| AWS Cross Account Activity |
Valid Accounts, Use Alternate Authentication Material |
Defense Evasion |
| AWS IAM Privilege Escalation |
Cloud Accounts, Cloud Account, Cloud Infrastructure Discovery, Brute Force, Account Manipulation, Cloud Groups |
Defense Evasion |
| AWS Network ACL Activity |
Disable or Modify Cloud Firewall |
Defense Evasion |
| AWS Security Hub Alerts |
None |
None |
| AWS User Monitoring |
Cloud Service Discovery |
Discovery |
| Active Directory Discovery |
Domain Account, Domain Trust Discovery, Remote System Discovery, Domain Groups, Password Policy Discovery, Local Groups, System Owner/User Discovery, Local Account, System Network Connections Discovery |
Discovery |
| Active Directory Password Spraying |
Password Spraying |
Credential Access |
| Apache Struts Vulnerability |
System Information Discovery |
Discovery |
| Asset Tracking |
None |
None |
| BITS Jobs |
BITS Jobs, Ingress Tool Transfer |
Defense Evasion |
| Baron Samedit CVE-2021-3156 |
Exploitation for Privilege Escalation |
Privilege Escalation |
| BlackMatter Ransomware |
Credentials in Registry, Inhibit System Recovery, Defacement, Data Encrypted for Impact |
Credential Access |
| Brand Monitoring |
None |
None |
| Clop Ransomware |
User Execution, Create or Modify System Process, Data Destruction, Service Execution, Inhibit System Recovery, Data Encrypted for Impact, Indicator Removal on Host, Service Stop, Clear Windows Event Logs |
Execution |
| Cloud Cryptomining |
Cloud Accounts, Unused/Unsupported Cloud Regions |
Defense Evasion |
| Cloud Federated Credential Abuse |
Valid Accounts, LSASS Memory, Cloud Account, Modify Authentication Process, Image File Execution Options Injection |
Defense Evasion |
| Cobalt Strike |
Archive via Utility, Windows Command Shell, Windows Service, Process Injection, File Transfer Protocols, Regsvr32, Mshta, Service Execution, Obfuscated Files or Information, Rundll32, Scheduled Task, Abuse Elevation Control Mechanism, Exploitation for Client Execution, Web Shell, MSBuild, Rename System Utilities, Trusted Developer Utilities Proxy Execution, Web Protocols, Remote System Discovery |
Collection |
| ColdRoot MacOS RAT |
None |
None |
| Collection and Staging |
Archive via Utility, Local Email Collection, Remote Email Collection, Masquerading |
Collection |
| Command and Control |
Exfiltration Over Alternative Protocol, DNS, Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, Non-Application Layer Protocol, Exfiltration Over C2 Channel, Drive-by Compromise, Transfer Data to Cloud Account, Local Email Collection, Email Collection, Email Forwarding Rule, Web Protocols |
Exfiltration |
| Container Implantation Monitoring and Investigation |
Implant Internal Image |
Persistence |
| Credential Dumping |
LSASS Memory, Process Injection, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation, Access Token Manipulation, Create or Modify System Process, Boot or Logon Autostart Execution, Abuse Elevation Control Mechanism, Compromise Client Software Binary, Modify Authentication Process, Steal or Forge Kerberos Tickets, Credentials from Password Stores, Account Discovery, Password Policy Discovery, Unsecured Credentials, OS Credential Dumping, Security Account Manager, NTDS, Kerberoasting, PowerShell |
Credential Access |
| DHS Report TA18-074A |
Local Account, File Transfer Protocols, SMB/Windows Admin Shares, Service Execution, PowerShell, Disable or Modify System Firewall, Registry Run Keys / Startup Folder, Windows Service, Scheduled Task, Malicious File, Modify Registry |
Persistence |
| DNS Amplification Attacks |
Reflection Amplification |
Impact |
| DNS Hijacking |
Drive-by Compromise |
Initial Access |
| DarkSide Ransomware |
Security Account Manager, BITS Jobs, Ingress Tool Transfer, CMSTP, Process Injection, Inhibit System Recovery, LSASS Memory, SMB/Windows Admin Shares, Automated Exfiltration, Service Execution, Data Encrypted for Impact, Bypass User Account Control |
Credential Access |
| Data Exfiltration |
Exfiltration Over Alternative Protocol, DNS, Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, Non-Application Layer Protocol, Exfiltration Over C2 Channel, Drive-by Compromise, Transfer Data to Cloud Account, Local Email Collection, Email Collection, Email Forwarding Rule, Web Protocols |
Exfiltration |
| Data Protection |
Drive-by Compromise |
Initial Access |
| Deobfuscate-Decode Files or Information |
Deobfuscate/Decode Files or Information |
Defense Evasion |
| Detect Zerologon Attack |
Exploitation of Remote Services, LSASS Memory, Exploit Public-Facing Application |
Lateral Movement |
| Dev Sec Ops |
Malicious Image, Compromise Client Software Binary, Compromise Software Dependencies and Development Tools, Exploitation for Credential Access, Cloud Service Discovery |
Execution |
| Disabling Security Tools |
Install Root Certificate, Disable or Modify Tools, Disable or Modify System Firewall, Windows Service, Modify Registry |
Defense Evasion |
| Domain Trust Discovery |
Domain Trust Discovery, Remote System Discovery |
Discovery |
| Dynamic DNS |
Exfiltration Over Alternative Protocol, DNS, Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, Non-Application Layer Protocol, Exfiltration Over C2 Channel, Drive-by Compromise, Transfer Data to Cloud Account, Local Email Collection, Email Collection, Email Forwarding Rule, Web Protocols |
Exfiltration |
| Emotet Malware DHS Report TA18-201A |
Windows Command Shell, Software Deployment Tools, Registry Run Keys / Startup Folder, SMB/Windows Admin Shares, Spearphishing Attachment |
Execution |
| F5 TMUI RCE CVE-2020-5902 |
Exploit Public-Facing Application |
Initial Access |
| FIN7 |
System Owner/User Discovery, JavaScript, Credentials from Web Browsers, Spearphishing Attachment, XSL Script Processing |
Discovery |
| GCP Cross Account Activity |
Valid Accounts |
Defense Evasion |
| HAFNIUM Group |
PowerShell, Web Shell, Local Account, SMB/Windows Admin Shares, Service Execution, LSASS Memory, Remote Email Collection, NTDS, Exploit Public-Facing Application |
Execution |
| Hidden Cobra Malware |
Network Share Connection Removal, DNS, Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, File Transfer Protocols, Remote Desktop Protocol, SMB/Windows Admin Shares |
Defense Evasion |
| IcedID |
Domain Account, Disable or Modify Tools, Command and Scripting Interpreter, Process Injection, Malicious File, Bypass User Account Control, Modify Registry, Archive via Utility, Mshta, Domain Trust Discovery, Spearphishing Attachment, Registry Run Keys / Startup Folder, Rundll32, Scheduled Task/Job, Data from Local System, Regsvr32, IP Addresses, Obfuscated Files or Information, Scheduled Task, SMB/Windows Admin Shares |
Discovery |
| Ingress Tool Transfer |
PowerShell, BITS Jobs, Ingress Tool Transfer, OS Credential Dumping, Remote Services, Screen Capture, Audio Capture, Remote Service Session Hijacking, Scheduled Task/Job, Access Token Manipulation, Abuse Elevation Control Mechanism, Process Injection, Native API, System Services, Obfuscated Files or Information, Indicator Removal from Tools, Component Object Model Hijacking, Deobfuscate/Decode Files or Information, Gather Victim Host Information, Impair Defenses |
Execution |
| JBoss Vulnerability |
System Information Discovery |
Discovery |
| Kubernetes Scanning Activity |
Cloud Service Discovery |
Discovery |
| Kubernetes Sensitive Object Access Activity |
None |
None |
| Lateral Movement |
Pass the Hash, SMB/Windows Admin Shares, Service Execution, Kerberoasting, Remote Desktop Protocol, Scheduled Task |
Defense Evasion |
| Malicious PowerShell |
PowerShell, BITS Jobs, Ingress Tool Transfer, OS Credential Dumping, Remote Services, Screen Capture, Audio Capture, Remote Service Session Hijacking, Scheduled Task/Job, Access Token Manipulation, Abuse Elevation Control Mechanism, Process Injection, Native API, System Services, Obfuscated Files or Information, Indicator Removal from Tools, Component Object Model Hijacking, Deobfuscate/Decode Files or Information, Gather Victim Host Information, Impair Defenses |
Execution |
| Masquerading - Rename System Utilities |
Rename System Utilities, MSBuild, Rundll32, Trusted Developer Utilities Proxy Execution, Masquerading |
Defense Evasion |
| Meterpreter |
System Owner/User Discovery |
Discovery |
| Microsoft MSHTML Remote Code Execution CVE-2021-40444 |
Control Panel, Spearphishing Attachment, Rundll32 |
Defense Evasion |
| Monitor for Updates |
None |
None |
| NOBELIUM Group |
Archive via Utility, Windows Command Shell, Windows Service, Process Injection, File Transfer Protocols, Regsvr32, Mshta, Service Execution, Obfuscated Files or Information, Rundll32, Scheduled Task, Abuse Elevation Control Mechanism, Exploitation for Client Execution, Web Shell, MSBuild, Rename System Utilities, Trusted Developer Utilities Proxy Execution, Web Protocols, Remote System Discovery |
Collection |
| Netsh Abuse |
Disable or Modify System Firewall |
Defense Evasion |
| Office 365 Detections |
Password Guessing, Cloud Account, Disable or Modify Cloud Firewall, Modify Authentication Process, Brute Force, Email Collection, Email Forwarding Rule, Remote Email Collection |
Credential Access |
| Orangeworm Attack Group |
Service Execution, Process Injection, Native API, System Services, Services Registry Permissions Weakness, Windows Service |
Execution |
| PetitPotam NTLM Relay on Active Directory Certificate Services |
Forced Authentication, OS Credential Dumping |
Credential Access |
| Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns |
PowerShell, Registry Run Keys / Startup Folder |
Execution |
| PrintNightmare CVE-2021-34527 |
Print Processors, Rundll32, Exploitation for Privilege Escalation |
Persistence |
| Prohibited Traffic Allowed or Protocol Mismatch |
Remote Desktop Protocol, Drive-by Compromise, Remote Services, Exfiltration Over Alternative Protocol, Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, Web Protocols |
Lateral Movement |
| ProxyShell |
Web Shell, Exploit Public-Facing Application, PowerShell |
Persistence |
| Ransomware |
Archive via Utility, Disable or Modify Cloud Firewall, Abuse Elevation Control Mechanism, Service Stop, Inhibit System Recovery, CMSTP, File Deletion, Data Destruction, User Execution, Automated Exfiltration, Domain Account, Local Account, Domain Trust Discovery, Domain Groups, Local Groups, Disable or Modify Tools, Clear Windows Event Logs, Account Access Removal, Service Execution, Visual Basic, Indicator Removal on Host, File and Directory Permissions Modification, Defacement, DLL Side-Loading, Indicator Removal from Tools, Component Object Model Hijacking, Exfiltration Over Alternative Protocol, Gather Victim Host Information, Registry Run Keys / Startup Folder, Windows Management Instrumentation, Modify Registry, SMB/Windows Admin Shares, Scheduled Task, Rename System Utilities, Web Protocols, Msiexec |
Collection |
| Ransomware Cloud |
Data Encrypted for Impact |
Impact |
| Remcos |
Bypass User Account Control, Masquerading, Port Monitors, Indicator Removal on Host, Registry Run Keys / Startup Folder, Image File Execution Options Injection, Application Shimming, Screen Capture, Create or Modify System Process |
Privilege Escalation |
| Revil Ransomware |
Disable or Modify Cloud Firewall, Inhibit System Recovery, Disable or Modify Tools, Defacement, DLL Side-Loading, User Execution, Modify Registry, CMSTP |
Defense Evasion |
| Router and Infrastructure Security |
Hardware Additions, Network Denial of Service, ARP Cache Poisoning, Man-in-the-Middle, TFTP Boot, Traffic Duplication |
Initial Access |
| Ryuk Ransomware |
Inhibit System Recovery, Data Destruction, Domain Trust Discovery, Remote Desktop Protocol, Data Encrypted for Impact, Windows Command Shell, Scheduled Task, Disable or Modify Tools, Service Stop |
Impact |
| SQL Injection |
Exploit Public-Facing Application |
Initial Access |
| SamSam Ransomware |
Match Legitimate Name or Location, Active Scanning, OS Credential Dumping, Service Stop, Malicious File, Data Destruction, Account Access Removal, Inhibit System Recovery, File and Directory Permissions Modification, SMB/Windows Admin Shares, Service Execution, System Information Discovery, System Network Configuration Discovery, Disable or Modify Tools, Ingress Tool Transfer, Account Discovery, Masquerading, Command and Scripting Interpreter, Regsvr32, Indirect Command Execution, Scheduled Task/Job, Exploitation for Client Execution, Software Deployment Tools, Remote Desktop Protocol, Rundll32, Data Encrypted for Impact, Windows Service, Create or Modify System Process, Rename System Utilities, Exploit Public-Facing Application |
Defense Evasion |
| Silver Sparrow |
Ingress Tool Transfer, Launch Agent, Data Staged |
Command And Control |
| Spearphishing Attachments |
Spearphishing Attachment, Security Account Manager, Spearphishing Link |
Initial Access |
| Suspicious AWS Login Activities |
Unused/Unsupported Cloud Regions |
Defense Evasion |
| Suspicious AWS S3 Activities |
Data from Cloud Storage Object |
Collection |
| Suspicious AWS Traffic |
None |
None |
| Suspicious Cloud Authentication Activities |
Unused/Unsupported Cloud Regions |
Defense Evasion |
| Suspicious Cloud Instance Activities |
Cloud Accounts, Transfer Data to Cloud Account |
Defense Evasion |
| Suspicious Cloud Provisioning Activities |
Valid Accounts |
Defense Evasion |
| Suspicious Cloud User Activities |
Cloud Infrastructure Discovery, Cloud Accounts, Valid Accounts |
Discovery |
| Suspicious Command-Line Executions |
Windows Command Shell, Command and Scripting Interpreter, Exploitation for Privilege Escalation, Rename System Utilities |
Execution |
| Suspicious Compiled HTML Activity |
Compiled HTML File |
Defense Evasion |
| Suspicious DNS Traffic |
Exfiltration Over Alternative Protocol, DNS, Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, Non-Application Layer Protocol, Exfiltration Over C2 Channel, Drive-by Compromise, Transfer Data to Cloud Account, Local Email Collection, Email Collection, Email Forwarding Rule, Web Protocols |
Exfiltration |
| Suspicious Emails |
Spearphishing Attachment |
Initial Access |
| Suspicious GCP Storage Activities |
Data from Cloud Storage Object |
Collection |
| Suspicious MSHTA Activity |
Mshta, Windows Command Shell, Command and Scripting Interpreter, Registry Run Keys / Startup Folder |
Defense Evasion |
| Suspicious Okta Activity |
Default Accounts |
Defense Evasion |
| Suspicious Regsvcs Regasm Activity |
Regsvcs/Regasm |
Defense Evasion |
| Suspicious Regsvr32 Activity |
Regsvr32 |
Defense Evasion |
| Suspicious Rundll32 Activity |
Rundll32, LSASS Memory, Rename System Utilities |
Defense Evasion |
| Suspicious WMI Use |
Windows Management Instrumentation Event Subscription, Windows Management Instrumentation |
Privilege Escalation |
| Suspicious Windows Registry Activities |
Bypass User Account Control, Masquerading, Port Monitors, Indicator Removal on Host, Registry Run Keys / Startup Folder, Image File Execution Options Injection, Application Shimming, Screen Capture, Create or Modify System Process |
Privilege Escalation |
| Suspicious Zoom Child Processes |
Windows Command Shell, Command and Scripting Interpreter, Exploitation for Privilege Escalation, Rename System Utilities |
Execution |
| Trickbot |
Domain Account, Disable or Modify Tools, Command and Scripting Interpreter, Process Injection, Malicious File, Bypass User Account Control, Modify Registry, Archive via Utility, Mshta, Domain Trust Discovery, Spearphishing Attachment, Registry Run Keys / Startup Folder, Rundll32, Scheduled Task/Job, Data from Local System, Regsvr32, IP Addresses, Obfuscated Files or Information, Scheduled Task, SMB/Windows Admin Shares |
Discovery |
| Trusted Developer Utilities Proxy Execution |
Trusted Developer Utilities Proxy Execution, Rename System Utilities |
Defense Evasion |
| Trusted Developer Utilities Proxy Execution MSBuild |
MSBuild, Rename System Utilities |
Defense Evasion |
| Unusual Processes |
Match Legitimate Name or Location, Active Scanning, OS Credential Dumping, Service Stop, Malicious File, Data Destruction, Account Access Removal, Inhibit System Recovery, File and Directory Permissions Modification, SMB/Windows Admin Shares, Service Execution, System Information Discovery, System Network Configuration Discovery, Disable or Modify Tools, Ingress Tool Transfer, Account Discovery, Masquerading, Command and Scripting Interpreter, Regsvr32, Indirect Command Execution, Scheduled Task/Job, Exploitation for Client Execution, Software Deployment Tools, Remote Desktop Protocol, Rundll32, Data Encrypted for Impact, Windows Service, Create or Modify System Process, Rename System Utilities, Exploit Public-Facing Application |
Defense Evasion |
| Use of Cleartext Protocols |
None |
None |
| Windows DNS SIGRed CVE-2020-1350 |
Exploitation for Client Execution |
Execution |
| Windows Defense Evasion Tactics |
Disable or Modify Tools, Hidden Files and Directories, Bypass User Account Control, Modify Registry, Windows File and Directory Permissions Modification, Masquerading |
Defense Evasion |
| Windows Discovery Techniques |
Valid Accounts, Account Discovery, Domain Policy Modification, Trusted Relationship, Domain Trust Discovery, Gather Victim Network Information, Gather Victim Org Information, Active Scanning, Gather Victim Host Information, System Service Discovery, Query Registry, Network Service Scanning, Windows Management Instrumentation, Process Discovery, File and Directory Discovery, Software Discovery, Software, SMB/Windows Admin Shares, Network Share Discovery, Data from Network Shared Drive, Scheduled Task/Job, Exploitation for Privilege Escalation, Create or Modify System Process, Boot or Logon Autostart Execution, Hijack Execution Flow, Credentials, Domain Properties, Network Trust Dependencies, Account Manipulation, Vulnerability Scanning, Process Injection |
Defense Evasion |
| Windows File Extension and Association Abuse |
Rename System Utilities, MSBuild, Rundll32, Trusted Developer Utilities Proxy Execution, Masquerading |
Defense Evasion |
| Windows Log Manipulation |
Inhibit System Recovery, Indicator Removal on Host, Clear Windows Event Logs |
Impact |
| Windows Persistence Techniques |
Path Interception by Unquoted Path, Windows File and Directory Permissions Modification, Establish Accounts, Valid Accounts, Account Manipulation, Rogue Domain Controller, Domain Policy Modification, Scheduled Task/Job, Access Token Manipulation, Abuse Elevation Control Mechanism, Port Monitors, Services Registry Permissions Weakness, Registry Run Keys / Startup Folder, Application Shimming, Windows Service, Scheduled Task, Exploitation for Privilege Escalation |
Persistence |
| Windows Privilege Escalation |
Exploitation for Privilege Escalation, Access Token Manipulation, Abuse Elevation Control Mechanism, Accessibility Features, Valid Accounts, Account Manipulation, Image File Execution Options Injection |
Privilege Escalation |
| Windows Service Abuse |
Service Execution, Process Injection, Native API, System Services, Services Registry Permissions Weakness, Windows Service |
Execution |
| XMRig |
Match Legitimate Name or Location, Active Scanning, OS Credential Dumping, Service Stop, Malicious File, Data Destruction, Account Access Removal, Inhibit System Recovery, File and Directory Permissions Modification, SMB/Windows Admin Shares, Service Execution, System Information Discovery, System Network Configuration Discovery, Disable or Modify Tools, Ingress Tool Transfer, Account Discovery, Masquerading, Command and Scripting Interpreter, Regsvr32, Indirect Command Execution, Scheduled Task/Job, Exploitation for Client Execution, Software Deployment Tools, Remote Desktop Protocol, Rundll32, Data Encrypted for Impact, Windows Service, Create or Modify System Process, Rename System Utilities, Exploit Public-Facing Application |
Defense Evasion |
research bot