Permissions,Persistence,APT29|UNC2452|Magic Hound
T1098.001,Additional Cloud Credentials,Persistence,APT29|UNC2452
T1543.004,Launch Daemon,Persistence|Privilege Escalation,no
T1543.003,Windows Service,Persistence|Privilege Escalation,Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|Honeybee|FIN7|Threat Group-3390|APT19|APT3|Lazarus Group|Carbanak
T1543.003,Windows Service,Persistence|Privilege Escalation,PROMETHIUM|Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|FIN7|APT19|Threat Group-3390|Honeybee|APT3|Lazarus Group|Carbanak
T1543.002,Systemd Service,Persistence|Privilege Escalation,Rocke
T1543.001,Launch Agent,Persistence|Privilege Escalation,no
T1037.005,Startup Items,Persistence|Privilege Escalation,no
T1037.004,Rc.common,Persistence|Privilege Escalation,no
T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Threat Group-3390|menuPass|Gorgon Group|Patchwork
T1037.004,RC Scripts,Persistence|Privilege Escalation,no
T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Gorgon Group|Threat Group-3390|menuPass|Patchwork
T1055.013,Process Doppelgänging,Defense Evasion|Privilege Escalation,Leafminer
T1055.011,Extra Window Memory Injection,Defense Evasion|Privilege Escalation,no
T1055.014,VDSO Hijacking,Defense Evasion|Privilege Escalation,no
@@ -277,7 +400,7 @@ T1055.005,Thread Local Storage,Defense Evasion|Privilege Escalation,no
T1055.004,Asynchronous Procedure Call,Defense Evasion|Privilege Escalation,no
T1055.003,Thread Execution Hijacking,Defense Evasion|Privilege Escalation,no
T1055.002,Portable Executable Injection,Defense Evasion|Privilege Escalation,Rocke|Gorgon Group
T1055.001,Dynamic-link Library Injection,Defense Evasion|Privilege Escalation,TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda
T1055.001,Dynamic-link Library Injection,Defense Evasion|Privilege Escalation,Wizard Spider|TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda
T1037.003,Network Logon Script,Persistence|Privilege Escalation,no
T1543,Create or Modify System Process,Persistence|Privilege Escalation,no
T1037.002,Logon Script (Mac),Persistence|Privilege Escalation,no
@@ -285,13 +408,13 @@ T1037.001,Logon Script (Windows),Persistence|Privilege Escalation,Cobalt Group|A
T1542.003,Bootkit,Persistence|Defense Evasion,APT41|Lazarus Group|APT28
T1542.002,Component Firmware,Persistence|Defense Evasion,Equation
T1542.001,System Firmware,Persistence|Defense Evasion,no
T1505.003,Web Shell,Persistence,Tropic Trooper|Soft Cell|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda
T1505.003,Web Shell,Persistence,Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda
T1505.002,Transport Agent,Persistence,no
T1505.001,SQL Stored Procedures,Persistence,no
T1053.003,Cron,Execution|Persistence|Privilege Escalation,Rocke
T1053.004,Launchd,Execution|Persistence|Privilege Escalation,no
T1053.001,At (Linux),Execution|Persistence|Privilege Escalation,no
T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|Machete|Soft Cell|Silence|TEMP.Veles|APT33|APT39|Dragonfly 2.0|Patchwork|OilRig|Rancor|Cobalt Group|FIN8|menuPass|FIN10|APT32|FIN7|Stealth Falcon|FIN6|APT3|APT29
T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,Mustang Panda|Higaisa|UNC2452|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|Dragonfly 2.0|Rancor|Cobalt Group|OilRig|Patchwork|FIN8|FIN7|menuPass|FIN10|APT32|Stealth Falcon|FIN6|APT3|APT29
T1053.002,At (Windows),Execution|Persistence|Privilege Escalation,BRONZE BUTLER|Threat Group-3390|APT18
T1542,Pre-OS Boot,Defense Evasion|Persistence,no
T1137.001,Office Template Macros,Persistence,MuddyWater
@@ -301,140 +424,141 @@ T1137.005,Outlook Rules,Persistence,no
T1137.006,Add-ins,Persistence,Naikon
T1137.002,Office Test,Persistence,APT28
T1531,Account Access Removal,Impact,no
T1539,Steal Web Session Cookie,Credential Access,no
T1539,Steal Web Session Cookie,Credential Access,Evilnum
T1529,System Shutdown/Reboot,Impact,Lazarus Group|APT38|APT37
T1518,Software Discovery,Discovery,BRONZE BUTLER|Tropic Trooper|Inception
T1518,Software Discovery,Discovery,Mustang Panda|Windshift|MuddyWater|Windigo|Sidewinder|Operation Wocao|BRONZE BUTLER|Tropic Trooper|Inception
T1547.013,XDG Autostart Entries,Persistence|Privilege Escalation,no
T1534,Internal Spearphishing,Lateral Movement,Gamaredon Group
T1528,Steal Application Access Token,Credential Access,APT28
T1535,Unused/Unsupported Cloud Regions,Defense Evasion,no
T1525,Implant Container Image,Persistence,no
T1525,Implant Internal Image,Persistence,no
T1538,Cloud Service Dashboard,Discovery,no
T1530,Data from Cloud Storage Object,Collection,no
T1530,Data from Cloud Storage Object,Collection,Fox Kitten
T1578,Modify Cloud Compute Infrastructure,Defense Evasion,no
T1537,Transfer Data to Cloud Account,Exfiltration,no
T1526,Cloud Service Discovery,Discovery,no
T1505,Server Software Component,Persistence,no
T1499,Endpoint Denial of Service,Impact,no
T1497,Virtualization/Sandbox Evasion,Defense Evasion|Discovery,no
T1498,Network Denial of Service,Impact,no
T1499,Endpoint Denial of Service,Impact,Sandworm Team
T1497,Virtualization/Sandbox Evasion,Defense Evasion|Discovery,Darkhotel
T1498,Network Denial of Service,Impact,APT28
T1496,Resource Hijacking,Impact,Blue Mockingbird|Rocke|APT41|Lazarus Group
T1495,Firmware Corruption,Impact,no
T1491,Defacement,Impact,no
T1490,Inhibit System Recovery,Impact,no
T1489,Service Stop,Impact,Lazarus Group
T1486,Data Encrypted for Impact,Impact,APT41|TA505|APT38
T1489,Service Stop,Impact,Wizard Spider|Lazarus Group
T1486,Data Encrypted for Impact,Impact,Indrik Spider|APT41|TA505|APT38
T1485,Data Destruction,Impact,Sandworm Team|Lazarus Group|APT38
T1484,Group Policy Modification,Defense Evasion|Privilege Escalation,no
T1482,Domain Trust Discovery,Discovery,Wizard Spider
T1484,Domain Policy Modification,Defense Evasion|Privilege Escalation,no
T1482,Domain Trust Discovery,Discovery,APT29|Chimera|UNC2452
T1480,Execution Guardrails,Defense Evasion,no
T1222,File and Directory Permissions Modification,Defense Evasion,no
T1221,Template Injection,Defense Evasion,Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus
T1220,XSL Script Processing,Defense Evasion,Cobalt Group
T1197,BITS Jobs,Defense Evasion|Persistence,Patchwork|APT41|Leviathan
T1217,Browser Bookmark Discovery,Discovery,no
T1213,Data from Information Repositories,Collection,Turla
T1189,Drive-by Compromise,Initial Access,Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|BRONZE BUTLER|Leafminer|Dark Caracal|APT19|APT32|Lazarus Group|Threat Group-3390|Elderwood|APT37|Patchwork|PLATINUM
T1203,Exploitation for Client Execution,Execution,Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|Lazarus Group|BRONZE BUTLER|Cobalt Group|APT37|Patchwork|Leviathan|Elderwood|TA459|APT29
T1220,XSL Script Processing,Defense Evasion,Higaisa|Cobalt Group
T1222,File and Directory Permissions Modification,Defense Evasion,no
T1189,Drive-by Compromise,Initial Access,Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|Lazarus Group|BRONZE BUTLER|Threat Group-3390|Dragonfly 2.0|APT32|Leafminer|APT19|Dark Caracal|Elderwood|Patchwork|PLATINUM|APT37
T1207,Rogue Domain Controller,Defense Evasion,no
T1199,Trusted Relationship,Initial Access,Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass
T1197,BITS Jobs,Defense Evasion|Persistence,APT39|Patchwork|APT41|Leviathan
T1217,Browser Bookmark Discovery,Discovery,Chimera|Fox Kitten
T1213,Data from Information Repositories,Collection,Fox Kitten|FIN6|Turla
T1212,Exploitation for Credential Access,Credential Access,no
T1211,Exploitation for Defense Evasion,Defense Evasion,APT28
T1190,Exploit Public-Facing Application,Initial Access,Blue Mockingbird|Rocke|APT39|BlackTech|APT41|Soft Cell|Night Dragon|Axiom
T1210,Exploitation of Remote Services,Lateral Movement,Threat Group-3390|APT28
T1202,Indirect Command Execution,Defense Evasion,no
T1200,Hardware Additions,Initial Access,DarkVishnya
T1201,Password Policy Discovery,Discovery,Turla|OilRig
T1219,Remote Access Software,Command And Control,Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak
T1207,Rogue Domain Controller,Defense Evasion,no
T1199,Trusted Relationship,Initial Access,APT28|menuPass
T1218,Signed Binary Proxy Execution,Defense Evasion,no
T1202,Indirect Command Execution,Defense Evasion,no
T1201,Password Policy Discovery,Discovery,Chimera|Turla|OilRig
T1190,Exploit Public-Facing Application,Initial Access,Volatile Cedar|UNC2452|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom
T1210,Exploitation of Remote Services,Lateral Movement,Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28
T1219,Remote Access Software,Command And Control,Mustang Panda|MuddyWater|Evilnum|GOLD SOUTHFIELD|Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak
T1195,Supply Chain Compromise,Initial Access,no
T1204,User Execution,Execution,no
T1216,Signed Script Proxy Execution,Defense Evasion,no
T1195,Supply Chain Compromise,Initial Access,Elderwood
T1203,Exploitation for Client Execution,Execution,Mustang Panda|Darkhotel|Higaisa|HAFNIUM|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Cobalt Group|Lazarus Group|APT29|TA459|APT37|Leviathan|Patchwork|Elderwood
T1218,Signed Binary Proxy Execution,Defense Evasion,no
T1205,Traffic Signaling,Defense Evasion|Persistence|Command And Control,no
T1216,Signed Script Proxy Execution,Defense Evasion,no
T1176,Browser Extensions,Persistence,Kimsuky|Stolen Pencil
T1175,Component Object Model and Distributed COM,Lateral Movement|Execution,no
T1187,Forced Authentication,Credential Access,DarkHydrus|Dragonfly 2.0
T1187,Forced Authentication,Credential Access,Dragonfly 2.0|DarkHydrus
T1185,Man in the Browser,Collection,no
T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,Blue Mockingbird
T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,FIN6|Blue Mockingbird
T1136,Create Account,Persistence,no
T1140,Deobfuscate/Decode Files or Information,Defense Evasion,Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|menuPass|Honeybee|Threat Group-3390|APT19|Gorgon Group|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER
T1149,LC_MAIN Hijacking,Defense Evasion,no
T1135,Network Share Discovery,Discovery,APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug
T1137,Office Application Startup,Persistence,Gamaredon Group|APT32
T1140,Deobfuscate/Decode Files or Information,Defense Evasion,APT39|APT29|ZIRCONIUM|Higaisa|UNC2452|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|Threat Group-3390|menuPass|Gorgon Group|Honeybee|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER
T1135,Network Share Discovery,Discovery,Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug
T1153,Source,Execution,no
T1133,External Remote Services,Persistence|Initial Access,Sandworm Team|APT41|Soft Cell|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18
T1133,External Remote Services,Persistence|Initial Access,APT29|UNC2452|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18
T1132,Data Encoding,Command And Control,no
T1129,Shared Modules,Execution,no
T1127,Trusted Developer Utilities Proxy Execution,Defense Evasion,no
T1125,Video Capture,Collection,Silence|FIN7
T1124,System Time Discovery,Discovery,The White Company|Lazarus Group|BRONZE BUTLER|Turla
T1124,System Time Discovery,Discovery,Darkhotel|ZIRCONIUM|Higaisa|Sidewinder|Chimera|Operation Wocao|The White Company|Lazarus Group|BRONZE BUTLER|Turla
T1123,Audio Capture,Collection,APT37
T1120,Peripheral Device Discovery,Discovery,Turla|APT37|Gamaredon Group|Equation|APT28
T1119,Automated Collection,Collection,Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6
T1115,Clipboard Data,Collection,APT39|APT38
T1114,Email Collection,Collection,no
T1113,Screen Capture,Collection,Gamaredon Group|APT39|Silence|MuddyWater|Dragonfly 2.0|OilRig|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28
T1112,Modify Registry,Defense Evasion,Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Honeybee|Patchwork|Gorgon Group|FIN8
T1111,Two-Factor Authentication Interception,Credential Access,no
T1110,Brute Force,Credential Access,DarkVishnya|APT39|OilRig|FIN5|Turla
T1120,Peripheral Device Discovery,Discovery,Operation Wocao|Turla|APT37|Gamaredon Group|Equation|APT28
T1119,Automated Collection,Collection,Mustang Panda|Sidewinder|Chimera|menuPass|Operation Wocao|Gamaredon Group|Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6
T1115,Clipboard Data,Collection,Operation Wocao|APT39|APT38
T1114,Email Collection,Collection,Silent Librarian
T1113,Screen Capture,Collection,GOLD SOUTHFIELD|Gamaredon Group|APT39|Silence|MuddyWater|OilRig|Dragonfly 2.0|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28
T1112,Modify Registry,Defense Evasion,Operation Wocao|Kimsuky|Lazarus Group|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Patchwork|Gorgon Group|Dragonfly 2.0|APT19|Threat Group-3390|Honeybee|FIN8
T1111,Two-Factor Authentication Interception,Credential Access,Chimera|Operation Wocao
T1110,Brute Force,Credential Access,APT28|Fox Kitten|DarkVishnya|APT39|OilRig|FIN5|Turla
T1108,Redundant Access,Defense Evasion|Persistence,no
T1106,Native API,Execution,Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|Gorgon Group|APT37
T1105,Ingress Tool Transfer,Command And Control,Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|Soft Cell|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Turla|Gorgon Group|OilRig|Dragonfly 2.0|APT37|FIN8|PLATINUM|Leviathan|Elderwood|Magic Hound|APT3|APT32|BRONZE BUTLER|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28
T1106,Native API,Execution,Higaisa|menuPass|Operation Wocao|Chimera|Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|APT37|Gorgon Group
T1105,Ingress Tool Transfer,Command And Control,HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|UNC2452|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Turla|OilRig|Rancor|Cobalt Group|Gorgon Group|Dragonfly 2.0|APT37|Elderwood|Leviathan|FIN8|PLATINUM|Magic Hound|BRONZE BUTLER|APT3|APT32|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28
T1104,Multi-Stage Channels,Command And Control,APT41|MuddyWater|APT3
T1102,Web Service,Command And Control,Gamaredon Group|Rocke|Inception|FIN6
T1102,Web Service,Command And Control,Fox Kitten|Turla|APT32|Gamaredon Group|Rocke|Inception|FIN6
T1098,Account Manipulation,Persistence,APT3|Dragonfly 2.0|Lazarus Group
T1095,Non-Application Layer Protocol,Command And Control,APT29|PLATINUM|APT3
T1095,Non-Application Layer Protocol,Command And Control,HAFNIUM|Operation Wocao|FIN6|APT29|PLATINUM|APT3
T1092,Communication Through Removable Media,Command And Control,APT28
T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Tropic Trooper|Darkhotel|APT28
T1090,Proxy,Command And Control,Sandworm Team|Blue Mockingbird|Wizard Spider|APT41|Turla
T1087,Account Discovery,Discovery,no
T1083,File and Directory Discovery,Discovery,Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dark Caracal|Dragonfly 2.0|Magic Hound|Sowbug|BRONZE BUTLER|APT3|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang
T1082,System Information Discovery,Discovery,Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|Honeybee|APT19|APT37|APT32|Magic Hound|OilRig|APT3|Sowbug|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang
T1080,Taint Shared Content,Lateral Movement,BRONZE BUTLER|Darkhotel
T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Sandworm Team|Wizard Spider|Silence|APT41|Soft Cell|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|Leviathan|APT33|OilRig|FIN5|menuPass|APT28|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak
T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Mustang Panda|Tropic Trooper|Darkhotel|APT28
T1090,Proxy,Command And Control,Windigo|Fox Kitten|Operation Wocao|Sandworm Team|Blue Mockingbird|APT41|Turla
T1087,Account Discovery,Discovery,APT29|UNC2452
T1083,File and Directory Discovery,Discovery,APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|UNC2452|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dragonfly 2.0|Dark Caracal|Sowbug|APT3|Magic Hound|BRONZE BUTLER|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang
T1082,System Information Discovery,Discovery,APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|UNC2452|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT32|APT37|Honeybee|APT19|Magic Hound|Sowbug|OilRig|APT3|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang
T1080,Taint Shared Content,Lateral Movement,Gamaredon Group|BRONZE BUTLER|Darkhotel
T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT29|Silent Librarian|UNC2452|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|APT33|Leviathan|FIN8|OilRig|FIN5|menuPass|APT28|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak
T1074,Data Staged,Collection,Wizard Spider
T1072,Software Deployment Tools,Execution|Lateral Movement,Silence|APT32|Threat Group-1314
T1071,Application Layer Protocol,Command And Control,Rocke|Magic Hound|Dragonfly 2.0
T1070,Indicator Removal on Host,Defense Evasion,no
T1069,Permission Groups Discovery,Discovery,TA505|APT3
T1068,Exploitation for Privilege Escalation,Privilege Escalation,Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28
T1070,Indicator Removal on Host,Defense Evasion,APT29|UNC2452
T1069,Permission Groups Discovery,Discovery,APT29|UNC2452|TA505|APT3
T1068,Exploitation for Privilege Escalation,Privilege Escalation,ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28
T1064,Scripting,Defense Evasion|Execution,no
T1062,Hypervisor,Persistence,no
T1061,Graphical User Interface,Execution,no
T1059,Command and Scripting Interpreter,Execution,APT32|Molerats|Whitefly|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang
T1057,Process Discovery,Discovery,Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang
T1056,Input Capture,Collection|Credential Access,no
T1055,Process Injection,Defense Evasion|Privilege Escalation,APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM
T1059,Command and Scripting Interpreter,Execution,Windigo|Fox Kitten|APT32|Whitefly|APT39|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang
T1057,Process Discovery,Discovery,APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|UNC2452|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang
T1056,Input Capture,Collection|Credential Access,APT39
T1055,Process Injection,Defense Evasion|Privilege Escalation,Operation Wocao|APT32|Sharpshooter|Silence|APT41|Kimsuky|APT37|Cobalt Group|Turla|Honeybee|PLATINUM
T1053,Scheduled Task/Job,Execution|Persistence|Privilege Escalation,no
T1052,Exfiltration Over Physical Medium,Exfiltration,no
T1051,Shared Webroot,Lateral Movement,no
T1049,System Network Connections Discovery,Discovery,Tropic Trooper|APT41|APT38|Soft Cell|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang
T1049,System Network Connections Discovery,Discovery,Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|APT3|OilRig|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang
T1048,Exfiltration Over Alternative Protocol,Exfiltration,no
T1047,Windows Management Instrumentation,Execution,Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|Soft Cell|APT32|MuddyWater|OilRig|Threat Group-3390|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda
T1046,Network Service Scanning,Discovery,Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|Leafminer|OilRig|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390
T1043,Commonly Used Port,Command And Control,Machete|OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|Dragonfly 2.0|FIN7|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390
T1041,Exfiltration Over C2 Channel,Exfiltration,Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|Soft Cell|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang
T1040,Network Sniffing,Credential Access|Discovery,Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28
T1039,Data from Network Shared Drive,Collection,Sowbug|BRONZE BUTLER|menuPass
T1047,Windows Management Instrumentation,Execution,Mustang Panda|Windshift|UNC2452|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|Threat Group-3390|OilRig|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda
T1046,Network Service Scanning,Discovery,Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|Cobalt Group|OilRig|Leafminer|menuPass|Suckfly|FIN6|Threat Group-3390
T1043,Commonly Used Port,Command And Control,OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|FIN7|Dragonfly 2.0|FIN8|APT37|APT3|Magic Hound|Lazarus Group|Threat Group-3390
T1041,Exfiltration Over C2 Channel,Exfiltration,ZIRCONIUM|Higaisa|Chimera|APT39|Operation Wocao|Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|GALLIUM|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang
T1040,Network Sniffing,Credential Access|Discovery,Kimsuky|Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28
T1039,Data from Network Shared Drive,Collection,Chimera|Fox Kitten|Gamaredon Group|BRONZE BUTLER|Sowbug|menuPass
T1037,Boot or Logon Initialization Scripts,Persistence|Privilege Escalation,Rocke
T1036,Masquerading,Defense Evasion,Windshift|APT32|BRONZE BUTLER|menuPass|Dragonfly 2.0
T1036,Masquerading,Defense Evasion,APT29|Mustang Panda|ZIRCONIUM|TA551|UNC2452|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM|Dragonfly 2.0
T1034,Path Interception,Persistence|Privilege Escalation,no
T1033,System Owner/User Discovery,Discovery,Frankenstein|APT41|Soft Cell|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3
T1033,System Owner/User Discovery,Discovery,Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|Dragonfly 2.0|APT37|APT19|APT32|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3
T1030,Data Transfer Size Limits,Exfiltration,Threat Group-3390
T1029,Scheduled Transfer,Exfiltration,no
T1027,Obfuscated Files or Information,Defense Evasion,Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|Machete|Soft Cell|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Cobalt Group|Patchwork|Leafminer|APT37|Threat Group-3390|Honeybee|Dark Caracal|menuPass|APT19|BlackOasis|FIN8|Leviathan|Elderwood|MuddyWater|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28
T1029,Scheduled Transfer,Exfiltration,Higaisa
T1027,Obfuscated Files or Information,Defense Evasion,APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Cobalt Group|Patchwork|APT37|Honeybee|Dark Caracal|Leafminer|menuPass|Threat Group-3390|APT19|BlackOasis|FIN8|FIN7|Elderwood|MuddyWater|Leviathan|Magic Hound|OilRig|APT3|APT32|Group5|Lazarus Group|Dust Storm|Putter Panda|APT28
T1026,Multiband Communication,Command And Control,Lazarus Group
T1025,Data from Removable Media,Collection,Machete|Turla|Gamaredon Group|APT28
T1025,Data from Removable Media,Collection,Turla|Gamaredon Group|APT28
T1021,Remote Services,Lateral Movement,no
T1020,Automated Exfiltration,Exfiltration,Tropic Trooper|Frankenstein|Honeybee
T1018,Remote System Discovery,Discovery,Sandworm Team|Rocke|Wizard Spider|Silence|Soft Cell|APT39|APT32|Deep Panda|Threat Group-3390|Dragonfly 2.0|Leafminer|Ke3chang|FIN8|APT3|FIN5|BRONZE BUTLER|menuPass|FIN6|Turla
T1016,System Network Configuration Discovery,Discovery,Sandworm Team|Tropic Trooper|Frankenstein|APT41|Soft Cell|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang
T1020,Automated Exfiltration,Exfiltration,Sidewinder|Gamaredon Group|Tropic Trooper|Frankenstein|Honeybee
T1018,Remote System Discovery,Discovery,APT29|UNC2452|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Deep Panda|Dragonfly 2.0|Threat Group-3390|Leafminer|Ke3chang|FIN8|BRONZE BUTLER|FIN5|APT3|menuPass|FIN6|Turla
T1016,System Network Configuration Discovery,Discovery,ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|OilRig|Magic Hound|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang
T1014,Rootkit,Defense Evasion,Rocke|APT41|APT28|Winnti Group
T1012,Query Registry,Discovery,APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla
T1012,Query Registry,Discovery,ZIRCONIUM|Chimera|Fox Kitten|APT39|Operation Wocao|APT32|Threat Group-3390|Dragonfly 2.0|OilRig|Stealth Falcon|Lazarus Group|Turla
T1011,Exfiltration Over Other Network Medium,Exfiltration,no
T1010,Application Window Discovery,Discovery,Lazarus Group
T1008,Fallback Channels,Command And Control,APT41|OilRig|Lazarus Group
T1007,System Service Discovery,Discovery,BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang
T1008,Fallback Channels,Command And Control,Carbanak|APT41|OilRig|Lazarus Group
T1007,System Service Discovery,Discovery,Chimera|Operation Wocao|BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang
T1006,Direct Volume Access,Defense Evasion,no
T1005,Data from Local System,Collection,Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|Soft Cell|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang
T1005,Data from Local System,Collection,APT29|Windigo|UNC2452|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Dragonfly 2.0|Dark Caracal|Honeybee|APT37|APT28|BRONZE BUTLER|APT3|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang
T1003,OS Credential Dumping,Credential Access,APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom
T1001,Data Obfuscation,Command And Control,Axiom
T1001,Data Obfuscation,Command And Control,Operation Wocao|Axiom
1 mitre_id technique tactics groups
2 T1205.001 T1553.006 Port Knocking Code Signing Policy Modification Defense Evasion|Persistence|Command And Control Defense Evasion no Turla|APT39
3 T1614 System Location Discovery Discovery no
4 T1613 Container and Resource Discovery Discovery no
5 T1552.007 Container API Credential Access no
6 T1612 Build Image on Host Defense Evasion no
7 T1611 Escape to Host Privilege Escalation no
8 T1204.003 Malicious Image Execution no
9 T1053.007 Container Orchestration Job Execution|Persistence|Privilege Escalation no
10 T1610 Deploy Container Defense Evasion|Execution no
11 T1609 Container Administration Command Execution no
12 T1608.005 Link Target Resource Development Silent Librarian
13 T1608.004 Drive-by Target Resource Development APT32|Threat Group-3390
14 T1608.003 Install Digital Certificate Resource Development no
15 T1608.002 Upload Tool Resource Development Threat Group-3390
16 T1608.001 Upload Malware Resource Development APT32
17 T1608 Stage Capabilities Resource Development no
18 T1016.001 Internet Connection Discovery Discovery APT29|UNC2452|Turla
19 T1553.005 Mark-of-the-Web Bypass Defense Evasion TA505
20 T1555.005 Password Managers Credential Access Fox Kitten|Operation Wocao
21 T1484.002 Domain Trust Modification Defense Evasion|Privilege Escalation APT29|UNC2452
22 T1484.001 Group Policy Modification Defense Evasion|Privilege Escalation Indrik Spider
23 T1547.014 Active Setup Persistence|Privilege Escalation no
24 T1606.002 SAML Tokens Credential Access APT29|UNC2452
25 T1606.001 Web Cookies Credential Access APT29|UNC2452
26 T1606 Forge Web Credentials Credential Access no
27 T1555.004 Windows Credential Manager Credential Access Stealth Falcon|OilRig|Turla
28 T1059.008 Network Device CLI Execution no
29 T1602.002 Network Device Configuration Dump Collection no
30 T1542.005 TFTP Boot Defense Evasion|Persistence no
31 T1542.004 ROMMONkit Defense Evasion|Persistence no
32 T1602.001 SNMP (MIB Dump) Collection no
33 T1602 Data from Configuration Repository Collection no
34 T1601.002 Downgrade System Image Defense Evasion no
35 T1601.001 Patch System Image Defense Evasion no
36 T1601 Modify System Image Defense Evasion no
37 T1600.002 Disable Crypto Hardware Defense Evasion no
38 T1600.001 Reduce Key Space Defense Evasion no
39 T1600 Weaken Encryption Defense Evasion no
40 T1556.004 Network Device Authentication Credential Access|Defense Evasion|Persistence no
41 T1599.001 Network Address Translation Traversal Defense Evasion no
42 T1599 Network Boundary Bridging Defense Evasion no
43 T1020.001 Traffic Duplication Exfiltration no
44 T1557.002 ARP Cache Poisoning Credential Access|Collection Cleaver
45 T1588.006 Vulnerabilities Resource Development Sandworm Team
46 T1053.006 Systemd Timers Execution|Persistence|Privilege Escalation no
47 T1562.008 Disable Cloud Logs Defense Evasion no
48 T1547.012 Print Processors Persistence|Privilege Escalation no
49 T1598.003 Spearphishing Link Reconnaissance Silent Librarian|Sidewinder|Sandworm Team|APT32|Kimsuky
50 T1598.002 Spearphishing Attachment Reconnaissance Sidewinder
51 T1598.001 Spearphishing Service Reconnaissance no
52 T1598 Phishing for Information Reconnaissance ZIRCONIUM|APT28
53 T1597.002 Purchase Technical Data Reconnaissance no
54 T1597.001 Threat Intel Vendors Reconnaissance no
55 T1597 Search Closed Sources Reconnaissance no
56 T1596.005 Scan Databases Reconnaissance no
57 T1596.004 CDNs Reconnaissance no
58 T1596.003 Digital Certificates Reconnaissance no
59 T1596.001 DNS/Passive DNS Reconnaissance no
60 T1596.002 WHOIS Reconnaissance no
61 T1596 Search Open Technical Databases Reconnaissance no
62 T1595.002 Vulnerability Scanning Reconnaissance Volatile Cedar|APT28|Sandworm Team
63 T1595.001 Scanning IP Blocks Reconnaissance no
64 T1595 Active Scanning Reconnaissance no
65 T1594 Search Victim-Owned Websites Reconnaissance Silent Librarian|Sandworm Team
66 T1593.002 Search Engines Reconnaissance no
67 T1593.001 Social Media Reconnaissance no
68 T1593 Search Open Websites/Domains Reconnaissance Sandworm Team
69 T1592.004 Client Configurations Reconnaissance HAFNIUM
70 T1592.003 Firmware Reconnaissance no
71 T1592.002 Software Reconnaissance Sandworm Team
72 T1592.001 Hardware Reconnaissance no
73 T1592 Gather Victim Host Information Reconnaissance no
74 T1591.004 Identify Roles Reconnaissance no
75 T1591.003 Identify Business Tempo Reconnaissance no
76 T1591.001 Determine Physical Locations Reconnaissance no
77 T1591.002 Business Relationships Reconnaissance Sandworm Team
78 T1591 Gather Victim Org Information Reconnaissance no
79 T1590.006 Network Security Appliances Reconnaissance no
80 T1590.005 IP Addresses Reconnaissance HAFNIUM
81 T1590.004 Network Topology Reconnaissance no
82 T1590.003 Network Trust Dependencies Reconnaissance no
83 T1590.002 DNS Reconnaissance no
84 T1590.001 Domain Properties Reconnaissance Sandworm Team
85 T1590 Gather Victim Network Information Reconnaissance HAFNIUM
86 T1589.003 Employee Names Reconnaissance Silent Librarian|Sandworm Team
87 T1589.002 Email Addresses Reconnaissance TA551|MuddyWater|HAFNIUM|APT32|Silent Librarian|Sandworm Team
88 T1589.001 Credentials Reconnaissance APT28|Magic Hound|Chimera
89 T1589 Gather Victim Identity Information Reconnaissance APT32
90 T1588.005 Exploits Resource Development no
91 T1588.004 Digital Certificates Resource Development Lazarus Group|Silent Librarian
92 T1588.003 Code Signing Certificates Resource Development Wizard Spider
93 T1588.002 Tool Resource Development MuddyWater|Silent Librarian|GALLIUM|Sandworm Team
94 T1588.001 Malware Resource Development Turla|APT1
95 T1588 Obtain Capabilities Resource Development no
96 T1587.004 Exploits Resource Development no
97 T1587.003 Digital Certificates Resource Development APT29|PROMETHIUM
98 T1587.002 Code Signing Certificates Resource Development PROMETHIUM|Patchwork
99 T1587.001 Malware Resource Development APT29|Lazarus Group|UNC2452|Sandworm Team|Turla|FIN7|Night Dragon|Cleaver
100 T1587 Develop Capabilities Resource Development Kimsuky
101 T1586.002 Email Accounts Resource Development Magic Hound|Kimsuky
102 T1586.001 Social Media Accounts Resource Development no
103 T1586 Compromise Accounts Resource Development no
104 T1585.002 Email Accounts Resource Development Magic Hound|Silent Librarian|Sandworm Team|APT1
105 T1585.001 Social Media Accounts Resource Development Fox Kitten|Sandworm Team|APT32|Cleaver
106 T1585 Establish Accounts Resource Development Fox Kitten|APT17
107 T1584.006 Web Services Resource Development Turla
108 T1584.005 Botnet Resource Development no
109 T1584.004 Server Resource Development Indrik Spider|Turla|APT16
110 T1584.003 Virtual Private Server Resource Development Turla
111 T1584.002 DNS Server Resource Development no
112 T1584.001 Domains Resource Development APT29|UNC2452|APT1
113 T1583.006 Web Services Resource Development ZIRCONIUM|MuddyWater|HAFNIUM|Lazarus Group|Turla|APT32|APT17|APT29
114 T1583.005 Botnet Resource Development no
115 T1583.004 Server Resource Development GALLIUM|Sandworm Team
116 T1583.003 Virtual Private Server Resource Development HAFNIUM|TEMP.Veles
117 T1583.002 DNS Server Resource Development no
118 T1584 Compromise Infrastructure Resource Development no
119 T1583.001 Domains Resource Development APT29|Mustang Panda|ZIRCONIUM|UNC2452|Lazarus Group|Silent Librarian|menuPass|Sandworm Team|APT32|Kimsuky|APT1|APT28
120 T1583 Acquire Infrastructure Resource Development no
121 T1564.007 VBA Stomping Defense Evasion no
122 T1558.004 AS-REP Roasting Credential Access no
123 T1580 Cloud Infrastructure Discovery Discovery no
124 T1218.012 Verclsid Defense Evasion no
125 T1205.001 Port Knocking Defense Evasion|Persistence|Command And Control PROMETHIUM
126 T1564.006 Run Virtual Instance Defense Evasion no
127 T1564.005 Hidden File System Defense Evasion Strider|Equation
128 T1556.003 Pluggable Authentication Modules Credential Access|Defense Evasion Credential Access|Defense Evasion|Persistence no
129 T1574.012 COR_PROFILER Persistence|Privilege Escalation|Defense Evasion Blue Mockingbird
130 T1562.007 Disable or Modify Cloud Firewall Defense Evasion no
131 T1098.004 SSH Authorized Keys Persistence no
132 T1480.001 Environmental Keying Defense Evasion APT41|Equation
133 T1059.007 JavaScript/JScript JavaScript Execution APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer MuddyWater|Turla|Higaisa|Sidewinder|Evilnum|Kimsuky|FIN6|APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer
134 T1578.004 Revert Cloud Instance Defense Evasion no
135 T1578.003 Delete Cloud Instance Defense Evasion no
136 T1578.001 Create Snapshot Defense Evasion no
137 T1578.002 Create Cloud Instance Defense Evasion no
138 T1127.001 MSBuild Defense Evasion Frankenstein
139 T1027.005 Indicator Removal from Tools Defense Evasion Soft Cell|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda
140 T1562.006 Indicator Blocking Defense Evasion no
141 T1573.002 Asymmetric Cryptography Command And Control Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6 Operation Wocao|Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6
142 T1573.001 Symmetric Cryptography Command And Control Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group Mustang Panda|Darkhotel|ZIRCONIUM|Higaisa|Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group
143 T1573 Encrypted Channel Command And Control Tropic Trooper
144 T1027.004 Compile After Delivery Defense Evasion Gamaredon Group|Rocke|MuddyWater
145 T1574.004 Dylib Hijacking Persistence|Privilege Escalation|Defense Evasion no
146 T1546.015 Component Object Model Hijacking Privilege Escalation|Persistence APT28
147 T1071.004 DNS Command And Control APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7 Chimera|APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7
148 T1071.003 Mail Protocols Command And Control APT32|SilverTerrier|APT28 Turla|Kimsuky|APT32|SilverTerrier|APT28
149 T1071.002 File Transfer Protocols Command And Control APT41|SilverTerrier|Machete|Honeybee Kimsuky|APT41|SilverTerrier|Honeybee
150 T1071.001 Web Protocols Command And Control Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|Machete|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Cobalt Group|APT19|Threat Group-3390|Rancor|Orangeworm|APT37|Ke3chang|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|APT32|OilRig|Magic Hound|Gamaredon Group|Stealth Falcon APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|UNC2452|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Ke3chang|Orangeworm|APT19|Cobalt Group|Threat Group-3390|Rancor|APT37|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|Magic Hound|APT32|OilRig|Gamaredon Group|Stealth Falcon
151 T1572 Protocol Tunneling Command And Control OilRig|Cobalt Group|FIN6 Chimera|Fox Kitten|OilRig|Cobalt Group|FIN6
152 T1048.003 Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol Exfiltration APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group Wizard Spider|FIN6|APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group
153 T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol Exfiltration no APT29|UNC2452
154 T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol Exfiltration no
155 T1001.003 Protocol Impersonation Command And Control Lazarus Group Higaisa|Lazarus Group
156 T1001.002 Steganography Command And Control Axiom APT29|Axiom
157 T1001.001 Junk Data Command And Control APT28
158 T1132.002 Non-Standard Encoding Command And Control no
159 T1132.001 Standard Encoding Command And Control Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork HAFNIUM|TA551|Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork
160 T1090.004 Domain Fronting Command And Control APT29
161 T1090.003 Multi-hop Proxy Command And Control Inception|FIN4|APT29 APT28|Operation Wocao|Inception|FIN4|APT29
162 T1090.002 External Proxy Command And Control APT39|Silence|Soft Cell|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28 APT39|Silence|GALLIUM|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28
163 T1090.001 Internal Proxy Command And Control APT39|Strider APT29|Higaisa|UNC2452|Operation Wocao|APT39|Strider
164 T1102.003 One-Way Communication Command And Control Leviathan
165 T1102.002 Bidirectional Communication Command And Control Sandworm Team|APT39|APT12|Turla|FIN7|APT37|Magic Hound|Carbanak ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|FIN7|Turla|APT37|Magic Hound|Carbanak
166 T1102.001 Dead Drop Resolver Command And Control Rocke|APT41|BRONZE BUTLER|RTM|Patchwork
167 T1571 Non-Standard Port Command And Control Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7
168 T1074.002 Remote Data Staging Collection Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8 APT29|Chimera|UNC2452|Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8
169 T1074.001 Local Data Staging Collection Machete|Soft Cell|TEMP.Veles|Patchwork|Dragonfly 2.0|Honeybee|Leviathan|APT3|FIN5|menuPass|FIN6|Lazarus Group|Threat Group-3390|APT28 Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|Honeybee|Dragonfly 2.0|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28
170 T1078.004 Cloud Accounts Defense Evasion|Persistence|Privilege Escalation|Initial Access APT33
171 T1564.004 NTFS File Attributes Defense Evasion APT32
172 T1564.003 Hidden Window Defense Evasion Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound Higaisa|Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound
173 T1078.003 Local Accounts Defense Evasion|Persistence|Privilege Escalation|Initial Access Tropic Trooper|FIN10|Stolen Pencil|APT32 HAFNIUM|Turla|Operation Wocao|PROMETHIUM|Tropic Trooper|FIN10|Stolen Pencil|APT32
174 T1078.002 Domain Accounts Defense Evasion|Persistence|Privilege Escalation|Initial Access TA505|APT3|Threat Group-1314 Indrik Spider|Chimera|Operation Wocao|Sandworm Team|Wizard Spider|APT29|TA505|APT3|Threat Group-1314
175 T1078.001 Default Accounts Defense Evasion|Persistence|Privilege Escalation|Initial Access no
176 T1564.002 Hidden Users Defense Evasion no
177 T1574.006 LD_PRELOAD Dynamic Linker Hijacking Persistence|Privilege Escalation|Defense Evasion Rocke APT41|Rocke
178 T1574.002 DLL Side-Loading Persistence|Privilege Escalation|Defense Evasion BRONZE BUTLER|Naikon|APT41|Soft Cell|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390 Mustang Panda|Higaisa|BlackTech|Sidewinder|Chimera|BRONZE BUTLER|Naikon|APT41|GALLIUM|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390
179 T1574.001 DLL Search Order Hijacking Persistence|Privilege Escalation|Defense Evasion Whitefly|RTM|Threat Group-3390|menuPass Evilnum|APT41|Whitefly|RTM|Threat Group-3390|menuPass
180 T1574.008 Path Interception by Search Order Hijacking Persistence|Privilege Escalation|Defense Evasion no
181 T1574.007 Path Interception by PATH Environment Variable Persistence|Privilege Escalation|Defense Evasion no
182 T1574.009 Path Interception by Unquoted Path Persistence|Privilege Escalation|Defense Evasion no
184 T1574.005 Executable Installer File Permissions Weakness Persistence|Privilege Escalation|Defense Evasion no
185 T1574.010 Services File Permissions Weakness Persistence|Privilege Escalation|Defense Evasion no
186 T1574 Hijack Execution Flow Persistence|Privilege Escalation|Defense Evasion no
187 T1069.001 Local Groups Discovery Turla|OilRig|admin@338 Chimera|Operation Wocao|Turla|OilRig|admin@338
188 T1570 Lateral Tool Transfer Lateral Movement APT32|Wizard Spider|Turla|FIN10 Chimera|GALLIUM|Operation Wocao|APT32|Wizard Spider|Turla|FIN10
189 T1568.003 DNS Calculation Command And Control APT12
190 T1204.002 Malicious File Execution Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|APT19|Dragonfly 2.0|BRONZE BUTLER|Cobalt Group|DarkHydrus|Gorgon Group|Patchwork|OilRig|Dark Caracal|MuddyWater|Lazarus Group|FIN7|APT32|Rancor|APT37|FIN8|APT28|Elderwood|TA459|APT29|Leviathan|menuPass|PLATINUM Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Dragonfly 2.0|Dark Caracal|Cobalt Group|DarkHydrus|OilRig|Rancor|BRONZE BUTLER|FIN7|APT19|Patchwork|APT32|Gorgon Group|MuddyWater|Lazarus Group|APT37|TA459|Leviathan|APT29|APT28|FIN8|Elderwood|PLATINUM|menuPass
191 T1204.001 Malicious Link Execution Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|Turla|APT33
192 T1195.003 Compromise Hardware Supply Chain Initial Access no
193 T1195.002 Compromise Software Supply Chain Initial Access Sandworm Team|APT41 APT29|UNC2452|Cobalt Group|GOLD SOUTHFIELD|Dragonfly|Sandworm Team|APT41
194 T1195.001 Compromise Software Dependencies and Development Tools Initial Access no
195 T1568.001 Fast Flux DNS Command And Control TA505 menuPass|TA505
196 T1052.001 Exfiltration over USB Exfiltration Tropic Trooper Mustang Panda|Tropic Trooper
197 T1569.002 Service Execution Execution Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang Chimera|Operation Wocao|Wizard Spider|Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang
198 T1569.001 Launchctl Execution no
199 T1569 System Services Execution no
200 T1568.002 Domain Generation Algorithms Command And Control APT41 TA551|APT41
201 T1568 Dynamic Resolution Command And Control no APT29|UNC2452
202 T1011.001 Exfiltration Over Bluetooth Exfiltration no
203 T1567.002 Exfiltration to Cloud Storage Exfiltration Leviathan|Turla ZIRCONIUM|HAFNIUM|Chimera|Leviathan|Turla
204 T1567.001 Exfiltration to Code Repository Exfiltration no
205 T1059.006 Python Execution Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete
206 T1059.005 Visual Basic Execution APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|Lazarus Group|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound
207 T1059.004 Unix Shell Execution Rocke|APT41
208 T1059.003 Windows Command Shell Execution TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|Soft Cell|Turla|Silence|APT32|APT39|Darkhotel|MuddyWater|APT18|APT38|Dark Caracal|Gorgon Group|Dragonfly 2.0|Rancor|Ke3chang|APT37|Leviathan|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|Threat Group-3390|menuPass|Gamaredon Group|Suckfly|Patchwork|Threat Group-1314|APT3|admin@338|APT1 APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|UNC2452|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Dragonfly 2.0|Rancor|Gorgon Group|Ke3chang|Dark Caracal|Leviathan|APT37|APT28|FIN8|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|Threat Group-3390|menuPass|Gamaredon Group|Patchwork|Suckfly|Threat Group-1314|APT3|admin@338|APT1
209 T1059.002 AppleScript Execution no
210 T1059.001 PowerShell Execution Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|Soft Cell|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|DarkHydrus|APT28|Thrip|Gorgon Group|Cobalt Group|Dragonfly 2.0|Leviathan|TA459|FIN8|MuddyWater|Magic Hound|OilRig|BRONZE BUTLER|CopyKittens|APT32|FIN7|FIN10|Threat Group-3390|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Lazarus Group|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|APT28|Thrip|Cobalt Group|Turla|APT19|Dragonfly 2.0|Gorgon Group|DarkHydrus|Leviathan|TA459|MuddyWater|FIN8|OilRig|Magic Hound|BRONZE BUTLER|CopyKittens|APT32|FIN10|menuPass|Threat Group-3390|FIN7|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda
211 T1567 Exfiltration Over Web Service Exfiltration no APT28
212 T1497.003 Time Based Evasion Defense Evasion|Discovery no
213 T1497.002 User Activity Based Checks Defense Evasion|Discovery FIN7 Darkhotel|FIN7
214 T1497.001 System Checks Defense Evasion|Discovery Frankenstein Darkhotel|Evilnum|Frankenstein
215 T1498.002 Reflection Amplification Impact no
216 T1498.001 Direct Network Flood Impact no
217 T1566.003 Spearphishing via Service Initial Access Magic Hound|Windshift|FIN6|OilRig|Dark Caracal Ajax Security Team|Lazarus Group|Magic Hound|Windshift|FIN6|OilRig|Dark Caracal
218 T1566.002 Spearphishing Link Initial Access Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Turla|APT28|Cobalt Group|Dragonfly 2.0|OilRig|APT33|Elderwood|Leviathan|Magic Hound|Patchwork|APT29|FIN8 Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Cobalt Group|Turla|APT28|Dragonfly 2.0|OilRig|APT29|APT33|Leviathan|FIN8|Elderwood|Patchwork|Magic Hound
219 T1566.001 Spearphishing Attachment Initial Access Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Turla|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|OilRig|Lazarus Group|APT19|Dragonfly 2.0|BRONZE BUTLER|APT32|FIN8|MuddyWater|APT28|TA459|Leviathan|Patchwork|PLATINUM|Elderwood|APT29|APT37|menuPass Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|OilRig|BRONZE BUTLER|Cobalt Group|FIN7|APT19|Gorgon Group|Rancor|APT32|DarkHydrus|Lazarus Group|Dragonfly 2.0|MuddyWater|APT28|FIN8|Elderwood|APT37|menuPass|TA459|PLATINUM|APT29|Leviathan|Patchwork
220 T1566 Phishing Initial Access no GOLD SOUTHFIELD|Dragonfly
221 T1565.003 Runtime Data Manipulation Impact APT38
222 T1565.002 Transmitted Data Manipulation Impact APT38
223 T1565.001 Stored Data Manipulation Impact FIN4|APT38
224 T1565 Data Manipulation Impact no
225 T1564.001 Hidden Files and Directories Defense Evasion Rocke|APT32|Tropic Trooper|APT28|Lazarus Group Mustang Panda|Rocke|APT32|Tropic Trooper|APT28|Lazarus Group
226 T1564 Hide Artifacts Defense Evasion no
227 T1563.002 RDP Hijacking Lateral Movement no
228 T1563.001 SSH Hijacking Lateral Movement no
229 T1563 Remote Service Session Hijacking Lateral Movement no
230 T1518.001 Security Software Discovery Discovery Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon Windshift|Sidewinder|Operation Wocao|Wizard Spider|Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon
231 T1069.003 Cloud Groups Discovery no
232 T1069.002 Domain Groups Discovery Turla|Wizard Spider|Inception|OilRig|FIN6|Dragonfly 2.0|Ke3chang Turla|Inception|OilRig|Dragonfly 2.0|Ke3chang
233 T1087.004 Cloud Account Discovery no
234 T1087.003 Email Account Discovery Sandworm Team|TA505
235 T1087.002 Domain Account Discovery Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang
236 T1087.001 Local Account Discovery Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338 Chimera|Fox Kitten|Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338
237 T1553.004 Install Root Certificate Defense Evasion no
238 T1562.004 Disable or Modify System Firewall Defense Evasion Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak APT29|UNC2452|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak
239 T1562.003 HISTCONTROL Impair Command History Logging Defense Evasion no
240 T1562.002 Disable Windows Event Logging Defense Evasion Threat Group-3390 APT29|UNC2452|Threat Group-3390
241 T1562.001 Disable or Modify Tools Defense Evasion Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda APT29|MuddyWater|UNC2452|Wizard Spider|FIN6|Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda
242 T1562 Impair Defenses Defense Evasion no
243 T1003.004 LSA Secrets Credential Access OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390
244 T1003.005 Cached Domain Credentials Credential Access OilRig|MuddyWater|Leafminer|APT33
245 T1561.002 Disk Structure Wipe Impact Sandworm Team|Lazarus Group|APT38|APT37
246 T1561.001 Disk Content Wipe Impact Lazarus Group
247 T1561 Disk Wipe Impact no
248 T1560.003 Archive via Custom Method Collection Lazarus Group|Kimsuky|CopyKittens|FIN6 Mustang Panda|Lazarus Group|Kimsuky|CopyKittens|FIN6
249 T1560.002 Archive via Library Collection Lazarus Group|Threat Group-3390
250 T1560.001 Archive via Utility Collection APT41|Soft Cell|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|APT3|Sowbug|menuPass|APT1|Ke3chang APT29|Mustang Panda|HAFNIUM|UNC2452|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|APT1|Ke3chang
251 T1560 Archive Collected Data Collection menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang
252 T1499.004 Application or System Exploitation Impact no
253 T1499.003 Application Exhaustion Flood Impact no
254 T1499.002 Service Exhaustion Flood Impact no
255 T1499.001 OS Exhaustion Flood Impact no
256 T1491.002 External Defacement Impact no Sandworm Team
257 T1491.001 Internal Defacement Impact Lazarus Group
258 T1114.003 Email Forwarding Rule Collection no Silent Librarian|Kimsuky
259 T1114.002 Remote Email Collection Collection APT1|FIN4|APT28|Dragonfly 2.0|Ke3chang|Leafminer APT29|HAFNIUM|Chimera|UNC2452|APT1|FIN4|Dragonfly 2.0|APT28|Leafminer|Ke3chang
260 T1114.001 Local Email Collection Collection Magic Hound|APT1 Chimera|Magic Hound|APT1
261 T1134.005 SID-History Injection Defense Evasion|Privilege Escalation no
262 T1134.004 Parent PID Spoofing Defense Evasion|Privilege Escalation no
263 T1134.003 Make and Impersonate Token Defense Evasion|Privilege Escalation no
264 T1134.002 Create Process with Token Defense Evasion|Privilege Escalation Turla|Lazarus Group
265 T1134.001 Token Impersonation/Theft Defense Evasion|Privilege Escalation APT28
266 T1213.002 Sharepoint Collection Ke3chang|APT28 Chimera|Ke3chang|APT28
267 T1213.001 Confluence Collection no
268 T1555.003 Credentials from Web Browsers Credential Access Magic Hound|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats Ajax Security Team|ZIRCONIUM|FIN6|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats
269 T1555.002 Securityd Memory Credential Access no
270 T1555.001 Keychain Credential Access no
271 T1559.002 Dynamic Data Exchange Execution Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7 Sidewinder|Sharpshooter|TA505|MuddyWater|Gallmaker|Cobalt Group|Patchwork|APT37|APT28|FIN7
272 T1559.001 Component Object Model Execution Gamaredon Group|MuddyWater
273 T1559 Inter-Process Communication Execution no
274 T1558.002 Silver Ticket Credential Access no
275 T1558.001 Golden Ticket Credential Access Ke3chang
276 T1558 Steal or Forge Kerberos Tickets Credential Access no
277 T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay Credential Access|Collection no Wizard Spider
278 T1557 Man-in-the-Middle Credential Access|Collection no Kimsuky
279 T1556.002 Password Filter DLL Credential Access|Defense Evasion Credential Access|Defense Evasion|Persistence Strider
280 T1556.001 Domain Controller Authentication Credential Access|Defense Evasion Credential Access|Defense Evasion|Persistence no Chimera
281 T1556 Modify Authentication Process Credential Access|Defense Evasion Credential Access|Defense Evasion|Persistence no
282 T1056.004 Credential API Hooking Collection|Credential Access PLATINUM
283 T1056.003 Web Portal Capture Collection|Credential Access no
284 T1056.002 GUI Input Capture Collection|Credential Access FIN4
285 T1056.001 Keylogging Collection|Credential Access APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|Ke3chang|OilRig|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28 Ajax Security Team|Operation Wocao|APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28
286 T1555 Credentials from Password Stores Credential Access APT39|OilRig|MuddyWater|Leafminer|APT33|Turla|Stealth Falcon APT29|Evilnum|UNC2452|FIN6|APT39|OilRig|MuddyWater|Leafminer|APT33|Stealth Falcon
287 T1552.005 Cloud Instance Metadata API Credential Access no
288 T1003.008 /etc/passwd and /etc/shadow Credential Access no
289 T1003.007 Proc Filesystem Credential Access no
290 T1003.006 DCSync Credential Access no APT29|UNC2452|Operation Wocao
291 T1558.003 Kerberoasting Credential Access no APT29|UNC2452|Operation Wocao|Wizard Spider
292 T1552.006 Group Policy Preferences Credential Access APT33
293 T1003.003 NTDS Credential Access FIN6|Dragonfly 2.0 Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6|Dragonfly 2.0
294 T1003.002 Security Account Manager Credential Access Threat Group-3390|Ke3chang|Soft Cell|Night Dragon|Dragonfly 2.0|menuPass Wizard Spider|Threat Group-3390|Ke3chang|GALLIUM|Night Dragon|Dragonfly 2.0|menuPass
295 T1003.001 LSASS Memory Credential Access Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|Soft Cell|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Lazarus Group|Leafminer|Magic Hound|MuddyWater|PLATINUM|FIN8|BRONZE BUTLER|OilRig|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Leafminer|Magic Hound|Lazarus Group|PLATINUM|FIN8|MuddyWater|BRONZE BUTLER|OilRig|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver
296 T1110.004 Credential Stuffing Credential Access no Chimera
297 T1110.003 Password Spraying Credential Access APT33|Leafminer|Lazarus Group Silent Librarian|Chimera|APT28|APT33|Leafminer|Lazarus Group
298 T1110.002 Password Cracking Credential Access APT41|Dragonfly 2.0|APT3 FIN6|APT41|Dragonfly 2.0|APT3
299 T1110.001 Password Guessing Credential Access no APT28
300 T1021.006 Windows Remote Management Lateral Movement Threat Group-3390 APT29|UNC2452|Chimera|Wizard Spider|Threat Group-3390
301 T1021.005 VNC Lateral Movement GCMAN Fox Kitten|GCMAN
302 T1021.004 SSH Lateral Movement Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN Fox Kitten|Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN
303 T1021.003 Distributed Component Object Model Lateral Movement no
304 T1021.002 SMB/Windows Admin Shares Lateral Movement Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang Fox Kitten|APT41|Operation Wocao|Wizard Spider|Chimera|Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang
305 T1021.001 Remote Desktop Protocol Lateral Movement Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|menuPass|FIN10|Patchwork|FIN6|Lazarus Group|APT1|Axiom Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|FIN10|menuPass|Patchwork|FIN6|Lazarus Group|APT1|Axiom
306 T1554 Compromise Client Software Binary Persistence no
307 T1036.006 Space after Filename Defense Evasion no
308 T1036.005 Match Legitimate Name or Location Defense Evasion Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1 APT29|Mustang Panda|Sidewinder|Darkhotel|Lazarus Group|Indrik Spider|UNC2452|Fox Kitten|Machete|Chimera|PROMETHIUM|Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1
309 T1036.004 Masquerade Task or Service Defense Evasion Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7 ZIRCONIUM|APT29|Higaisa|UNC2452|Fox Kitten|Kimsuky|Lazarus Group|PROMETHIUM|Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7
310 T1036.003 Rename System Utilities Defense Evasion menuPass|APT32|Soft Cell|PLATINUM menuPass|APT32|GALLIUM
311 T1036.002 Right-to-Left Override Defense Evasion BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic
312 T1036.001 Invalid Code Signature Defense Evasion Windshift Windshift|APT37
313 T1553.003 SIP and Trust Provider Hijacking Defense Evasion no
314 T1553.002 Code Signing Defense Evasion Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|APT37|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel APT29|GALLIUM|UNC2452|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel
315 T1553.001 Gatekeeper Bypass Defense Evasion no
316 T1553 Subvert Trust Controls Defense Evasion no
317 T1027.003 Steganography Defense Evasion BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37 TA551|BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37
318 T1027.002 Software Packing Defense Evasion TA505|Rocke|Soft Cell|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon ZIRCONIUM|Lazarus Group|TA505|Rocke|GALLIUM|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon
319 T1027.001 Binary Padding Defense Evasion Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee Mustang Panda|Higaisa|Gamaredon Group|APT32|Patchwork|Leviathan|BRONZE BUTLER|Moafee
320 T1222.002 Linux and Mac File and Directory Permissions Modification Defense Evasion Rocke|APT32
321 T1222.001 Windows File and Directory Permissions Modification Defense Evasion no Wizard Spider
322 T1552.004 Private Keys Credential Access Rocke APT29|UNC2452|Operation Wocao|Rocke
323 T1552.003 Bash History Credential Access no
324 T1552.002 Credentials in Registry Credential Access APT32
325 T1552.001 Credentials In Files Credential Access Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3 Fox Kitten|Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3
326 T1552 Unsecured Credentials Credential Access no
327 T1216.001 PubPrn Defense Evasion APT32
328 T1070.006 Timestomp Defense Evasion Rocke|TEMP.Veles|APT32|Lazarus Group|APT28 APT29|UNC2452|Chimera|Kimsuky|Rocke|TEMP.Veles|APT32|Lazarus Group|APT28
329 T1070.005 Network Share Connection Removal Defense Evasion Threat Group-3390
330 T1070.004 File Deletion Defense Evasion Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|FIN10|APT28|Threat Group-3390|Group5|Lazarus Group|APT18|APT29 APT39|Mustang Panda|Chimera|Evilnum|UNC2452|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Honeybee|Patchwork|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|FIN5|BRONZE BUTLER|OilRig|APT3|Magic Hound|APT28|FIN10|Threat Group-3390|Group5|Lazarus Group|APT18|APT29
331 T1070.003 Clear Command History Defense Evasion APT41
332 T1550.004 Web Session Cookie Defense Evasion|Lateral Movement no APT29|UNC2452
333 T1550.001 Application Access Token Defense Evasion|Lateral Movement APT28
334 T1550.003 Pass the Ticket Defense Evasion|Lateral Movement APT32|BRONZE BUTLER|APT29
335 T1550.002 Pass the Hash Defense Evasion|Lateral Movement Soft Cell|APT32|Night Dragon|APT28|APT1 Chimera|Kimsuky|GALLIUM|APT32|Night Dragon|APT28|APT1
336 T1550 Use Alternate Authentication Material Defense Evasion|Lateral Movement no APT29|UNC2452
337 T1548.004 Elevated Execution with Prompt Privilege Escalation|Defense Evasion no
338 T1548.003 Sudo and Sudo Caching Privilege Escalation|Defense Evasion no
339 T1548.002 Bypass User Access Control Bypass User Account Control Privilege Escalation|Defense Evasion APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29 Evilnum|APT37|MuddyWater|Cobalt Group|Honeybee|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29
340 T1548.001 Setuid and Setgid Privilege Escalation|Defense Evasion no
341 T1548 Abuse Elevation Control Mechanism Privilege Escalation|Defense Evasion no
342 T1136.003 Cloud Account Persistence no
343 T1070.002 Clear Linux or Mac System Logs Defense Evasion Rocke
344 T1070.001 Clear Windows Event Logs Defense Evasion APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28 Chimera|Operation Wocao|APT41|APT38|APT32|Dragonfly 2.0|FIN8|FIN5|APT28
345 T1136.002 Domain Account Persistence Soft Cell HAFNIUM|GALLIUM
346 T1136.001 Local Account Persistence APT39|APT41|Dragonfly 2.0|Leafminer|APT3 Fox Kitten|APT39|APT41|Dragonfly 2.0|Leafminer|APT3
347 T1547.011 Plist Modification Persistence|Privilege Escalation no
348 T1547.010 Port Monitors Persistence|Privilege Escalation no
349 T1547.009 Shortcut Modification Persistence|Privilege Escalation APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Leviathan|Lazarus Group
350 T1547.008 LSASS Driver Persistence|Privilege Escalation no
351 T1547.007 Re-opened Applications Persistence|Privilege Escalation no
352 T1547.006 Kernel Modules and Extensions Persistence|Privilege Escalation no
353 T1547.005 Security Support Provider Persistence|Privilege Escalation no Lazarus Group
354 T1547.004 Winlogon Helper DLL Persistence|Privilege Escalation Tropic Trooper|Turla Wizard Spider|Tropic Trooper|Turla
355 T1547.003 Time Providers Persistence|Privilege Escalation no
356 T1546.014 Emond Privilege Escalation|Persistence no
357 T1546.013 PowerShell Profile Privilege Escalation|Persistence Turla
359 T1218.008 Odbcconf Defense Evasion Cobalt Group
360 T1546.011 Application Shimming Privilege Escalation|Persistence FIN7
361 T1547.002 Authentication Package Persistence|Privilege Escalation no
362 T1546.010 AppInit DLLs Privilege Escalation|Persistence no APT39
363 T1546.009 AppCert DLLs Privilege Escalation|Persistence Honeybee
364 T1218.007 Msiexec Defense Evasion TA505|Rancor ZIRCONIUM|Molerats|Machete|TA505|Rancor
365 T1546.008 Accessibility Features Privilege Escalation|Persistence APT41|APT3|APT29|Deep Panda|Axiom Fox Kitten|APT41|APT3|APT29|Deep Panda|Axiom
366 T1546.007 Netsh Helper DLL Privilege Escalation|Persistence no
367 T1546.006 LC_LOAD_DYLIB Addition Privilege Escalation|Persistence no
368 T1546.005 Trap Privilege Escalation|Persistence no
369 T1546.004 .bash_profile and .bashrc Unix Shell Configuration Modification Privilege Escalation|Persistence no
370 T1546.003 Windows Management Instrumentation Event Subscription Privilege Escalation|Persistence APT33|Blue Mockingbird|Turla|Leviathan|APT29 Mustang Panda|UNC2452|APT33|Blue Mockingbird|Turla|Leviathan|APT29
371 T1546.002 Screensaver Privilege Escalation|Persistence no
372 T1546.001 Change Default File Association Privilege Escalation|Persistence Kimsuky
373 T1547.001 Registry Run Keys / Startup Folder Persistence|Privilege Escalation Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Machete|Kimsuky|APT33|APT39|APT32|APT18|Turla|Dark Caracal|Cobalt Group|Honeybee|Threat Group-3390|Dragonfly 2.0|Gorgon Group|Ke3chang|APT19|Leviathan|MuddyWater|APT37|BRONZE BUTLER|Magic Hound|APT3|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Dark Caracal|Threat Group-3390|Turla|Honeybee|APT19|Cobalt Group|Ke3chang|Dragonfly 2.0|Gorgon Group|Leviathan|APT37|MuddyWater|BRONZE BUTLER|APT3|Magic Hound|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel
374 T1218.002 Control Panel Defense Evasion no
375 T1218.010 Regsvr32 Defense Evasion Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda TA551|Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda
376 T1218.009 Regsvcs/Regasm Defense Evasion no
377 T1218.005 Mshta Defense Evasion Inception|Kimsuky|APT32|MuddyWater|FIN7 Mustang Panda|TA551|Sidewinder|Lazarus Group|Inception|Kimsuky|APT32|MuddyWater|FIN7
378 T1218.004 InstallUtil Defense Evasion no Mustang Panda|menuPass
379 T1218.001 Compiled HTML File Defense Evasion APT41|Silence|Lazarus Group|Dark Caracal|OilRig APT41|Silence|Lazarus Group|OilRig|Dark Caracal
380 T1218.003 CMSTP Defense Evasion Cobalt Group|MuddyWater
381 T1218.011 Rundll32 Defense Evasion APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28 HAFNIUM|TA551|UNC2452|APT41|Gamaredon Group|APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28
382 T1547 Boot or Logon Autostart Execution Persistence|Privilege Escalation no
383 T1546 Event Triggered Execution Privilege Escalation|Persistence no
384 T1098.003 Add Office 365 Global Administrator Role Persistence no
385 T1098.002 Exchange Email Delegate Permissions Persistence Magic Hound APT29|UNC2452|Magic Hound
386 T1098.001 Additional Azure Service Principal Credentials Additional Cloud Credentials Persistence no APT29|UNC2452
387 T1543.004 Launch Daemon Persistence|Privilege Escalation no
388 T1543.003 Windows Service Persistence|Privilege Escalation Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|Honeybee|FIN7|Threat Group-3390|APT19|APT3|Lazarus Group|Carbanak PROMETHIUM|Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|FIN7|APT19|Threat Group-3390|Honeybee|APT3|Lazarus Group|Carbanak
389 T1543.002 Systemd Service Persistence|Privilege Escalation Rocke
390 T1543.001 Launch Agent Persistence|Privilege Escalation no
391 T1037.005 Startup Items Persistence|Privilege Escalation no
392 T1037.004 Rc.common RC Scripts Persistence|Privilege Escalation no
393 T1055.012 Process Hollowing Defense Evasion|Privilege Escalation Threat Group-3390|menuPass|Gorgon Group|Patchwork Gorgon Group|Threat Group-3390|menuPass|Patchwork
394 T1055.013 Process Doppelgänging Defense Evasion|Privilege Escalation Leafminer
395 T1055.011 Extra Window Memory Injection Defense Evasion|Privilege Escalation no
396 T1055.014 VDSO Hijacking Defense Evasion|Privilege Escalation no
400 T1055.004 Asynchronous Procedure Call Defense Evasion|Privilege Escalation no
401 T1055.003 Thread Execution Hijacking Defense Evasion|Privilege Escalation no
402 T1055.002 Portable Executable Injection Defense Evasion|Privilege Escalation Rocke|Gorgon Group
403 T1055.001 Dynamic-link Library Injection Defense Evasion|Privilege Escalation TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda Wizard Spider|TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda
404 T1037.003 Network Logon Script Persistence|Privilege Escalation no
405 T1543 Create or Modify System Process Persistence|Privilege Escalation no
406 T1037.002 Logon Script (Mac) Persistence|Privilege Escalation no
408 T1542.003 Bootkit Persistence|Defense Evasion APT41|Lazarus Group|APT28
409 T1542.002 Component Firmware Persistence|Defense Evasion Equation
410 T1542.001 System Firmware Persistence|Defense Evasion no
411 T1505.003 Web Shell Persistence Tropic Trooper|Soft Cell|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda
412 T1505.002 Transport Agent Persistence no
413 T1505.001 SQL Stored Procedures Persistence no
414 T1053.003 Cron Execution|Persistence|Privilege Escalation Rocke
415 T1053.004 Launchd Execution|Persistence|Privilege Escalation no
416 T1053.001 At (Linux) Execution|Persistence|Privilege Escalation no
417 T1053.005 Scheduled Task Execution|Persistence|Privilege Escalation Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|Machete|Soft Cell|Silence|TEMP.Veles|APT33|APT39|Dragonfly 2.0|Patchwork|OilRig|Rancor|Cobalt Group|FIN8|menuPass|FIN10|APT32|FIN7|Stealth Falcon|FIN6|APT3|APT29 Mustang Panda|Higaisa|UNC2452|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|Dragonfly 2.0|Rancor|Cobalt Group|OilRig|Patchwork|FIN8|FIN7|menuPass|FIN10|APT32|Stealth Falcon|FIN6|APT3|APT29
418 T1053.002 At (Windows) Execution|Persistence|Privilege Escalation BRONZE BUTLER|Threat Group-3390|APT18
419 T1542 Pre-OS Boot Defense Evasion|Persistence no
420 T1137.001 Office Template Macros Persistence MuddyWater
424 T1137.006 Add-ins Persistence Naikon
425 T1137.002 Office Test Persistence APT28
426 T1531 Account Access Removal Impact no
427 T1539 Steal Web Session Cookie Credential Access no Evilnum
428 T1529 System Shutdown/Reboot Impact Lazarus Group|APT38|APT37
429 T1518 Software Discovery Discovery BRONZE BUTLER|Tropic Trooper|Inception Mustang Panda|Windshift|MuddyWater|Windigo|Sidewinder|Operation Wocao|BRONZE BUTLER|Tropic Trooper|Inception
430 T1547.013 XDG Autostart Entries Persistence|Privilege Escalation no
431 T1534 Internal Spearphishing Lateral Movement Gamaredon Group
432 T1528 Steal Application Access Token Credential Access APT28
433 T1535 Unused/Unsupported Cloud Regions Defense Evasion no
434 T1525 Implant Container Image Implant Internal Image Persistence no
435 T1538 Cloud Service Dashboard Discovery no
436 T1530 Data from Cloud Storage Object Collection no Fox Kitten
437 T1578 Modify Cloud Compute Infrastructure Defense Evasion no
438 T1537 Transfer Data to Cloud Account Exfiltration no
439 T1526 Cloud Service Discovery Discovery no
440 T1505 Server Software Component Persistence no
441 T1499 Endpoint Denial of Service Impact no Sandworm Team
442 T1497 Virtualization/Sandbox Evasion Defense Evasion|Discovery no Darkhotel
443 T1498 Network Denial of Service Impact no APT28
444 T1496 Resource Hijacking Impact Blue Mockingbird|Rocke|APT41|Lazarus Group
445 T1495 Firmware Corruption Impact no
446 T1491 Defacement Impact no
447 T1490 Inhibit System Recovery Impact no
448 T1489 Service Stop Impact Lazarus Group Wizard Spider|Lazarus Group
449 T1486 Data Encrypted for Impact Impact APT41|TA505|APT38 Indrik Spider|APT41|TA505|APT38
450 T1485 Data Destruction Impact Sandworm Team|Lazarus Group|APT38
451 T1484 Group Policy Modification Domain Policy Modification Defense Evasion|Privilege Escalation no
452 T1482 Domain Trust Discovery Discovery Wizard Spider APT29|Chimera|UNC2452
453 T1480 Execution Guardrails Defense Evasion no
T1222 File and Directory Permissions Modification Defense Evasion no
454 T1221 Template Injection Defense Evasion Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus
455 T1220 XSL Script Processing Defense Evasion Cobalt Group Higaisa|Cobalt Group
456 T1197 T1222 BITS Jobs File and Directory Permissions Modification Defense Evasion|Persistence Defense Evasion Patchwork|APT41|Leviathan no
457 T1217 T1189 Browser Bookmark Discovery Drive-by Compromise Discovery Initial Access no Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|Lazarus Group|BRONZE BUTLER|Threat Group-3390|Dragonfly 2.0|APT32|Leafminer|APT19|Dark Caracal|Elderwood|Patchwork|PLATINUM|APT37
458 T1213 T1207 Data from Information Repositories Rogue Domain Controller Collection Defense Evasion Turla no
459 T1189 T1199 Drive-by Compromise Trusted Relationship Initial Access Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|BRONZE BUTLER|Leafminer|Dark Caracal|APT19|APT32|Lazarus Group|Threat Group-3390|Elderwood|APT37|Patchwork|PLATINUM Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass
460 T1203 T1197 Exploitation for Client Execution BITS Jobs Execution Defense Evasion|Persistence Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|Lazarus Group|BRONZE BUTLER|Cobalt Group|APT37|Patchwork|Leviathan|Elderwood|TA459|APT29 APT39|Patchwork|APT41|Leviathan
461 T1217 Browser Bookmark Discovery Discovery Chimera|Fox Kitten
462 T1213 Data from Information Repositories Collection Fox Kitten|FIN6|Turla
463 T1212 Exploitation for Credential Access Credential Access no
464 T1211 Exploitation for Defense Evasion Defense Evasion APT28
T1190 Exploit Public-Facing Application Initial Access Blue Mockingbird|Rocke|APT39|BlackTech|APT41|Soft Cell|Night Dragon|Axiom
T1210 Exploitation of Remote Services Lateral Movement Threat Group-3390|APT28
T1202 Indirect Command Execution Defense Evasion no
465 T1200 Hardware Additions Initial Access DarkVishnya
466 T1201 T1202 Password Policy Discovery Indirect Command Execution Discovery Defense Evasion Turla|OilRig no
467 T1219 T1201 Remote Access Software Password Policy Discovery Command And Control Discovery Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak Chimera|Turla|OilRig
468 T1207 T1190 Rogue Domain Controller Exploit Public-Facing Application Defense Evasion Initial Access no Volatile Cedar|UNC2452|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom
469 T1199 T1210 Trusted Relationship Exploitation of Remote Services Initial Access Lateral Movement APT28|menuPass Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28
470 T1218 T1219 Signed Binary Proxy Execution Remote Access Software Defense Evasion Command And Control no Mustang Panda|MuddyWater|Evilnum|GOLD SOUTHFIELD|Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak
471 T1195 Supply Chain Compromise Initial Access no
472 T1204 User Execution Execution no
473 T1216 T1203 Signed Script Proxy Execution Exploitation for Client Execution Defense Evasion Execution no Mustang Panda|Darkhotel|Higaisa|HAFNIUM|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Cobalt Group|Lazarus Group|APT29|TA459|APT37|Leviathan|Patchwork|Elderwood
474 T1195 T1218 Supply Chain Compromise Signed Binary Proxy Execution Initial Access Defense Evasion Elderwood no
475 T1205 Traffic Signaling Defense Evasion|Persistence|Command And Control no
476 T1216 Signed Script Proxy Execution Defense Evasion no
477 T1176 Browser Extensions Persistence Kimsuky|Stolen Pencil
478 T1175 Component Object Model and Distributed COM Lateral Movement|Execution no
479 T1187 Forced Authentication Credential Access DarkHydrus|Dragonfly 2.0 Dragonfly 2.0|DarkHydrus
480 T1185 Man in the Browser Collection no
481 T1134 Access Token Manipulation Defense Evasion|Privilege Escalation Blue Mockingbird FIN6|Blue Mockingbird
482 T1136 Create Account Persistence no
T1140 Deobfuscate/Decode Files or Information Defense Evasion Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|menuPass|Honeybee|Threat Group-3390|APT19|Gorgon Group|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER
483 T1149 LC_MAIN Hijacking Defense Evasion no
T1135 Network Share Discovery Discovery APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug
484 T1137 Office Application Startup Persistence Gamaredon Group|APT32
485 T1140 Deobfuscate/Decode Files or Information Defense Evasion APT39|APT29|ZIRCONIUM|Higaisa|UNC2452|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|Threat Group-3390|menuPass|Gorgon Group|Honeybee|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER
486 T1135 Network Share Discovery Discovery Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug
487 T1153 Source Execution no
488 T1133 External Remote Services Persistence|Initial Access Sandworm Team|APT41|Soft Cell|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18 APT29|UNC2452|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18
489 T1132 Data Encoding Command And Control no
490 T1129 Shared Modules Execution no
491 T1127 Trusted Developer Utilities Proxy Execution Defense Evasion no
492 T1125 Video Capture Collection Silence|FIN7
493 T1124 System Time Discovery Discovery The White Company|Lazarus Group|BRONZE BUTLER|Turla Darkhotel|ZIRCONIUM|Higaisa|Sidewinder|Chimera|Operation Wocao|The White Company|Lazarus Group|BRONZE BUTLER|Turla
494 T1123 Audio Capture Collection APT37
495 T1120 Peripheral Device Discovery Discovery Turla|APT37|Gamaredon Group|Equation|APT28 Operation Wocao|Turla|APT37|Gamaredon Group|Equation|APT28
496 T1119 Automated Collection Collection Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6 Mustang Panda|Sidewinder|Chimera|menuPass|Operation Wocao|Gamaredon Group|Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6
497 T1115 Clipboard Data Collection APT39|APT38 Operation Wocao|APT39|APT38
498 T1114 Email Collection Collection no Silent Librarian
499 T1113 Screen Capture Collection Gamaredon Group|APT39|Silence|MuddyWater|Dragonfly 2.0|OilRig|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28 GOLD SOUTHFIELD|Gamaredon Group|APT39|Silence|MuddyWater|OilRig|Dragonfly 2.0|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28
500 T1112 Modify Registry Defense Evasion Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Honeybee|Patchwork|Gorgon Group|FIN8 Operation Wocao|Kimsuky|Lazarus Group|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Patchwork|Gorgon Group|Dragonfly 2.0|APT19|Threat Group-3390|Honeybee|FIN8
501 T1111 Two-Factor Authentication Interception Credential Access no Chimera|Operation Wocao
502 T1110 Brute Force Credential Access DarkVishnya|APT39|OilRig|FIN5|Turla APT28|Fox Kitten|DarkVishnya|APT39|OilRig|FIN5|Turla
503 T1108 Redundant Access Defense Evasion|Persistence no
504 T1106 Native API Execution Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|Gorgon Group|APT37 Higaisa|menuPass|Operation Wocao|Chimera|Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|APT37|Gorgon Group
505 T1105 Ingress Tool Transfer Command And Control Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|Soft Cell|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Turla|Gorgon Group|OilRig|Dragonfly 2.0|APT37|FIN8|PLATINUM|Leviathan|Elderwood|Magic Hound|APT3|APT32|BRONZE BUTLER|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28 HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|UNC2452|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Turla|OilRig|Rancor|Cobalt Group|Gorgon Group|Dragonfly 2.0|APT37|Elderwood|Leviathan|FIN8|PLATINUM|Magic Hound|BRONZE BUTLER|APT3|APT32|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28
506 T1104 Multi-Stage Channels Command And Control APT41|MuddyWater|APT3
507 T1102 Web Service Command And Control Gamaredon Group|Rocke|Inception|FIN6 Fox Kitten|Turla|APT32|Gamaredon Group|Rocke|Inception|FIN6
508 T1098 Account Manipulation Persistence APT3|Dragonfly 2.0|Lazarus Group
509 T1095 Non-Application Layer Protocol Command And Control APT29|PLATINUM|APT3 HAFNIUM|Operation Wocao|FIN6|APT29|PLATINUM|APT3
510 T1092 Communication Through Removable Media Command And Control APT28
511 T1091 Replication Through Removable Media Lateral Movement|Initial Access Tropic Trooper|Darkhotel|APT28 Mustang Panda|Tropic Trooper|Darkhotel|APT28
512 T1090 Proxy Command And Control Sandworm Team|Blue Mockingbird|Wizard Spider|APT41|Turla Windigo|Fox Kitten|Operation Wocao|Sandworm Team|Blue Mockingbird|APT41|Turla
513 T1087 Account Discovery Discovery no APT29|UNC2452
514 T1083 File and Directory Discovery Discovery Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dark Caracal|Dragonfly 2.0|Magic Hound|Sowbug|BRONZE BUTLER|APT3|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|UNC2452|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dragonfly 2.0|Dark Caracal|Sowbug|APT3|Magic Hound|BRONZE BUTLER|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang
515 T1082 System Information Discovery Discovery Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|Honeybee|APT19|APT37|APT32|Magic Hound|OilRig|APT3|Sowbug|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|UNC2452|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT32|APT37|Honeybee|APT19|Magic Hound|Sowbug|OilRig|APT3|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang
516 T1080 Taint Shared Content Lateral Movement BRONZE BUTLER|Darkhotel Gamaredon Group|BRONZE BUTLER|Darkhotel
517 T1078 Valid Accounts Defense Evasion|Persistence|Privilege Escalation|Initial Access Sandworm Team|Wizard Spider|Silence|APT41|Soft Cell|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|Leviathan|APT33|OilRig|FIN5|menuPass|APT28|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak APT29|Silent Librarian|UNC2452|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|APT33|Leviathan|FIN8|OilRig|FIN5|menuPass|APT28|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak
518 T1074 Data Staged Collection Wizard Spider
519 T1072 Software Deployment Tools Execution|Lateral Movement Silence|APT32|Threat Group-1314
520 T1071 Application Layer Protocol Command And Control Rocke|Magic Hound|Dragonfly 2.0
521 T1070 Indicator Removal on Host Defense Evasion no APT29|UNC2452
522 T1069 Permission Groups Discovery Discovery TA505|APT3 APT29|UNC2452|TA505|APT3
523 T1068 Exploitation for Privilege Escalation Privilege Escalation Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28 ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28
524 T1064 Scripting Defense Evasion|Execution no
525 T1062 Hypervisor Persistence no
526 T1061 Graphical User Interface Execution no
527 T1059 Command and Scripting Interpreter Execution APT32|Molerats|Whitefly|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang Windigo|Fox Kitten|APT32|Whitefly|APT39|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang
528 T1057 Process Discovery Discovery Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|UNC2452|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang
529 T1056 Input Capture Collection|Credential Access no APT39
530 T1055 Process Injection Defense Evasion|Privilege Escalation APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM Operation Wocao|APT32|Sharpshooter|Silence|APT41|Kimsuky|APT37|Cobalt Group|Turla|Honeybee|PLATINUM
531 T1053 Scheduled Task/Job Execution|Persistence|Privilege Escalation no
532 T1052 Exfiltration Over Physical Medium Exfiltration no
533 T1051 Shared Webroot Lateral Movement no
534 T1049 System Network Connections Discovery Discovery Tropic Trooper|APT41|APT38|Soft Cell|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|APT3|OilRig|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang
535 T1048 Exfiltration Over Alternative Protocol Exfiltration no
536 T1047 Windows Management Instrumentation Execution Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|Soft Cell|APT32|MuddyWater|OilRig|Threat Group-3390|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda Mustang Panda|Windshift|UNC2452|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|Threat Group-3390|OilRig|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda
537 T1046 Network Service Scanning Discovery Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|Leafminer|OilRig|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390 Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|Cobalt Group|OilRig|Leafminer|menuPass|Suckfly|FIN6|Threat Group-3390
538 T1043 Commonly Used Port Command And Control Machete|OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|Dragonfly 2.0|FIN7|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390 OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|FIN7|Dragonfly 2.0|FIN8|APT37|APT3|Magic Hound|Lazarus Group|Threat Group-3390
539 T1041 Exfiltration Over C2 Channel Exfiltration Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|Soft Cell|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang ZIRCONIUM|Higaisa|Chimera|APT39|Operation Wocao|Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|GALLIUM|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang
540 T1040 Network Sniffing Credential Access|Discovery Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28 Kimsuky|Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28
541 T1039 Data from Network Shared Drive Collection Sowbug|BRONZE BUTLER|menuPass Chimera|Fox Kitten|Gamaredon Group|BRONZE BUTLER|Sowbug|menuPass
542 T1037 Boot or Logon Initialization Scripts Persistence|Privilege Escalation Rocke
543 T1036 Masquerading Defense Evasion Windshift|APT32|BRONZE BUTLER|menuPass|Dragonfly 2.0 APT29|Mustang Panda|ZIRCONIUM|TA551|UNC2452|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM|Dragonfly 2.0
544 T1034 Path Interception Persistence|Privilege Escalation no
545 T1033 System Owner/User Discovery Discovery Frankenstein|APT41|Soft Cell|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3 Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|Dragonfly 2.0|APT37|APT19|APT32|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3
546 T1030 Data Transfer Size Limits Exfiltration Threat Group-3390
547 T1029 Scheduled Transfer Exfiltration no Higaisa
548 T1027 Obfuscated Files or Information Defense Evasion Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|Machete|Soft Cell|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Cobalt Group|Patchwork|Leafminer|APT37|Threat Group-3390|Honeybee|Dark Caracal|menuPass|APT19|BlackOasis|FIN8|Leviathan|Elderwood|MuddyWater|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28 APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Cobalt Group|Patchwork|APT37|Honeybee|Dark Caracal|Leafminer|menuPass|Threat Group-3390|APT19|BlackOasis|FIN8|FIN7|Elderwood|MuddyWater|Leviathan|Magic Hound|OilRig|APT3|APT32|Group5|Lazarus Group|Dust Storm|Putter Panda|APT28
549 T1026 Multiband Communication Command And Control Lazarus Group
550 T1025 Data from Removable Media Collection Machete|Turla|Gamaredon Group|APT28 Turla|Gamaredon Group|APT28
551 T1021 Remote Services Lateral Movement no
552 T1020 Automated Exfiltration Exfiltration Tropic Trooper|Frankenstein|Honeybee Sidewinder|Gamaredon Group|Tropic Trooper|Frankenstein|Honeybee
553 T1018 Remote System Discovery Discovery Sandworm Team|Rocke|Wizard Spider|Silence|Soft Cell|APT39|APT32|Deep Panda|Threat Group-3390|Dragonfly 2.0|Leafminer|Ke3chang|FIN8|APT3|FIN5|BRONZE BUTLER|menuPass|FIN6|Turla APT29|UNC2452|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Deep Panda|Dragonfly 2.0|Threat Group-3390|Leafminer|Ke3chang|FIN8|BRONZE BUTLER|FIN5|APT3|menuPass|FIN6|Turla
554 T1016 System Network Configuration Discovery Discovery Sandworm Team|Tropic Trooper|Frankenstein|APT41|Soft Cell|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|OilRig|Magic Hound|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang
555 T1014 Rootkit Defense Evasion Rocke|APT41|APT28|Winnti Group
556 T1012 Query Registry Discovery APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla ZIRCONIUM|Chimera|Fox Kitten|APT39|Operation Wocao|APT32|Threat Group-3390|Dragonfly 2.0|OilRig|Stealth Falcon|Lazarus Group|Turla
557 T1011 Exfiltration Over Other Network Medium Exfiltration no
558 T1010 Application Window Discovery Discovery Lazarus Group
559 T1008 Fallback Channels Command And Control APT41|OilRig|Lazarus Group Carbanak|APT41|OilRig|Lazarus Group
560 T1007 System Service Discovery Discovery BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang Chimera|Operation Wocao|BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang
561 T1006 Direct Volume Access Defense Evasion no
562 T1005 Data from Local System Collection Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|Soft Cell|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang APT29|Windigo|UNC2452|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Dragonfly 2.0|Dark Caracal|Honeybee|APT37|APT28|BRONZE BUTLER|APT3|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang
563 T1003 OS Credential Dumping Credential Access APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom
564 T1001 Data Obfuscation Command And Control Axiom Operation Wocao|Axiom
stories/aws_cryptomining.yml → stories/deprecated/aws_cryptomining.yml
View File
stories/aws_suspicious_provisioning_activities.yml → stories/deprecated/aws_suspicious_provisioning_activities.yml
View File
stories/common_phishing_frameworks.yml → stories/deprecated/common_phishing_frameworks.yml
View File
stories/host_redirection.yml → stories/deprecated/host_redirection.yml
View File
stories/kubernetes_sensitive_role_activity.yml → stories/deprecated/kubernetes_sensitive_role_activity.yml
View File
stories/monitor_backup_solution.yml → stories/deprecated/monitor_backup_solution.yml
View File
stories/monitor_for_unauthorized_software.yml → stories/deprecated/monitor_for_unauthorized_software.yml
View File
stories/spectre_and_meltdown_vulnerabilities.yml → stories/deprecated/spectre_and_meltdown_vulnerabilities.yml
View File
stories/splunk_enterprise_vulnerability.yml → stories/deprecated/splunk_enterprise_vulnerability.yml
View File
stories/splunk_enterprise_vulnerability_cve_2018_11409.yml → stories/deprecated/splunk_enterprise_vulnerability_cve_2018_11409.yml
View File
stories/suspicious_aws_ec2_activities.yml → stories/deprecated/suspicious_aws_ec2_activities.yml
View File
stories/unusual_aws_ec2_modifications.yml → stories/deprecated/unusual_aws_ec2_modifications.yml
View File
stories/web_fraud_detection.yml → stories/deprecated/web_fraud_detection.yml
View File