action.social.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1656
|
Impersonation
|
action.hacking.variety.Other
|
Other
| related-to |
T1001
|
Data Obfuscation
|
action.hacking.variety.Other
|
Other
| related-to |
T1001.001
|
Junk Data
|
action.hacking.variety.Other
|
Other
| related-to |
T1001.002
|
Steganography
|
action.hacking.variety.Other
|
Other
| related-to |
T1001.003
|
Protocol or Service Impersonation
|
action.hacking.variety.Other
|
Other
| related-to |
T1071
|
Application Layer Protocol
|
action.hacking.variety.Other
|
Other
| related-to |
T1071.001
|
Web Protocols
|
action.hacking.variety.Other
|
Other
| related-to |
T1071.002
|
File Transfer Protocols
|
action.hacking.variety.Other
|
Other
| related-to |
T1071.003
|
Mail Protocols
|
action.hacking.variety.Other
|
Other
| related-to |
T1071.004
|
DNS
|
action.hacking.variety.Other
|
Other
| related-to |
T1105
|
Ingress Tool Transfer
|
action.hacking.variety.Other
|
Other
| related-to |
T1127.001
|
MSBuild
|
action.malware.variety.Other
|
Other
| related-to |
T1080
|
Taint Shared Content
|
action.malware.variety.Other
|
Other
| related-to |
T1204
|
User Execution
|
action.malware.variety.Other
|
Other
| related-to |
T1204.001
|
Malicious Link
|
action.malware.variety.Other
|
Other
| related-to |
T1204.002
|
Malicious File
|
action.malware.variety.Other
|
Other
| related-to |
T1204.003
|
Malicious Image
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1027.011
|
Fileless Storage
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1027.012
|
LNK Icon Smuggling
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1027.013
|
Encrypted/Encoded File
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1059.009
|
Cloud API
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1059.010
|
AutoHotKey & AutoIT
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1059.011
|
Lua
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1127.002
|
ClickOnce
|
action.hacking.variety.Backdoor
|
Hacking action that creates a backdoor for use.
| related-to |
T1098.006
|
Additional Container Cluster Roles
|
action.hacking.variety.Backdoor
|
Hacking action that creates a backdoor for use.
| related-to |
T1098.007
|
Additional Local or Domain Groups
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1027
|
Obfuscated Files or Information
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1027.001
|
Binary Padding
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1027.002
|
Software Packing
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1027.003
|
Steganography
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1027.004
|
Compile After Delivery
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1027.010
|
Command Obfuscation
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1027.011
|
Fileless Storage
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1027.012
|
LNK Icon Smuggling
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1027.013
|
Encrypted/Encoded File
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1027.014
|
Polymorphic Code
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1070.010
|
Relocate Malware
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1132.002
|
Non-Standard Encoding
|
action.hacking.variety.OS commanding
|
OS commanding. Child of 'Exploit vuln'.
| related-to |
T1059.009
|
Cloud API
|
action.hacking.variety.OS commanding
|
OS commanding. Child of 'Exploit vuln'.
| related-to |
T1059.010
|
AutoHotKey & AutoIT
|
action.hacking.variety.OS commanding
|
OS commanding. Child of 'Exploit vuln'.
| related-to |
T1059.011
|
Lua
|
action.hacking.variety.OS commanding
|
OS commanding. Child of 'Exploit vuln'.
| related-to |
T1127.002
|
ClickOnce
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1021.007
|
Cloud Services
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1021.008
|
Direct Cloud VM Connections
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1134.003
|
Make and Impersonate Token
|
action.hacking.vector.Command shell
|
Remote shell
| related-to |
T1021.008
|
Direct Cloud VM Connections
|
action.hacking.vector.Command shell
|
Remote shell
| related-to |
T1027.010
|
Command Obfuscation
|
action.hacking.vector.Command shell
|
Remote shell
| related-to |
T1059.009
|
Cloud API
|
action.hacking.vector.Command shell
|
Remote shell
| related-to |
T1059.010
|
AutoHotKey & AutoIT
|
action.hacking.vector.Command shell
|
Remote shell
| related-to |
T1059.011
|
Lua
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1071.005
|
Publish/Subscribe Protocols
|
action.malware.variety.Capture stored data
|
Capture data stored on system disk
| related-to |
T1016.002
|
Wi-Fi Discovery
|
action.malware.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1036.009
|
Break Process Trees
|
action.malware.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1071.005
|
Publish/Subscribe Protocols
|
action.malware.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1016.002
|
Wi-Fi Discovery
|
action.malware.variety.Spyware/Keylogger
|
Spyware, keylogger or form-grabber (capture user input or activity)
| related-to |
T1111
|
Multi-Factor Authentication Interception
|
action.social.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1036.008
|
Masquerade File Type
|
action.social.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1036.010
|
Masquerade Account Name
|
attribute.integrity.variety.Modify privileges
|
Modified privileges or permissions
| related-to |
T1098.006
|
Additional Container Cluster Roles
|
attribute.integrity.variety.Modify privileges
|
Modified privileges or permissions
| related-to |
T1098.007
|
Additional Local or Domain Groups
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1047
|
Windows Management Instrumentation
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1053
|
Scheduled Task/Job
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1053.002
|
At
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1053.003
|
Cron
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1053.005
|
Scheduled Task
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1053.006
|
Systemd Timers
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1053.007
|
Container Orchestration Job
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1059
|
Command and Scripting Interpreter
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1059.001
|
PowerShell
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1059.002
|
AppleScript
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1059.003
|
Windows Command Shell
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1059.004
|
Unix Shell
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1059.005
|
Visual Basic
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1059.006
|
Python
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1059.007
|
JavaScript
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1059.008
|
Network Device CLI
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1072
|
Software Deployment Tools
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1105
|
Ingress Tool Transfer
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1106
|
Native API
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1112
|
Modify Registry
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1127
|
Trusted Developer Utilities Proxy Execution
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1127.001
|
MSBuild
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1129
|
Shared Modules
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1137
|
Office Application Startup
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1137.001
|
Office Template Macros
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1137.002
|
Office Test
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1137.003
|
Outlook Forms
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1137.004
|
Outlook Home Page
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1137.005
|
Outlook Rules
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1187
|
Forced Authentication
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1202
|
Indirect Command Execution
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1216
|
System Script Proxy Execution
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1216.001
|
PubPrn
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1216.002
|
SyncAppvPublishingServer
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1218
|
System Binary Proxy Execution
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1218.001
|
Compiled HTML File
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1218.002
|
Control Panel
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1218.003
|
CMSTP
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1218.004
|
InstallUtil
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1218.005
|
Mshta
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1218.007
|
Msiexec
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1218.008
|
Odbcconf
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1218.009
|
Regsvcs/Regasm
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1218.010
|
Regsvr32
|
action.hacking.variety.AiTM
|
Adversary-in-the-middle attack. Child of 'Exploit vuln'
| related-to |
T1111
|
Multi-Factor Authentication Interception
|
action.hacking.variety.AiTM
|
Adversary-in-the-middle attack. Child of 'Exploit vuln'
| related-to |
T1185
|
Browser Session Hijacking
|
action.hacking.variety.AiTM
|
Adversary-in-the-middle attack. Child of 'Exploit vuln'
| related-to |
T1187
|
Forced Authentication
|
action.hacking.variety.Backdoor
|
Hacking action that creates a backdoor for use.
| related-to |
T1037
|
Boot or Logon Initialization Scripts
|
action.hacking.variety.Backdoor
|
Hacking action that creates a backdoor for use.
| related-to |
T1053
|
Scheduled Task/Job
|
action.hacking.variety.Backdoor
|
Hacking action that creates a backdoor for use.
| related-to |
T1078
|
Valid Accounts
|
action.hacking.variety.Backdoor
|
Hacking action that creates a backdoor for use.
| related-to |
T1098
|
Account Manipulation
|
action.hacking.variety.Backdoor
|
Hacking action that creates a backdoor for use.
| related-to |
T1133
|
External Remote Services
|
action.hacking.variety.Backdoor
|
Hacking action that creates a backdoor for use.
| related-to |
T1563.002
|
RDP Hijacking
|
action.hacking.variety.Brute force
|
Brute force or password guessing attacks.
| related-to |
T1110
|
Brute Force
|
action.hacking.variety.Brute force
|
Brute force or password guessing attacks.
| related-to |
T1222.002
|
Linux and Mac File and Directory Permissions Modification
|
action.hacking.variety.Brute force
|
Brute force or password guessing attacks.
| related-to |
T1565.001
|
Stored Data Manipulation
|
action.hacking.variety.Brute force
|
Brute force or password guessing attacks.
| related-to |
T1021.003
|
Distributed Component Object Model
|
action.hacking.variety.Brute force
|
Brute force or password guessing attacks.
| related-to |
T1531
|
Account Access Removal
|
action.hacking.variety.Buffer overflow
|
Buffer overflow. Child of 'Exploit vuln'.
| related-to |
T1203
|
Exploitation for Client Execution
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1001
|
Data Obfuscation
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1102.001
|
Dead Drop Resolver
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1602.001
|
SNMP (MIB Dump)
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1584.002
|
DNS Server
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1008
|
Fallback Channels
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1014
|
Rootkit
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1036
|
Masquerading
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1071
|
Application Layer Protocol
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1090
|
Proxy
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1102
|
Web Service
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1104
|
Multi-Stage Channels
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1132
|
Data Encoding
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1583.007
|
Serverless
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1205
|
Traffic Signaling
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1021.007
|
Cloud Services
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1053.005
|
Scheduled Task
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1211
|
Exploitation for Defense Evasion
|
action.hacking.variety.Exploit misconfig
|
Exploit a misconfiguration (vs vuln or weakness)
| related-to |
T1068
|
Exploitation for Privilege Escalation
|
action.hacking.variety.Exploit misconfig
|
Exploit a misconfiguration (vs vuln or weakness)
| related-to |
T1190
|
Exploit Public-Facing Application
|
action.hacking.variety.Exploit misconfig
|
Exploit a misconfiguration (vs vuln or weakness)
| related-to |
T1212
|
Exploitation for Credential Access
|
action.hacking.variety.Exploit vuln
|
Exploit vulnerability in code (vs misconfig or weakness). This can be used with other hacking enumerations, (such as XSS when an XSS vuln exists.). Parent of many hacking varieties.
| related-to |
T1068
|
Exploitation for Privilege Escalation
|
action.hacking.variety.Exploit vuln
|
Exploit vulnerability in code (vs misconfig or weakness). This can be used with other hacking enumerations, (such as XSS when an XSS vuln exists.). Parent of many hacking varieties.
| related-to |
T1212
|
Exploitation for Credential Access
|
action.hacking.variety.Format string attack
|
Format string attack. Child of 'Exploit vuln'.
| related-to |
T1068
|
Exploitation for Privilege Escalation
|
action.hacking.variety.Fuzz testing
|
Fuzz testing. Child of 'Exploit vuln'.
| related-to |
T1068
|
Exploitation for Privilege Escalation
|
action.hacking.variety.Hijack
|
To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes)
| related-to |
T1185
|
Browser Session Hijacking
|
action.hacking.variety.HTTP request smuggling
|
HTTP request smuggling. Child of 'Exploit vuln'.
| related-to |
T1185
|
Browser Session Hijacking
|
action.hacking.variety.HTTP request smuggling
|
HTTP request smuggling. Child of 'Exploit vuln'.
| related-to |
T1203
|
Exploitation for Client Execution
|
action.hacking.variety.HTTP request splitting
|
HTTP request splitting. Child of 'Exploit vuln'.
| related-to |
T1185
|
Browser Session Hijacking
|
action.hacking.variety.HTTP request splitting
|
HTTP request splitting. Child of 'Exploit vuln'.
| related-to |
T1203
|
Exploitation for Client Execution
|
action.hacking.variety.HTTP response smuggling
|
HTTP response smuggling. Child of 'Exploit vuln'.
| related-to |
T1185
|
Browser Session Hijacking
|
action.hacking.variety.HTTP response smuggling
|
HTTP response smuggling. Child of 'Exploit vuln'.
| related-to |
T1203
|
Exploitation for Client Execution
|
action.hacking.variety.HTTP response splitting
|
HTTP response splitting. Child of 'Exploit vuln'.
| related-to |
T1185
|
Browser Session Hijacking
|
action.hacking.variety.HTTP response splitting
|
HTTP response splitting. Child of 'Exploit vuln'.
| related-to |
T1203
|
Exploitation for Client Execution
|
action.hacking.variety.Insecure deserialization
|
iterating over sequential or obvious values. https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization. Child of 'Exploit vuln'.
| related-to |
T1068
|
Exploitation for Privilege Escalation
|
action.hacking.variety.Integer overflows
|
Integer overflows. Child of 'Exploit vuln'.
| related-to |
T1068
|
Exploitation for Privilege Escalation
|
action.hacking.variety.LDAP injection
|
LDAP injection. Child of 'Exploit vuln'.
| related-to |
T1068
|
Exploitation for Privilege Escalation
|
action.hacking.variety.Null byte injection
|
Null byte injection. Child of 'Exploit vuln'.
| related-to |
T1027
|
Obfuscated Files or Information
|
action.hacking.variety.Offline cracking
|
Offline password or key cracking (e.g., rainbow tables, Hashcat, JtR)
| related-to |
T1565.001
|
Stored Data Manipulation
|
action.hacking.variety.OS commanding
|
OS commanding. Child of 'Exploit vuln'.
| related-to |
T1059
|
Command and Scripting Interpreter
|
action.hacking.variety.OS commanding
|
OS commanding. Child of 'Exploit vuln'.
| related-to |
T1505.005
|
Terminal Services DLL
|
action.hacking.variety.OS commanding
|
OS commanding. Child of 'Exploit vuln'.
| related-to |
T1569
|
System Services
|
action.hacking.variety.OS commanding
|
OS commanding. Child of 'Exploit vuln'.
| related-to |
T1110
|
Brute Force
|
action.hacking.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1007
|
System Service Discovery
|
action.hacking.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1012
|
Query Registry
|
action.hacking.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1033
|
System Owner/User Discovery
|
action.hacking.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1057
|
Process Discovery
|
action.hacking.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1069
|
Permission Groups Discovery
|
action.hacking.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1136.003
|
Cloud Account
|
action.hacking.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1082
|
System Information Discovery
|
action.hacking.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1083
|
File and Directory Discovery
|
action.hacking.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1087
|
Account Discovery
|
action.hacking.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1573.001
|
Symmetric Cryptography
|
action.hacking.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1119
|
Automated Collection
|
action.hacking.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1120
|
Peripheral Device Discovery
|
action.hacking.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1124
|
System Time Discovery
|
action.hacking.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1201
|
Password Policy Discovery
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1018
|
Remote System Discovery
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1007
|
System Service Discovery
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1046
|
Network Service Discovery
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1049
|
System Network Connections Discovery
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1119
|
Automated Collection
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1135
|
Network Share Discovery
|
action.hacking.variety.Session fixation
|
Session fixation. Child of 'Exploit vuln'.
| related-to |
T1185
|
Browser Session Hijacking
|
action.hacking.variety.Session fixation
|
Session fixation. Child of 'Exploit vuln'.
| related-to |
T1212
|
Exploitation for Credential Access
|
action.hacking.variety.SQLi
|
SQL injection. Child of 'Exploit vuln'.
| related-to |
T1190
|
Exploit Public-Facing Application
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1134
|
Access Token Manipulation
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1127
|
Trusted Developer Utilities Proxy Execution
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1021
|
Remote Services
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1027.007
|
Dynamic API Resolution
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1029
|
Scheduled Transfer
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1547.004
|
Winlogon Helper DLL
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1598.003
|
Spearphishing Link
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1560.001
|
Archive via Utility
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1583.004
|
Server
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1078
|
Valid Accounts
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1011.001
|
Exfiltration Over Bluetooth
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1550.004
|
Web Session Cookie
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1601.002
|
Downgrade System Image
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1569.002
|
Service Execution
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1133
|
External Remote Services
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1134
|
Access Token Manipulation
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1654
|
Log Enumeration
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1548
|
Abuse Elevation Control Mechanism
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1041
|
Exfiltration Over C2 Channel
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1187
|
Forced Authentication
|
action.hacking.variety.XML external entities
|
XML external entities. Child of 'Exploit vuln'.
| related-to |
T1558.002
|
Silver Ticket
|
action.hacking.variety.XPath injection
|
XPath injection. Child of 'Exploit vuln'.
| related-to |
T1010
|
Application Window Discovery
|
action.hacking.vector.3rd party desktop
|
3rd party online desktop sharing (LogMeIn, Go2Assist)
| related-to |
T1133
|
External Remote Services
|
action.hacking.vector.Backdoor
|
Hacking actions taken through a backdoor. C2 is only used by malware.
| related-to |
T1037
|
Boot or Logon Initialization Scripts
|
action.hacking.vector.Backdoor
|
Hacking actions taken through a backdoor. C2 is only used by malware.
| related-to |
T1053
|
Scheduled Task/Job
|
action.hacking.vector.Backdoor
|
Hacking actions taken through a backdoor. C2 is only used by malware.
| related-to |
T1078
|
Valid Accounts
|
action.hacking.vector.Backdoor
|
Hacking actions taken through a backdoor. C2 is only used by malware.
| related-to |
T1098
|
Account Manipulation
|
action.hacking.vector.Backdoor
|
Hacking actions taken through a backdoor. C2 is only used by malware.
| related-to |
T1133
|
External Remote Services
|
action.hacking.vector.Backdoor
|
Hacking actions taken through a backdoor. C2 is only used by malware.
| related-to |
T1563.002
|
RDP Hijacking
|
action.hacking.vector.Command shell
|
Remote shell
| related-to |
T1029
|
Scheduled Transfer
|
action.hacking.vector.Command shell
|
Remote shell
| related-to |
T1547.004
|
Winlogon Helper DLL
|
action.hacking.vector.Command shell
|
Remote shell
| related-to |
T1598.003
|
Spearphishing Link
|
action.hacking.vector.Command shell
|
Remote shell
| related-to |
T1583.004
|
Server
|
action.hacking.vector.Command shell
|
Remote shell
| related-to |
T1047
|
Windows Management Instrumentation
|
action.hacking.vector.Command shell
|
Remote shell
| related-to |
T1059
|
Command and Scripting Interpreter
|
action.hacking.vector.Command shell
|
Remote shell
| related-to |
T1552.008
|
Chat Messages
|
action.hacking.vector.Command shell
|
Remote shell
| related-to |
T1505.005
|
Terminal Services DLL
|
action.hacking.vector.Command shell
|
Remote shell
| related-to |
T1569
|
System Services
|
action.hacking.vector.Command shell
|
Remote shell
| related-to |
T1110
|
Brute Force
|
action.hacking.vector.Command shell
|
Remote shell
| related-to |
T1071.001
|
Web Protocols
|
action.hacking.vector.Command shell
|
Remote shell
| related-to |
T1127.002
|
ClickOnce
|
action.hacking.vector.Command shell
|
Remote shell
| related-to |
T1546.013
|
PowerShell Profile
|
action.hacking.vector.Command shell
|
Remote shell
| related-to |
T1584.005
|
Botnet
|
action.hacking.vector.Desktop sharing software
|
Superset of 'Desktop sharing' and '3rd party desktop'. Please use in place of the other two
| related-to |
T1027.007
|
Dynamic API Resolution
|
action.hacking.vector.Desktop sharing software
|
Superset of 'Desktop sharing' and '3rd party desktop'. Please use in place of the other two
| related-to |
T1560.001
|
Archive via Utility
|
action.hacking.vector.Desktop sharing software
|
Superset of 'Desktop sharing' and '3rd party desktop'. Please use in place of the other two
| related-to |
T1133
|
External Remote Services
|
action.hacking.vector.Other network service
|
Network service that is not remote access or a web application.
| related-to |
T1008
|
Fallback Channels
|
action.hacking.vector.Other network service
|
Network service that is not remote access or a web application.
| related-to |
T1071
|
Application Layer Protocol
|
action.hacking.vector.Other network service
|
Network service that is not remote access or a web application.
| related-to |
T1090
|
Proxy
|
action.hacking.vector.Other network service
|
Network service that is not remote access or a web application.
| related-to |
T1095
|
Non-Application Layer Protocol
|
action.hacking.vector.Other network service
|
Network service that is not remote access or a web application.
| related-to |
T1102
|
Web Service
|
action.hacking.vector.Other network service
|
Network service that is not remote access or a web application.
| related-to |
T1104
|
Multi-Stage Channels
|
action.hacking.vector.Other network service
|
Network service that is not remote access or a web application.
| related-to |
T1105
|
Ingress Tool Transfer
|
action.hacking.vector.Partner
|
Partner connection or credential. (Indicates supply chain breach.)
| related-to |
T1195
|
Supply Chain Compromise
|
action.hacking.vector.Partner
|
Partner connection or credential. (Indicates supply chain breach.)
| related-to |
T1499.003
|
Application Exhaustion Flood
|
action.hacking.vector.Partner
|
Partner connection or credential. (Indicates supply chain breach.)
| related-to |
T1589.001
|
Credentials
|
action.hacking.vector.Partner
|
Partner connection or credential. (Indicates supply chain breach.)
| related-to |
T1499.002
|
Service Exhaustion Flood
|
action.hacking.vector.Partner
|
Partner connection or credential. (Indicates supply chain breach.)
| related-to |
T1199
|
Trusted Relationship
|
action.hacking.vector.Physical access
|
Physical access or connection (i.e., at keyboard or via cable)
| related-to |
T1200
|
Hardware Additions
|
action.hacking.vector.VPN
|
VPN
| related-to |
T1133
|
External Remote Services
|
action.hacking.vector.Web application
|
Web application
| related-to |
T1090.002
|
External Proxy
|
action.malware.variety.Adminware
|
System or network utilities (e.g., PsTools, Netcat)
| related-to |
T1072
|
Software Deployment Tools
|
action.malware.variety.Adware
|
Adware
| related-to |
T1199
|
Trusted Relationship
|
action.malware.variety.Backdoor
|
Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'.
| related-to |
T1037
|
Boot or Logon Initialization Scripts
|
action.malware.variety.Backdoor
|
Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'.
| related-to |
T1098
|
Account Manipulation
|
action.malware.variety.Backdoor
|
Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'.
| related-to |
T1133
|
External Remote Services
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1008
|
Fallback Channels
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1098
|
Account Manipulation
|
action.malware.variety.Brute force
|
Brute force attack
| related-to |
T1110
|
Brute Force
|
action.malware.variety.Brute force
|
Brute force attack
| related-to |
T1222.002
|
Linux and Mac File and Directory Permissions Modification
|
action.malware.variety.Brute force
|
Brute force attack
| related-to |
T1565.001
|
Stored Data Manipulation
|
action.malware.variety.Brute force
|
Brute force attack
| related-to |
T1021.003
|
Distributed Component Object Model
|
action.malware.variety.Brute force
|
Brute force attack
| related-to |
T1531
|
Account Access Removal
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1102.001
|
Dead Drop Resolver
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1008
|
Fallback Channels
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1071
|
Application Layer Protocol
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1584.007
|
Serverless
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1055.014
|
VDSO Hijacking
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1021
|
Remote Services
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1561
|
Disk Wipe
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1090
|
Proxy
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1566.003
|
Spearphishing via Service
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1110.003
|
Password Spraying
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1070.005
|
Network Share Connection Removal
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1578.005
|
Modify Cloud Compute Configurations
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1095
|
Non-Application Layer Protocol
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1102
|
Web Service
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1216
|
System Script Proxy Execution
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1036.003
|
Rename System Utilities
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1546.014
|
Emond
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1104
|
Multi-Stage Channels
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1132
|
Data Encoding
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1583.007
|
Serverless
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1485
|
Data Destruction
|
action.malware.variety.Capture app data
|
Capture data from application or system process
| related-to |
T1056
|
Input Capture
|
action.malware.variety.Capture app data
|
Capture data from application or system process
| related-to |
T1596.003
|
Digital Certificates
|
action.malware.variety.Capture app data
|
Capture data from application or system process
| related-to |
T1547.006
|
Kernel Modules and Extensions
|
action.malware.variety.Capture app data
|
Capture data from application or system process
| related-to |
T1090.002
|
External Proxy
|
action.malware.variety.Capture app data
|
Capture data from application or system process
| related-to |
T1546.017
|
Udev Rules
|
action.malware.variety.Capture app data
|
Capture data from application or system process
| related-to |
T1113
|
Screen Capture
|
action.malware.variety.Capture app data
|
Capture data from application or system process
| related-to |
T1114
|
Email Collection
|
action.malware.variety.Capture app data
|
Capture data from application or system process
| related-to |
T1110.002
|
Password Cracking
|
action.malware.variety.Capture app data
|
Capture data from application or system process
| related-to |
T1556.006
|
Multi-Factor Authentication
|
action.malware.variety.Capture app data
|
Capture data from application or system process
| related-to |
T1546.009
|
AppCert DLLs
|
action.malware.variety.Capture app data
|
Capture data from application or system process
| related-to |
T1123
|
Audio Capture
|
action.malware.variety.Capture app data
|
Capture data from application or system process
| related-to |
T1125
|
Video Capture
|
action.malware.variety.Capture app data
|
Capture data from application or system process
| related-to |
T1176
|
Browser Extensions
|
action.malware.variety.Capture app data
|
Capture data from application or system process
| related-to |
T1185
|
Browser Session Hijacking
|
action.malware.variety.Capture stored data
|
Capture data stored on system disk
| related-to |
T1114
|
Email Collection
|
action.malware.variety.Capture stored data
|
Capture data stored on system disk
| related-to |
T1587
|
Develop Capabilities
|
action.malware.variety.Capture stored data
|
Capture data stored on system disk
| related-to |
T1558.003
|
Kerberoasting
|
action.malware.variety.Capture stored data
|
Capture data stored on system disk
| related-to |
T1565.002
|
Transmitted Data Manipulation
|
action.malware.variety.Capture stored data
|
Capture data stored on system disk
| related-to |
T1005
|
Data from Local System
|
action.malware.variety.Capture stored data
|
Capture data stored on system disk
| related-to |
T1010
|
Application Window Discovery
|
action.malware.variety.Capture stored data
|
Capture data stored on system disk
| related-to |
T1025
|
Data from Removable Media
|
action.malware.variety.Capture stored data
|
Capture data stored on system disk
| related-to |
T1033
|
System Owner/User Discovery
|
action.malware.variety.Capture stored data
|
Capture data stored on system disk
| related-to |
T1039
|
Data from Network Shared Drive
|
action.malware.variety.Capture stored data
|
Capture data stored on system disk
| related-to |
T1083
|
File and Directory Discovery
|
action.malware.variety.Capture stored data
|
Capture data stored on system disk
| related-to |
T1119
|
Automated Collection
|
action.malware.variety.Client-side attack
|
Client-side or browser attack (e.g., redirection, XSS, AitB)
| related-to |
T1203
|
Exploitation for Client Execution
|
action.malware.variety.Destroy data
|
Destroy or corrupt stored data
| related-to |
T1542.002
|
Component Firmware
|
action.malware.variety.Destroy data
|
Destroy or corrupt stored data
| related-to |
T1092
|
Communication Through Removable Media
|
action.malware.variety.Destroy data
|
Destroy or corrupt stored data
| related-to |
T1566.002
|
Spearphishing Link
|
action.malware.variety.Destroy data
|
Destroy or corrupt stored data
| related-to |
T1600.001
|
Reduce Key Space
|
action.malware.variety.Destroy data
|
Destroy or corrupt stored data
| related-to |
T1027.010
|
Command Obfuscation
|
action.malware.variety.Destroy data
|
Destroy or corrupt stored data
| related-to |
T1496.001
|
Compute Hijacking
|
action.malware.variety.Destroy data
|
Destroy or corrupt stored data
| related-to |
T1218
|
System Binary Proxy Execution
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1006
|
Direct Volume Access
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1027
|
Obfuscated Files or Information
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1563
|
Remote Service Session Hijacking
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1111
|
Multi-Factor Authentication Interception
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1095
|
Non-Application Layer Protocol
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1499
|
Endpoint Denial of Service
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1059.011
|
Lua
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1036
|
Masquerading
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1505.004
|
IIS Components
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1562.007
|
Disable or Modify Cloud Firewall
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1195.002
|
Compromise Software Supply Chain
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1568
|
Dynamic Resolution
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1074.001
|
Local Data Staging
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1622
|
Debugger Evasion
|
action.malware.variety.Downloader
|
Downloader (pull updates or other malware)
| related-to |
T1204
|
User Execution
|
action.malware.variety.Downloader
|
Downloader (pull updates or other malware)
| related-to |
T1001.002
|
Steganography
|
action.malware.variety.Downloader
|
Downloader (pull updates or other malware)
| related-to |
T1559.002
|
Dynamic Data Exchange
|
action.malware.variety.Downloader
|
Downloader (pull updates or other malware)
| related-to |
T1027.005
|
Indicator Removal from Tools
|
action.malware.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1014
|
Rootkit
|
action.malware.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1036
|
Masquerading
|
action.malware.variety.Exploit misconfig
|
Exploit a misconfiguration (vs vuln or weakness)
| related-to |
T1068
|
Exploitation for Privilege Escalation
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1558.003
|
Kerberoasting
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1011
|
Exfiltration Over Other Network Medium
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1021.006
|
Windows Remote Management
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1020
|
Automated Exfiltration
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1055.004
|
Asynchronous Procedure Call
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1029
|
Scheduled Transfer
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1030
|
Data Transfer Size Limits
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1072
|
Software Deployment Tools
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1048
|
Exfiltration Over Alternative Protocol
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1070
|
Indicator Removal
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1552.006
|
Group Policy Preferences
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1213.005
|
Messaging Applications
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1052
|
Exfiltration Over Physical Medium
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1588.002
|
Tool
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1074
|
Data Staged
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1218.013
|
Mavinject
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1574.014
|
AppDomainManager
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1197
|
BITS Jobs
|
action.malware.variety.In-memory
|
(malware never stored to persistent storage)
| related-to |
T1115
|
Clipboard Data
|
action.malware.variety.In-memory
|
(malware never stored to persistent storage)
| related-to |
T1055
|
Process Injection
|
action.malware.variety.In-memory
|
(malware never stored to persistent storage)
| related-to |
T1053.002
|
At
|
action.malware.variety.In-memory
|
(malware never stored to persistent storage)
| related-to |
T1612
|
Build Image on Host
|
action.malware.variety.In-memory
|
(malware never stored to persistent storage)
| related-to |
T1560.002
|
Archive via Library
|
action.malware.variety.In-memory
|
(malware never stored to persistent storage)
| related-to |
T1036.004
|
Masquerade Task or Service
|
action.malware.variety.In-memory
|
(malware never stored to persistent storage)
| related-to |
T1538
|
Cloud Service Dashboard
|
action.malware.variety.In-memory
|
(malware never stored to persistent storage)
| related-to |
T1548.006
|
TCC Manipulation
|
action.malware.variety.In-memory
|
(malware never stored to persistent storage)
| related-to |
T1059.003
|
Windows Command Shell
|
action.malware.variety.In-memory
|
(malware never stored to persistent storage)
| related-to |
None
|
None
|
action.malware.variety.In-memory
|
(malware never stored to persistent storage)
| related-to |
T1585.001
|
Social Media Accounts
|
action.malware.variety.In-memory
|
(malware never stored to persistent storage)
| related-to |
T1125
|
Video Capture
|
action.malware.variety.In-memory
|
(malware never stored to persistent storage)
| related-to |
T1546.001
|
Change Default File Association
|
action.malware.variety.In-memory
|
(malware never stored to persistent storage)
| related-to |
T1115
|
Clipboard Data
|
action.malware.variety.Modify data
|
Malware which compromises a legitimate file rather than creating new filess
| related-to |
T1563.002
|
RDP Hijacking
|
action.malware.variety.Packet sniffer
|
Packet sniffer (capture data from network)
| related-to |
T1007
|
System Service Discovery
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1003
|
OS Credential Dumping
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1222
|
File and Directory Permissions Modification
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1114
|
Email Collection
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1587
|
Develop Capabilities
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1547
|
Boot or Logon Autostart Execution
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1598.004
|
Spearphishing Voice
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1558.003
|
Kerberoasting
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1115
|
Clipboard Data
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1565.002
|
Transmitted Data Manipulation
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1546.017
|
Udev Rules
|
action.malware.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1007
|
System Service Discovery
|
action.malware.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1012
|
Query Registry
|
action.malware.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1033
|
System Owner/User Discovery
|
action.malware.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1082
|
System Information Discovery
|
action.malware.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1083
|
File and Directory Discovery
|
action.malware.variety.RAM scraper
|
RAM scraper or memory parser (capture data from volatile memory)
| related-to |
T1222
|
File and Directory Permissions Modification
|
action.malware.variety.RAM scraper
|
RAM scraper or memory parser (capture data from volatile memory)
| related-to |
T1114
|
Email Collection
|
action.malware.variety.RAM scraper
|
RAM scraper or memory parser (capture data from volatile memory)
| related-to |
T1547
|
Boot or Logon Autostart Execution
|
action.malware.variety.RAM scraper
|
RAM scraper or memory parser (capture data from volatile memory)
| related-to |
T1598.004
|
Spearphishing Voice
|
action.malware.variety.Rootkit
|
Rootkit (maintain local privileges and stealth)
| related-to |
T1014
|
Rootkit
|
action.malware.variety.Rootkit
|
Rootkit (maintain local privileges and stealth)
| related-to |
T1195.002
|
Compromise Software Supply Chain
|
action.malware.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1016
|
System Network Configuration Discovery
|
action.malware.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1496.003
|
SMS Pumping
|
action.malware.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1018
|
Remote System Discovery
|
action.malware.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1007
|
System Service Discovery
|
action.malware.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1046
|
Network Service Discovery
|
action.malware.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1049
|
System Network Connections Discovery
|
action.malware.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1135
|
Network Share Discovery
|
action.malware.variety.Spyware/Keylogger
|
Spyware, keylogger or form-grabber (capture user input or activity)
| related-to |
T1546.017
|
Udev Rules
|
action.malware.variety.Trojan
|
An application which appears legitimate but hides malicious functionality. Child of 'RAT' when combined with 'Backdoor'
| related-to |
T1027.005
|
Indicator Removal from Tools
|
action.malware.variety.Unknown
|
Unknown
| related-to |
T1140
|
Deobfuscate/Decode Files or Information
|
action.malware.variety.Worm
|
Worm (propagate to other systems or devices)
| related-to |
T1080
|
Taint Shared Content
|
action.malware.variety.Worm
|
Worm (propagate to other systems or devices)
| related-to |
T1091
|
Replication Through Removable Media
|
action.malware.vector.Direct install
|
Directly installed or inserted by threat agent (after system access)
| related-to |
T1047
|
Windows Management Instrumentation
|
action.malware.vector.Email attachment
|
Email via user-executed attachment. Child of 'Email'
| related-to |
T1036
|
Masquerading
|
action.malware.vector.Email attachment
|
Email via user-executed attachment. Child of 'Email'
| related-to |
T1071.001
|
Web Protocols
|
action.malware.vector.Email attachment
|
Email via user-executed attachment. Child of 'Email'
| related-to |
T1546.013
|
PowerShell Profile
|
action.malware.vector.Email attachment
|
Email via user-executed attachment. Child of 'Email'
| related-to |
T1203
|
Exploitation for Client Execution
|
action.malware.vector.Email attachment
|
Email via user-executed attachment. Child of 'Email'
| related-to |
T1559.002
|
Dynamic Data Exchange
|
action.malware.vector.Email link
|
Email via embedded link. Child of 'Email'
| related-to |
T1598.004
|
Spearphishing Voice
|
action.malware.vector.Email link
|
Email via embedded link. Child of 'Email'
| related-to |
T1001.002
|
Steganography
|
action.malware.vector.Network propagation
|
Network propagation
| related-to |
T1021
|
Remote Services
|
action.malware.vector.Partner
|
Partner connection or credential. (Indicates supply chain breach.)
| related-to |
T1195
|
Supply Chain Compromise
|
action.malware.vector.Partner
|
Partner connection or credential. (Indicates supply chain breach.)
| related-to |
T1199
|
Trusted Relationship
|
action.malware.vector.Remote injection
|
Remotely injected by agent (i.e. via SQLi)
| related-to |
T1133
|
External Remote Services
|
action.malware.vector.Removable media
|
Removable storage media or devices
| related-to |
T1091
|
Replication Through Removable Media
|
action.malware.vector.Removable media
|
Removable storage media or devices
| related-to |
T1092
|
Communication Through Removable Media
|
action.malware.vector.Software update
|
Included in automated software update
| related-to |
T1072
|
Software Deployment Tools
|
action.malware.vector.Software update
|
Included in automated software update
| related-to |
T1195
|
Supply Chain Compromise
|
action.malware.vector.Web application
|
Web application. Parent of 'Web application - download' and 'Web application - drive-by.
| related-to |
T1133
|
External Remote Services
|
action.malware.vector.Web application - drive-by
|
Web via auto-executed or "drive-by" infection. Child of 'Web application'.
| related-to |
T1176
|
Browser Extensions
|
action.malware.vector.Web application - drive-by
|
Web via auto-executed or "drive-by" infection. Child of 'Web application'.
| related-to |
T1189
|
Drive-by Compromise
|
action.social.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1014
|
Rootkit
|
action.social.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1036
|
Masquerading
|
action.social.variety.Forgery
|
Forgery or counterfeiting (fake hardware, software, documents, etc)
| related-to |
T1562.007
|
Disable or Modify Cloud Firewall
|
action.social.variety.Phishing
|
Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting.
| related-to |
T1562.007
|
Disable or Modify Cloud Firewall
|
action.social.variety.Phishing
|
Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting.
| related-to |
T1204
|
User Execution
|
action.social.variety.Phishing
|
Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting.
| related-to |
T1001.002
|
Steganography
|
action.social.variety.Phishing
|
Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting.
| related-to |
T1559.002
|
Dynamic Data Exchange
|
action.social.variety.Phishing
|
Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting.
| related-to |
T1027.005
|
Indicator Removal from Tools
|
action.social.variety.Pretexting
|
Pretexting (dialogue leveraging invented scenario). Unlike 'Phishing', does not transfer data. (A fraudulent transfer or changing a bank account on a business account is not really disclosing data.
| related-to |
T1027.005
|
Indicator Removal from Tools
|
action.social.vector.Email
|
Email
| related-to |
T1204
|
User Execution
|
action.social.vector.Email
|
Email
| related-to |
T1001.002
|
Steganography
|
action.social.vector.Email
|
Email
| related-to |
T1559.002
|
Dynamic Data Exchange
|
action.social.vector.Email
|
Email
| related-to |
T1027.005
|
Indicator Removal from Tools
|
action.social.vector.Partner
|
Partner connection or credential. (Indicates supply chain breach.)
| related-to |
T1499.002
|
Service Exhaustion Flood
|
action.social.vector.Partner
|
Partner connection or credential. (Indicates supply chain breach.)
| related-to |
T1199
|
Trusted Relationship
|
action.social.vector.Removable media
|
Removable storage media
| related-to |
T1091
|
Replication Through Removable Media
|
action.social.vector.Social media
|
Social media or networking
| related-to |
T1204
|
User Execution
|
action.social.vector.Social media
|
Social media or networking
| related-to |
T1001.002
|
Steganography
|
action.social.vector.Social media
|
Social media or networking
| related-to |
T1559.002
|
Dynamic Data Exchange
|
action.social.vector.Social media
|
Social media or networking
| related-to |
T1027.005
|
Indicator Removal from Tools
|
action.social.vector.Software
|
Software
| related-to |
T1499.003
|
Application Exhaustion Flood
|
action.social.vector.Software
|
Software
| related-to |
T1589.001
|
Credentials
|
action.social.vector.Web application
|
Web application
| related-to |
T1189
|
Drive-by Compromise
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1003
|
OS Credential Dumping
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1222
|
File and Directory Permissions Modification
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1114
|
Email Collection
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1587
|
Develop Capabilities
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1547
|
Boot or Logon Autostart Execution
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1598.004
|
Spearphishing Voice
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1558.003
|
Kerberoasting
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1115
|
Clipboard Data
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1003.008
|
/etc/passwd and /etc/shadow
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1005
|
Data from Local System
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1011
|
Exfiltration Over Other Network Medium
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1011.001
|
Exfiltration Over Bluetooth
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1020
|
Automated Exfiltration
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1020.001
|
Traffic Duplication
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1025
|
Data from Removable Media
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1029
|
Scheduled Transfer
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1030
|
Data Transfer Size Limits
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1039
|
Data from Network Shared Drive
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1040
|
Network Sniffing
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1041
|
Exfiltration Over C2 Channel
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1048
|
Exfiltration Over Alternative Protocol
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1048.001
|
Exfiltration Over Symmetric Encrypted Non-C2 Protocol
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1048.002
|
Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1048.003
|
Exfiltration Over Unencrypted Non-C2 Protocol
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1052
|
Exfiltration Over Physical Medium
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1052.001
|
Exfiltration over USB
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1056
|
Input Capture
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1056.001
|
Keylogging
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1056.002
|
GUI Input Capture
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1056.003
|
Web Portal Capture
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1056.004
|
Credential API Hooking
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1113
|
Screen Capture
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1114
|
Email Collection
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1114.001
|
Local Email Collection
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1114.002
|
Remote Email Collection
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1114.003
|
Email Forwarding Rule
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1115
|
Clipboard Data
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1119
|
Automated Collection
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1123
|
Audio Capture
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1125
|
Video Capture
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1187
|
Forced Authentication
|
attribute.integrity.variety.Alter behavior
|
Influence or alter human behavior
| related-to |
T1114.003
|
Email Forwarding Rule
|
attribute.integrity.variety.Created account
|
Created new user account
| related-to |
T1136
|
Create Account
|
attribute.integrity.variety.Created account
|
Created new user account
| related-to |
T1136.001
|
Local Account
|
attribute.integrity.variety.Created account
|
Created new user account
| related-to |
T1136.002
|
Domain Account
|
attribute.integrity.variety.Created account
|
Created new user account
| related-to |
T1136.003
|
Cloud Account
|
attribute.integrity.variety.Log tampering
|
Log tampering or modification
| related-to |
T1070.001
|
Clear Windows Event Logs
|
attribute.integrity.variety.Log tampering
|
Log tampering or modification
| related-to |
T1070.002
|
Clear Linux or Mac System Logs
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1037
|
Boot or Logon Initialization Scripts
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1037.001
|
Logon Script (Windows)
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1037.002
|
Login Hook
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1037.003
|
Network Logon Script
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1037.004
|
RC Scripts
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1037.005
|
Startup Items
|
attribute.integrity.variety.Modify privileges
|
Modified privileges or permissions
| related-to |
T1098
|
Account Manipulation
|
attribute.integrity.variety.Modify privileges
|
Modified privileges or permissions
| related-to |
T1098.001
|
Additional Cloud Credentials
|
attribute.integrity.variety.Modify privileges
|
Modified privileges or permissions
| related-to |
T1098.002
|
Additional Email Delegate Permissions
|
attribute.integrity.variety.Modify privileges
|
Modified privileges or permissions
| related-to |
T1098.003
|
Additional Cloud Roles
|
attribute.integrity.variety.Modify privileges
|
Modified privileges or permissions
| related-to |
T1098.004
|
SSH Authorized Keys
|
attribute.integrity.variety.Software installation
|
Software installation or code modification
| related-to |
T1072
|
Software Deployment Tools
|
attribute.integrity.variety.Software installation
|
Software installation or code modification
| related-to |
T1080
|
Taint Shared Content
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1205
|
Traffic Signaling
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1205
|
Traffic Signaling
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1218.011
|
Rundll32
|
action.malware.variety.Backdoor
|
Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'.
| related-to |
T1205.001
|
Port Knocking
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1205.001
|
Port Knocking
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1205.001
|
Port Knocking
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1218.012
|
Verclsid
|
action.malware.variety.Capture app data
|
Capture data from application or system process
| related-to |
T1207
|
Rogue Domain Controller
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1218.013
|
Mavinject
|
action.malware.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1211
|
Exploitation for Defense Evasion
|
action.social.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1211
|
Exploitation for Defense Evasion
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1218.014
|
MMC
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1218.015
|
Electron Applications
|
action.hacking.vector.Desktop sharing software
|
Superset of 'Desktop sharing' and '3rd party desktop'. Please use in place of the other two
| related-to |
T1219
|
Remote Access Software
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1212
|
Exploitation for Credential Access
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1212
|
Exploitation for Credential Access
|
action.malware.vector.Web application - drive-by
|
Web via auto-executed or "drive-by" infection. Child of 'Web application'.
| related-to |
T1212
|
Exploitation for Credential Access
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1212
|
Exploitation for Credential Access
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1220
|
XSL Script Processing
|
action.malware.variety.Capture stored data
|
Capture data stored on system disk
| related-to |
T1213
|
Data from Information Repositories
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1213
|
Data from Information Repositories
|
action.malware.variety.Capture stored data
|
Capture data stored on system disk
| related-to |
T1213.001
|
Confluence
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1213.001
|
Confluence
|
action.malware.variety.Capture stored data
|
Capture data stored on system disk
| related-to |
T1213.002
|
Sharepoint
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1213.002
|
Sharepoint
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1213.003
|
Code Repositories
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1213.004
|
Customer Relationship Management Software
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1213.005
|
Messaging Applications
|
action.hacking.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1480
|
Execution Guardrails
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1480
|
Execution Guardrails
|
action.hacking.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1480.001
|
Environmental Keying
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1480.001
|
Environmental Keying
|
action.hacking.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1480.002
|
Mutual Exclusion
|
action.hacking.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1489
|
Service Stop
|
action.hacking.variety.Hijack
|
To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes)
| related-to |
T1496
|
Resource Hijacking
|
action.hacking.variety.Hijack
|
To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes)
| related-to |
T1496.001
|
Compute Hijacking
|
action.hacking.variety.Hijack
|
To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes)
| related-to |
T1496.002
|
Bandwidth Hijacking
|
action.hacking.variety.Hijack
|
To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes)
| related-to |
T1496.003
|
SMS Pumping
|
action.hacking.variety.Hijack
|
To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes)
| related-to |
T1496.004
|
Cloud Service Hijacking
|
action.hacking.vector.Hypervisor
|
Hypervisor break-out attack
| related-to |
T1497
|
Virtualization/Sandbox Evasion
|
action.hacking.vector.Inter-tenant
|
Penetration of another VM or web site on shared device or infrastructure
| related-to |
T1497
|
Virtualization/Sandbox Evasion
|
action.hacking.variety.DoS
|
Denial of service
| related-to |
T1498
|
Network Denial of Service
|
action.hacking.variety.DoS
|
Denial of service
| related-to |
T1498.001
|
Direct Network Flood
|
action.hacking.variety.DoS
|
Denial of service
| related-to |
T1498.002
|
Reflection Amplification
|
action.hacking.variety.DoS
|
Denial of service
| related-to |
T1499
|
Endpoint Denial of Service
|
action.hacking.variety.Soap array abuse
|
Soap array abuse. Child of 'Exploit vuln'.
| related-to |
T1499
|
Endpoint Denial of Service
|
action.hacking.variety.XML external entities
|
XML external entities. Child of 'Exploit vuln'.
| related-to |
T1499
|
Endpoint Denial of Service
|
action.malware.variety.Adminware
|
System or network utilities (e.g., PsTools, Netcat)
| related-to |
T1219
|
Remote Access Software
|
action.hacking.variety.DoS
|
Denial of service
| related-to |
T1499.001
|
OS Exhaustion Flood
|
action.malware.variety.Client-side attack
|
Client-side or browser attack (e.g., redirection, XSS, AitB)
| related-to |
T1221
|
Template Injection
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1222
|
File and Directory Permissions Modification
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1222.001
|
Windows File and Directory Permissions Modification
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1222.002
|
Linux and Mac File and Directory Permissions Modification
|
action.hacking.variety.DoS
|
Denial of service
| related-to |
T1499.002
|
Service Exhaustion Flood
|
action.hacking.variety.DoS
|
Denial of service
| related-to |
T1499.003
|
Application Exhaustion Flood
|
action.hacking.variety.DoS
|
Denial of service
| related-to |
T1499.004
|
Application or System Exploitation
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1505.001
|
SQL Stored Procedures
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1505.002
|
Transport Agent
|
action.malware.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1482
|
Domain Trust Discovery
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1484
|
Domain or Tenant Policy Modification
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1484.001
|
Group Policy Modification
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1484.002
|
Trust Modification
|
action.malware.variety.Destroy data
|
Destroy or corrupt stored data
| related-to |
T1485
|
Data Destruction
|
attribute.availability.variety.Destruction
|
Destruction
| related-to |
T1485
|
Data Destruction
|
attribute.availability.variety.Interruption
|
Interruption
| related-to |
T1485
|
Data Destruction
|
action.malware.variety.Destroy data
|
Destroy or corrupt stored data
| related-to |
T1485.001
|
Lifecycle-Triggered Deletion
|
attribute.availability.variety.Destruction
|
Destruction
| related-to |
T1485.001
|
Lifecycle-Triggered Deletion
|
attribute.availability.variety.Interruption
|
Interruption
| related-to |
T1485.001
|
Lifecycle-Triggered Deletion
|
action.malware.variety.Ransomware
|
Ransomware (encrypt or seize stored data)
| related-to |
T1486
|
Data Encrypted for Impact
|
attribute.availability.variety.Interruption
|
Interruption
| related-to |
T1486
|
Data Encrypted for Impact
|
attribute.availability.variety.Obscuration
|
Conversion or obscuration (ransomware)
| related-to |
T1486
|
Data Encrypted for Impact
|
action.hacking.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1518
|
Software Discovery
|
action.malware.variety.DoS
|
DoS attack
| related-to |
T1489
|
Service Stop
|
attribute.availability.variety.Interruption
|
Interruption
| related-to |
T1489
|
Service Stop
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1490
|
Inhibit System Recovery
|
action.malware.variety.Ransomware
|
Ransomware (encrypt or seize stored data)
| related-to |
T1490
|
Inhibit System Recovery
|
attribute.availability.variety.Loss
|
Loss
| related-to |
T1490
|
Inhibit System Recovery
|
attribute.availability.variety.Obscuration
|
Conversion or obscuration (ransomware)
| related-to |
T1491
|
Defacement
|
attribute.integrity.variety.Defacement
|
Deface content
| related-to |
T1491
|
Defacement
|
attribute.availability.variety.Obscuration
|
Conversion or obscuration (ransomware)
| related-to |
T1491.001
|
Internal Defacement
|
attribute.integrity.variety.Defacement
|
Deface content
| related-to |
T1491.001
|
Internal Defacement
|
attribute.availability.variety.Obscuration
|
Conversion or obscuration (ransomware)
| related-to |
T1491.002
|
External Defacement
|
attribute.integrity.variety.Defacement
|
Deface content
| related-to |
T1491.002
|
External Defacement
|
action.malware.variety.Destroy data
|
Destroy or corrupt stored data
| related-to |
T1495
|
Firmware Corruption
|
attribute.availability.variety.Destruction
|
Destruction
| related-to |
T1495
|
Firmware Corruption
|
attribute.availability.variety.Interruption
|
Interruption
| related-to |
T1495
|
Firmware Corruption
|
attribute.availability.variety.Loss
|
Loss
| related-to |
T1495
|
Firmware Corruption
|
action.hacking.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1518.001
|
Security Software Discovery
|
action.malware.variety.Click fraud
|
Click fraud, whether or not cryptocurrency mining. Also mark 'Click fraud or cryptocurrency mining'. Child of 'Click fraud and cryptocurrency mining'.
| related-to |
T1496
|
Resource Hijacking
|
action.malware.variety.Click fraud and cryptocurrency mining
|
Click fraud or cryptocurrency mining. Parent of 'Click fraud' and 'Cryptocurrency mining'.
| related-to |
T1496
|
Resource Hijacking
|
action.malware.variety.Cryptocurrency mining
|
Cryptocurrency mining, whether or not click fraud. Child of 'Click fraud and cryptocurrency mining'.
| related-to |
T1496
|
Resource Hijacking
|
action.malware.variety.Click fraud and cryptocurrency mining
|
Click fraud or cryptocurrency mining. Parent of 'Click fraud' and 'Cryptocurrency mining'.
| related-to |
T1496.001
|
Compute Hijacking
|
action.malware.variety.Cryptocurrency mining
|
Cryptocurrency mining, whether or not click fraud. Child of 'Click fraud and cryptocurrency mining'.
| related-to |
T1496.001
|
Compute Hijacking
|
attribute.availability.variety.Degradation
|
Performance degradation
| related-to |
T1496
|
Resource Hijacking
|
action.hacking.variety.Backdoor
|
Hacking action that creates a backdoor for use.
| related-to |
T1525
|
Implant Internal Image
|
action.hacking.vector.Backdoor
|
Hacking actions taken through a backdoor. C2 is only used by malware.
| related-to |
T1525
|
Implant Internal Image
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1526
|
Cloud Service Discovery
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1529
|
System Shutdown/Reboot
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1531
|
Account Access Removal
|
action.hacking.variety.Forced browsing
|
Forced browsing or predictable resource location. Child of 'Exploit vuln'.
| related-to |
T1539
|
Steal Web Session Cookie
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1497
|
Virtualization/Sandbox Evasion
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1497.001
|
System Checks
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1497.002
|
User Activity Based Checks
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1497.003
|
Time Based Evasion
|
action.hacking.variety.AiTM
|
Adversary-in-the-middle attack. Child of 'Exploit vuln'
| related-to |
T1539
|
Steal Web Session Cookie
|
action.malware.variety.DoS
|
DoS attack
| related-to |
T1498
|
Network Denial of Service
|
attribute.availability.variety.Degradation
|
Performance degradation
| related-to |
T1498
|
Network Denial of Service
|
attribute.availability.variety.Loss
|
Loss
| related-to |
T1498
|
Network Denial of Service
|
action.hacking.variety.Session replay
|
Session replay. Child of 'Exploit vuln'.
| related-to |
T1539
|
Steal Web Session Cookie
|
action.malware.variety.DoS
|
DoS attack
| related-to |
T1498.001
|
Direct Network Flood
|
attribute.availability.variety.Degradation
|
Performance degradation
| related-to |
T1498.001
|
Direct Network Flood
|
attribute.availability.variety.Loss
|
Loss
| related-to |
T1498.001
|
Direct Network Flood
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1543
|
Create or Modify System Process
|
action.malware.variety.DoS
|
DoS attack
| related-to |
T1498.002
|
Reflection Amplification
|
attribute.availability.variety.Degradation
|
Performance degradation
| related-to |
T1498.002
|
Reflection Amplification
|
attribute.availability.variety.Loss
|
Loss
| related-to |
T1498.002
|
Reflection Amplification
|
action.hacking.variety.Backdoor
|
Hacking action that creates a backdoor for use.
| related-to |
T1543
|
Create or Modify System Process
|
action.hacking.vector.Backdoor
|
Hacking actions taken through a backdoor. C2 is only used by malware.
| related-to |
T1543
|
Create or Modify System Process
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1543.001
|
Launch Agent
|
action.malware.variety.DoS
|
DoS attack
| related-to |
T1499
|
Endpoint Denial of Service
|
attribute.availability.variety.Degradation
|
Performance degradation
| related-to |
T1499
|
Endpoint Denial of Service
|
attribute.availability.variety.Loss
|
Loss
| related-to |
T1499
|
Endpoint Denial of Service
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1543.002
|
Systemd Service
|
action.malware.variety.DoS
|
DoS attack
| related-to |
T1499.001
|
OS Exhaustion Flood
|
attribute.availability.variety.Degradation
|
Performance degradation
| related-to |
T1499.001
|
OS Exhaustion Flood
|
attribute.availability.variety.Loss
|
Loss
| related-to |
T1499.001
|
OS Exhaustion Flood
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1543.003
|
Windows Service
|
action.malware.variety.DoS
|
DoS attack
| related-to |
T1499.002
|
Service Exhaustion Flood
|
attribute.availability.variety.Degradation
|
Performance degradation
| related-to |
T1499.002
|
Service Exhaustion Flood
|
attribute.availability.variety.Loss
|
Loss
| related-to |
T1499.002
|
Service Exhaustion Flood
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1543.004
|
Launch Daemon
|
action.malware.variety.DoS
|
DoS attack
| related-to |
T1499.003
|
Application Exhaustion Flood
|
attribute.availability.variety.Degradation
|
Performance degradation
| related-to |
T1499.003
|
Application Exhaustion Flood
|
attribute.availability.variety.Loss
|
Loss
| related-to |
T1499.003
|
Application Exhaustion Flood
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1543.005
|
Container Service
|
action.malware.variety.DoS
|
DoS attack
| related-to |
T1499.004
|
Application or System Exploitation
|
attribute.availability.variety.Degradation
|
Performance degradation
| related-to |
T1499.004
|
Application or System Exploitation
|
attribute.availability.variety.Loss
|
Loss
| related-to |
T1499.004
|
Application or System Exploitation
|
action.malware.variety.Backdoor
|
Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'.
| related-to |
T1505
|
Server Software Component
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1505
|
Server Software Component
|
action.hacking.variety.Backdoor
|
Hacking action that creates a backdoor for use.
| related-to |
T1546
|
Event Triggered Execution
|
action.malware.variety.Backdoor
|
Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'.
| related-to |
T1505.001
|
SQL Stored Procedures
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1505.001
|
SQL Stored Procedures
|
action.hacking.variety.XML injection
|
XML injection. Child of 'Exploit vuln'.
| related-to |
T1546
|
Event Triggered Execution
|
action.malware.variety.Backdoor
|
Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'.
| related-to |
T1505.002
|
Transport Agent
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1505.002
|
Transport Agent
|
action.malware.variety.Backdoor
|
Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'.
| related-to |
T1505.003
|
Web Shell
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1505.003
|
Web Shell
|
action.hacking.vector.Backdoor
|
Hacking actions taken through a backdoor. C2 is only used by malware.
| related-to |
T1546
|
Event Triggered Execution
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1547
|
Boot or Logon Autostart Execution
|
action.hacking.variety.Backdoor
|
Hacking action that creates a backdoor for use.
| related-to |
T1547
|
Boot or Logon Autostart Execution
|
action.hacking.vector.Backdoor
|
Hacking actions taken through a backdoor. C2 is only used by malware.
| related-to |
T1547
|
Boot or Logon Autostart Execution
|
action.malware.variety.Backdoor
|
Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'.
| related-to |
T1525
|
Implant Internal Image
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1525
|
Implant Internal Image
|
action.malware.variety.RAT
|
Remote Access Trojan. Parent of 'Backdoor' and 'Trojan'
| related-to |
T1525
|
Implant Internal Image
|
action.malware.variety.Unknown
|
Unknown
| related-to |
T1525
|
Implant Internal Image
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1548
|
Abuse Elevation Control Mechanism
|
action.malware.variety.Capture app data
|
Capture data from application or system process
| related-to |
T1528
|
Steal Application Access Token
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1548.001
|
Setuid and Setgid
|
attribute.availability.variety.Interruption
|
Interruption
| related-to |
T1529
|
System Shutdown/Reboot
|
action.malware.variety.Capture stored data
|
Capture data stored on system disk
| related-to |
T1530
|
Data from Cloud Storage
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1530
|
Data from Cloud Storage
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1548.002
|
Bypass User Account Control
|
attribute.availability.variety.Destruction
|
Destruction
| related-to |
T1531
|
Account Access Removal
|
attribute.availability.variety.Interruption
|
Interruption
| related-to |
T1531
|
Account Access Removal
|
attribute.integrity.variety.Unknown
|
Unknown
| related-to |
T1531
|
Account Access Removal
|
action.social.variety.Pretexting
|
Pretexting (dialogue leveraging invented scenario). Unlike 'Phishing', does not transfer data. (A fraudulent transfer or changing a bank account on a business account is not really disclosing data.
| related-to |
T1534
|
Internal Spearphishing
|
attribute.integrity.variety.Misrepresentation
|
compromise of authenticity (e.g. masquerading as the legitimate owner of an account)
| related-to |
T1534
|
Internal Spearphishing
|
attribute.integrity.variety.Repurpose
|
Repurposed asset for unauthorized function
| related-to |
T1535
|
Unused/Unsupported Cloud Regions
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1537
|
Transfer Data to Cloud Account
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1537
|
Transfer Data to Cloud Account
|
action.hacking.variety.Exploit misconfig
|
Exploit a misconfiguration (vs vuln or weakness)
| related-to |
T1548.002
|
Bypass User Account Control
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1548.003
|
Sudo and Sudo Caching
|
action.hacking.variety.Exploit misconfig
|
Exploit a misconfiguration (vs vuln or weakness)
| related-to |
T1548.003
|
Sudo and Sudo Caching
|
action.malware.variety.Capture app data
|
Capture data from application or system process
| related-to |
T1539
|
Steal Web Session Cookie
|
action.malware.variety.Rootkit
|
Rootkit (maintain local privileges and stealth)
| related-to |
T1542
|
Pre-OS Boot
|
action.malware.variety.Rootkit
|
Rootkit (maintain local privileges and stealth)
| related-to |
T1542.001
|
System Firmware
|
action.malware.variety.Rootkit
|
Rootkit (maintain local privileges and stealth)
| related-to |
T1542.002
|
Component Firmware
|
action.malware.variety.Rootkit
|
Rootkit (maintain local privileges and stealth)
| related-to |
T1542.003
|
Bootkit
|
action.malware.variety.Rootkit
|
Rootkit (maintain local privileges and stealth)
| related-to |
T1542.004
|
ROMMONkit
|
action.malware.variety.Rootkit
|
Rootkit (maintain local privileges and stealth)
| related-to |
T1542.005
|
TFTP Boot
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1548.004
|
Elevated Execution with Prompt
|
action.malware.variety.Backdoor
|
Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'.
| related-to |
T1543
|
Create or Modify System Process
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1543
|
Create or Modify System Process
|
action.malware.variety.Rootkit
|
Rootkit (maintain local privileges and stealth)
| related-to |
T1543
|
Create or Modify System Process
|
attribute.integrity.variety.Software installation
|
Software installation or code modification
| related-to |
T1543
|
Create or Modify System Process
|
action.hacking.variety.Exploit misconfig
|
Exploit a misconfiguration (vs vuln or weakness)
| related-to |
T1548.004
|
Elevated Execution with Prompt
|
attribute.integrity.variety.Software installation
|
Software installation or code modification
| related-to |
T1543.001
|
Launch Agent
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1548.005
|
Temporary Elevated Cloud Access
|
attribute.integrity.variety.Software installation
|
Software installation or code modification
| related-to |
T1543.002
|
Systemd Service
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1548.006
|
TCC Manipulation
|
action.malware.variety.RAT
|
Remote Access Trojan. Parent of 'Backdoor' and 'Trojan'
| related-to |
T1543.003
|
Windows Service
|
attribute.integrity.variety.Software installation
|
Software installation or code modification
| related-to |
T1543.003
|
Windows Service
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1550
|
Use Alternate Authentication Material
|
attribute.integrity.variety.Software installation
|
Software installation or code modification
| related-to |
T1543.004
|
Launch Daemon
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1550.001
|
Application Access Token
|
action.hacking.variety.Pass-the-hash
|
Pass-the-hash
| related-to |
T1550.002
|
Pass the Hash
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1550.002
|
Pass the Hash
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1550.003
|
Pass the Ticket
|
action.malware.variety.Backdoor
|
Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'.
| related-to |
T1546
|
Event Triggered Execution
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1546
|
Event Triggered Execution
|
attribute.integrity.variety.Alter behavior
|
Influence or alter human behavior
| related-to |
T1546
|
Event Triggered Execution
|
attribute.integrity.variety.Alter behavior
|
Influence or alter human behavior
| related-to |
T1546.001
|
Change Default File Association
|
attribute.integrity.variety.Alter behavior
|
Influence or alter human behavior
| related-to |
T1546.002
|
Screensaver
|
attribute.integrity.variety.Alter behavior
|
Influence or alter human behavior
| related-to |
T1546.003
|
Windows Management Instrumentation Event Subscription
|
attribute.integrity.variety.Alter behavior
|
Influence or alter human behavior
| related-to |
T1546.004
|
Unix Shell Configuration Modification
|
attribute.integrity.variety.Alter behavior
|
Influence or alter human behavior
| related-to |
T1546.005
|
Trap
|
attribute.integrity.variety.Alter behavior
|
Influence or alter human behavior
| related-to |
T1546.006
|
LC_LOAD_DYLIB Addition
|
attribute.integrity.variety.Alter behavior
|
Influence or alter human behavior
| related-to |
T1546.007
|
Netsh Helper DLL
|
attribute.integrity.variety.Alter behavior
|
Influence or alter human behavior
| related-to |
T1546.008
|
Accessibility Features
|
attribute.integrity.variety.Alter behavior
|
Influence or alter human behavior
| related-to |
T1546.009
|
AppCert DLLs
|
attribute.integrity.variety.Alter behavior
|
Influence or alter human behavior
| related-to |
T1546.010
|
AppInit DLLs
|
attribute.integrity.variety.Alter behavior
|
Influence or alter human behavior
| related-to |
T1546.011
|
Application Shimming
|
attribute.integrity.variety.Alter behavior
|
Influence or alter human behavior
| related-to |
T1546.012
|
Image File Execution Options Injection
|
attribute.integrity.variety.Alter behavior
|
Influence or alter human behavior
| related-to |
T1546.013
|
PowerShell Profile
|
attribute.integrity.variety.Alter behavior
|
Influence or alter human behavior
| related-to |
T1546.014
|
Emond
|
attribute.integrity.variety.Alter behavior
|
Influence or alter human behavior
| related-to |
T1546.015
|
Component Object Model Hijacking
|
attribute.integrity.variety.Software installation
|
Software installation or code modification
| related-to |
T1546.016
|
Installer Packages
|
action.hacking.variety.Session replay
|
Session replay. Child of 'Exploit vuln'.
| related-to |
T1550.004
|
Web Session Cookie
|
action.malware.variety.Backdoor
|
Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'.
| related-to |
T1547
|
Boot or Logon Autostart Execution
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1547
|
Boot or Logon Autostart Execution
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1547
|
Boot or Logon Autostart Execution
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1547.001
|
Registry Run Keys / Startup Folder
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1547.002
|
Authentication Package
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1547.003
|
Time Providers
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1547.004
|
Winlogon Helper DLL
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1547.005
|
Security Support Provider
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1547.006
|
Kernel Modules and Extensions
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1547.007
|
Re-opened Applications
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1547.008
|
LSASS Driver
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1547.009
|
Shortcut Modification
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1547.010
|
Port Monitors
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1547.012
|
Print Processors
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1547.013
|
XDG Autostart Entries
|
attribute.integrity.variety.Modify privileges
|
Modified privileges or permissions
| related-to |
T1547.014
|
Active Setup
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1550.004
|
Web Session Cookie
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1553
|
Subvert Trust Controls
|
action.hacking.variety.Backdoor
|
Hacking action that creates a backdoor for use.
| related-to |
T1554
|
Compromise Host Software Binary
|
action.malware.variety.Exploit misconfig
|
Exploit a misconfiguration (vs vuln or weakness)
| related-to |
T1548.002
|
Bypass User Account Control
|
action.hacking.vector.Backdoor
|
Hacking actions taken through a backdoor. C2 is only used by malware.
| related-to |
T1554
|
Compromise Host Software Binary
|
action.malware.variety.Client-side attack
|
Client-side or browser attack (e.g., redirection, XSS, AitB)
| related-to |
T1548.003
|
Sudo and Sudo Caching
|
action.hacking.variety.Backdoor
|
Hacking action that creates a backdoor for use.
| related-to |
T1556
|
Modify Authentication Process
|
action.hacking.vector.Backdoor
|
Hacking actions taken through a backdoor. C2 is only used by malware.
| related-to |
T1556
|
Modify Authentication Process
|
action.hacking.variety.AiTM
|
Adversary-in-the-middle attack. Child of 'Exploit vuln'
| related-to |
T1557
|
Adversary-in-the-Middle
|
action.hacking.variety.Routing detour
|
Routing detour. Child of 'Exploit vuln'.
| related-to |
T1557
|
Adversary-in-the-Middle
|
action.malware.variety.Pass-the-hash
|
Pass-the-hash
| related-to |
T1550
|
Use Alternate Authentication Material
|
action.malware.vector.Network propagation
|
Network propagation
| related-to |
T1550
|
Use Alternate Authentication Material
|
action.hacking.variety.AiTM
|
Adversary-in-the-middle attack. Child of 'Exploit vuln'
| related-to |
T1557.001
|
LLMNR/NBT-NS Poisoning and SMB Relay
|
action.hacking.variety.Cache poisoning
|
Cache poisoning. Child of 'Exploit vuln'.
| related-to |
T1557.002
|
ARP Cache Poisoning
|
action.hacking.variety.AiTM
|
Adversary-in-the-middle attack. Child of 'Exploit vuln'
| related-to |
T1557.002
|
ARP Cache Poisoning
|
action.malware.variety.Pass-the-hash
|
Pass-the-hash
| related-to |
T1550.002
|
Pass the Hash
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1550.002
|
Pass the Hash
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1558
|
Steal or Forge Kerberos Tickets
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1558.001
|
Golden Ticket
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1558.002
|
Silver Ticket
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1552
|
Unsecured Credentials
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1552.001
|
Credentials In Files
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1552.001
|
Credentials In Files
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1552.002
|
Credentials in Registry
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1552.002
|
Credentials in Registry
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1552.003
|
Bash History
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1552.003
|
Bash History
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1552.004
|
Private Keys
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1552.004
|
Private Keys
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1552.005
|
Cloud Instance Metadata API
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1552.005
|
Cloud Instance Metadata API
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1552.006
|
Group Policy Preferences
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1552.006
|
Group Policy Preferences
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1552.007
|
Container API
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1552.008
|
Chat Messages
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1552.008
|
Chat Messages
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1558.003
|
Kerberoasting
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1553
|
Subvert Trust Controls
|
action.malware.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1553
|
Subvert Trust Controls
|
action.social.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1553
|
Subvert Trust Controls
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1553.001
|
Gatekeeper Bypass
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1553.002
|
Code Signing
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1553.003
|
SIP and Trust Provider Hijacking
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1553.004
|
Install Root Certificate
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1553.005
|
Mark-of-the-Web Bypass
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1553.006
|
Code Signing Policy Modification
|
action.hacking.variety.Exploit misconfig
|
Exploit a misconfiguration (vs vuln or weakness)
| related-to |
T1558.004
|
AS-REP Roasting
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1558.004
|
AS-REP Roasting
|
action.malware.variety.Adminware
|
System or network utilities (e.g., PsTools, Netcat)
| related-to |
T1554
|
Compromise Host Software Binary
|
action.malware.variety.Backdoor
|
Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'.
| related-to |
T1554
|
Compromise Host Software Binary
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1554
|
Compromise Host Software Binary
|
action.malware.variety.Trojan
|
An application which appears legitimate but hides malicious functionality. Child of 'RAT' when combined with 'Backdoor'
| related-to |
T1554
|
Compromise Host Software Binary
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1555
|
Credentials from Password Stores
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1555
|
Credentials from Password Stores
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1555.001
|
Keychain
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1555.001
|
Keychain
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1555.002
|
Securityd Memory
|
action.malware.variety.RAM scraper
|
RAM scraper or memory parser (capture data from volatile memory)
| related-to |
T1555.002
|
Securityd Memory
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1555.002
|
Securityd Memory
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1555.003
|
Credentials from Web Browsers
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1555.003
|
Credentials from Web Browsers
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1555.004
|
Windows Credential Manager
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1555.004
|
Windows Credential Manager
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1555.005
|
Password Managers
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1555.005
|
Password Managers
|
action.malware.variety.Password dumper
|
Password dumper (extract credential hashes)
| related-to |
T1555.006
|
Cloud Secrets Management Stores
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1555.006
|
Cloud Secrets Management Stores
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1558.005
|
Ccache Files
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1559
|
Inter-Process Communication
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1556
|
Modify Authentication Process
|
attribute.integrity.variety.Modify privileges
|
Modified privileges or permissions
| related-to |
T1556
|
Modify Authentication Process
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1556.001
|
Domain Controller Authentication
|
attribute.integrity.variety.Modify privileges
|
Modified privileges or permissions
| related-to |
T1556.001
|
Domain Controller Authentication
|
action.malware.vector.Email link
|
Email via embedded link. Child of 'Email'
| related-to |
T1566.002
|
Spearphishing Link
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1566.002
|
Spearphishing Link
|
attribute.integrity.variety.Modify privileges
|
Modified privileges or permissions
| related-to |
T1566.002
|
Spearphishing Link
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1556.003
|
Pluggable Authentication Modules
|
attribute.integrity.variety.Modify privileges
|
Modified privileges or permissions
| related-to |
T1556.003
|
Pluggable Authentication Modules
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1556.004
|
Network Device Authentication
|
attribute.integrity.variety.Modify privileges
|
Modified privileges or permissions
| related-to |
T1556.004
|
Network Device Authentication
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1559.001
|
Component Object Model
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1559.002
|
Dynamic Data Exchange
|
action.malware.variety.AiTM
|
Man-in-the-middle attack. Child of 'Exploit vuln'.
| related-to |
T1557
|
Adversary-in-the-Middle
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1557
|
Adversary-in-the-Middle
|
action.hacking.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1562
|
Impair Defenses
|
action.malware.variety.AiTM
|
Man-in-the-middle attack. Child of 'Exploit vuln'.
| related-to |
T1557.001
|
LLMNR/NBT-NS Poisoning and SMB Relay
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1562
|
Impair Defenses
|
action.hacking.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1562.001
|
Disable or Modify Tools
|
action.malware.variety.AiTM
|
Man-in-the-middle attack. Child of 'Exploit vuln'.
| related-to |
T1557.002
|
ARP Cache Poisoning
|
action.malware.variety.AiTM
|
Man-in-the-middle attack. Child of 'Exploit vuln'.
| related-to |
T1557.003
|
DHCP Spoofing
|
action.hacking.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1562.002
|
Disable Windows Event Logging
|
action.hacking.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1562.003
|
Impair Command History Logging
|
action.hacking.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1562.004
|
Disable or Modify System Firewall
|
action.hacking.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1562.007
|
Disable or Modify Cloud Firewall
|
action.hacking.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1562.008
|
Disable or Modify Cloud Logs
|
action.hacking.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1562.011
|
Spoof Security Alerting
|
action.hacking.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1562.012
|
Disable or Modify Linux Audit System
|
action.malware.variety.Exploit misconfig
|
Exploit a misconfiguration (vs vuln or weakness)
| related-to |
T1558.004
|
AS-REP Roasting
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1563
|
Remote Service Session Hijacking
|
action.hacking.variety.Hijack
|
To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes)
| related-to |
T1563
|
Remote Service Session Hijacking
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1563.001
|
SSH Hijacking
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1560
|
Archive Collected Data
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1560.001
|
Archive via Utility
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1560.002
|
Archive via Library
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1560.003
|
Archive via Custom Method
|
action.malware.variety.Destroy data
|
Destroy or corrupt stored data
| related-to |
T1561
|
Disk Wipe
|
attribute.availability.variety.Destruction
|
Destruction
| related-to |
T1561
|
Disk Wipe
|
attribute.availability.variety.Interruption
|
Interruption
| related-to |
T1561
|
Disk Wipe
|
attribute.availability.variety.Loss
|
Loss
| related-to |
T1561
|
Disk Wipe
|
action.malware.variety.Destroy data
|
Destroy or corrupt stored data
| related-to |
T1561.001
|
Disk Content Wipe
|
attribute.availability.variety.Destruction
|
Destruction
| related-to |
T1561.001
|
Disk Content Wipe
|
attribute.availability.variety.Loss
|
Loss
| related-to |
T1561.001
|
Disk Content Wipe
|
action.malware.variety.Destroy data
|
Destroy or corrupt stored data
| related-to |
T1561.002
|
Disk Structure Wipe
|
attribute.availability.variety.Destruction
|
Destruction
| related-to |
T1561.002
|
Disk Structure Wipe
|
attribute.availability.variety.Interruption
|
Interruption
| related-to |
T1561.002
|
Disk Structure Wipe
|
attribute.availability.variety.Loss
|
Loss
| related-to |
T1561.002
|
Disk Structure Wipe
|
action.hacking.variety.Hijack
|
To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes)
| related-to |
T1563.001
|
SSH Hijacking
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1563.002
|
RDP Hijacking
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1562
|
Impair Defenses
|
action.malware.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1562
|
Impair Defenses
|
action.malware.variety.Modify data
|
Malware which compromises a legitimate file rather than creating new filess
| related-to |
T1562
|
Impair Defenses
|
action.social.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1562
|
Impair Defenses
|
action.hacking.variety.Hijack
|
To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes)
| related-to |
T1563.002
|
RDP Hijacking
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1562.001
|
Disable or Modify Tools
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1564
|
Hide Artifacts
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1562.002
|
Disable Windows Event Logging
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564
|
Hide Artifacts
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1562.003
|
Impair Command History Logging
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1564.001
|
Hidden Files and Directories
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1562.004
|
Disable or Modify System Firewall
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1562.006
|
Indicator Blocking
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564.001
|
Hidden Files and Directories
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1562.007
|
Disable or Modify Cloud Firewall
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1564.002
|
Hidden Users
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1562.008
|
Disable or Modify Cloud Logs
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564.002
|
Hidden Users
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1562.011
|
Spoof Security Alerting
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1564.003
|
Hidden Window
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1562.012
|
Disable or Modify Linux Audit System
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564.003
|
Hidden Window
|
action.malware.vector.Network propagation
|
Network propagation
| related-to |
T1563
|
Remote Service Session Hijacking
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1564.004
|
NTFS File Attributes
|
action.malware.vector.Network propagation
|
Network propagation
| related-to |
T1563.001
|
SSH Hijacking
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564.004
|
NTFS File Attributes
|
action.malware.vector.Network propagation
|
Network propagation
| related-to |
T1563.002
|
RDP Hijacking
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1564.005
|
Hidden File System
|
action.malware.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564
|
Hide Artifacts
|
action.social.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564
|
Hide Artifacts
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564.005
|
Hidden File System
|
action.malware.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564.001
|
Hidden Files and Directories
|
action.social.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564.001
|
Hidden Files and Directories
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1564.006
|
Run Virtual Instance
|
action.malware.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564.002
|
Hidden Users
|
action.social.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564.002
|
Hidden Users
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564.006
|
Run Virtual Instance
|
action.malware.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564.003
|
Hidden Window
|
action.social.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564.003
|
Hidden Window
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1564.007
|
VBA Stomping
|
action.malware.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564.004
|
NTFS File Attributes
|
action.social.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564.004
|
NTFS File Attributes
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564.007
|
VBA Stomping
|
action.malware.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564.005
|
Hidden File System
|
action.social.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564.005
|
Hidden File System
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1568
|
Dynamic Resolution
|
action.malware.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564.006
|
Run Virtual Instance
|
action.social.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564.006
|
Run Virtual Instance
|
action.hacking.vector.Other network service
|
Network service that is not remote access or a web application.
| related-to |
T1568
|
Dynamic Resolution
|
action.malware.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564.007
|
VBA Stomping
|
action.malware.variety.Trojan
|
An application which appears legitimate but hides malicious functionality. Child of 'RAT' when combined with 'Backdoor'
| related-to |
T1564.007
|
VBA Stomping
|
action.social.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564.007
|
VBA Stomping
|
attribute.integrity.variety.Modify data
|
Modified stored data or content
| related-to |
T1565
|
Data Manipulation
|
attribute.integrity.variety.Modify data
|
Modified stored data or content
| related-to |
T1565.001
|
Stored Data Manipulation
|
attribute.integrity.variety.Modify data
|
Modified stored data or content
| related-to |
T1565.002
|
Transmitted Data Manipulation
|
attribute.integrity.variety.Modify data
|
Modified stored data or content
| related-to |
T1565.003
|
Runtime Data Manipulation
|
action.malware.vector.Instant messaging
|
Instant Messaging
| related-to |
T1566
|
Phishing
|
action.social.variety.Phishing
|
Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting.
| related-to |
T1566
|
Phishing
|
action.social.vector.Email
|
Email
| related-to |
T1566
|
Phishing
|
action.malware.vector.Email
|
Email. Parent to 'Email attachment', 'Email autoexecute', 'Email link', 'Email unknown'
| related-to |
T1566.001
|
Spearphishing Attachment
|
action.malware.vector.Email attachment
|
Email via user-executed attachment. Child of 'Email'
| related-to |
T1566.001
|
Spearphishing Attachment
|
action.social.variety.Phishing
|
Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting.
| related-to |
T1566.001
|
Spearphishing Attachment
|
action.social.vector.Email
|
Email
| related-to |
T1566.001
|
Spearphishing Attachment
|
action.social.variety.Phishing
|
Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting.
| related-to |
T1566.002
|
Spearphishing Link
|
action.social.vector.Email
|
Email
| related-to |
T1566.002
|
Spearphishing Link
|
action.social.vector.Web application
|
Web application
| related-to |
T1566.002
|
Spearphishing Link
|
action.social.variety.Phishing
|
Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting.
| related-to |
T1566.003
|
Spearphishing via Service
|
action.social.vector.Email
|
Email
| related-to |
T1566.003
|
Spearphishing via Service
|
action.social.variety.Phishing
|
Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting.
| related-to |
T1566.004
|
Spearphishing Voice
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1567
|
Exfiltration Over Web Service
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1567
|
Exfiltration Over Web Service
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1567.001
|
Exfiltration to Code Repository
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1567.001
|
Exfiltration to Code Repository
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1567.002
|
Exfiltration to Cloud Storage
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1567.002
|
Exfiltration to Cloud Storage
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1567.003
|
Exfiltration to Text Storage Sites
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1567.003
|
Exfiltration to Text Storage Sites
|
action.malware.variety.Export data
|
Export data to another site or system
| related-to |
T1567.004
|
Exfiltration Over Webhook
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1567.004
|
Exfiltration Over Webhook
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1568.001
|
Fast Flux DNS
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1568.002
|
Domain Generation Algorithms
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1568
|
Dynamic Resolution
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1568
|
Dynamic Resolution
|
action.malware.vector.Download by malware
|
Downloaded and installed by local malware
| related-to |
T1568
|
Dynamic Resolution
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1568.003
|
DNS Calculation
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1568.001
|
Fast Flux DNS
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1568.001
|
Fast Flux DNS
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1569
|
System Services
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1568.002
|
Domain Generation Algorithms
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1568.002
|
Domain Generation Algorithms
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1569.001
|
Launchctl
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1568.003
|
DNS Calculation
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1568.003
|
DNS Calculation
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1569.002
|
Service Execution
|
action.hacking.vector.Other network service
|
Network service that is not remote access or a web application.
| related-to |
T1571
|
Non-Standard Port
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1572
|
Protocol Tunneling
|
action.malware.vector.Direct install
|
Directly installed or inserted by threat agent (after system access)
| related-to |
T1569.002
|
Service Execution
|
action.malware.vector.Network propagation
|
Network propagation
| related-to |
T1570
|
Lateral Tool Transfer
|
action.hacking.vector.Other network service
|
Network service that is not remote access or a web application.
| related-to |
T1572
|
Protocol Tunneling
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1571
|
Non-Standard Port
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1571
|
Non-Standard Port
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1573
|
Encrypted Channel
|
action.hacking.vector.Other network service
|
Network service that is not remote access or a web application.
| related-to |
T1573
|
Encrypted Channel
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1572
|
Protocol Tunneling
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1572
|
Protocol Tunneling
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1573.001
|
Symmetric Cryptography
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1573.002
|
Asymmetric Cryptography
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1573
|
Encrypted Channel
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1573
|
Encrypted Channel
|
action.hacking.variety.Hijack
|
To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes)
| related-to |
T1574
|
Hijack Execution Flow
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1573.001
|
Symmetric Cryptography
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1573.001
|
Symmetric Cryptography
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1574
|
Hijack Execution Flow
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1573.002
|
Asymmetric Cryptography
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1573.002
|
Asymmetric Cryptography
|
action.hacking.variety.XML injection
|
XML injection. Child of 'Exploit vuln'.
| related-to |
T1574
|
Hijack Execution Flow
|
action.hacking.variety.Exploit misconfig
|
Exploit a misconfiguration (vs vuln or weakness)
| related-to |
T1574.001
|
DLL Search Order Hijacking
|
action.hacking.variety.Exploit vuln
|
Exploit vulnerability in code (vs misconfig or weakness). This can be used with other hacking enumerations, (such as XSS when an XSS vuln exists.). Parent of many hacking varieties.
| related-to |
T1574.001
|
DLL Search Order Hijacking
|
action.hacking.variety.Hijack
|
To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes)
| related-to |
T1574.001
|
DLL Search Order Hijacking
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1574.001
|
DLL Search Order Hijacking
|
action.hacking.variety.Exploit misconfig
|
Exploit a misconfiguration (vs vuln or weakness)
| related-to |
T1574.002
|
DLL Side-Loading
|
action.hacking.variety.Exploit vuln
|
Exploit vulnerability in code (vs misconfig or weakness). This can be used with other hacking enumerations, (such as XSS when an XSS vuln exists.). Parent of many hacking varieties.
| related-to |
T1574.002
|
DLL Side-Loading
|
action.hacking.variety.Hijack
|
To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes)
| related-to |
T1574.002
|
DLL Side-Loading
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1574.002
|
DLL Side-Loading
|
action.hacking.variety.Exploit vuln
|
Exploit vulnerability in code (vs misconfig or weakness). This can be used with other hacking enumerations, (such as XSS when an XSS vuln exists.). Parent of many hacking varieties.
| related-to |
T1574.004
|
Dylib Hijacking
|
action.hacking.variety.Hijack
|
To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes)
| related-to |
T1574.004
|
Dylib Hijacking
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1574.004
|
Dylib Hijacking
|
action.hacking.variety.Exploit misconfig
|
Exploit a misconfiguration (vs vuln or weakness)
| related-to |
T1574.005
|
Executable Installer File Permissions Weakness
|
action.hacking.variety.Hijack
|
To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes)
| related-to |
T1574.005
|
Executable Installer File Permissions Weakness
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1574.005
|
Executable Installer File Permissions Weakness
|
action.hacking.variety.Exploit misconfig
|
Exploit a misconfiguration (vs vuln or weakness)
| related-to |
T1574.010
|
Services File Permissions Weakness
|
action.hacking.variety.Exploit misconfig
|
Exploit a misconfiguration (vs vuln or weakness)
| related-to |
T1574.011
|
Services Registry Permissions Weakness
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1578
|
Modify Cloud Compute Infrastructure
|
action.hacking.vector.Hypervisor
|
Hypervisor break-out attack
| related-to |
T1578
|
Modify Cloud Compute Infrastructure
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1574.012
|
COR_PROFILER
|
action.hacking.vector.Inter-tenant
|
Penetration of another VM or web site on shared device or infrastructure
| related-to |
T1578
|
Modify Cloud Compute Infrastructure
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1578.001
|
Create Snapshot
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1578.002
|
Create Cloud Instance
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1578.003
|
Delete Cloud Instance
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1578.004
|
Revert Cloud Instance
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1578.005
|
Modify Cloud Compute Configurations
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1580
|
Cloud Infrastructure Discovery
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1583
|
Acquire Infrastructure
|
action.malware.vector.Web application - download
|
Web via user-executed or downloaded content. Child of 'Web application'.
| related-to |
T1583
|
Acquire Infrastructure
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1583.001
|
Domains
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1583.001
|
Domains
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1583.001
|
Domains
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1583.002
|
DNS Server
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1583.002
|
DNS Server
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1583.002
|
DNS Server
|
action.hacking.variety.Forced browsing
|
Forced browsing or predictable resource location. Child of 'Exploit vuln'.
| related-to |
T1583.003
|
Virtual Private Server
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1583.003
|
Virtual Private Server
|
action.hacking.variety.Forced browsing
|
Forced browsing or predictable resource location. Child of 'Exploit vuln'.
| related-to |
T1583.004
|
Server
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1583.004
|
Server
|
action.hacking.variety.DoS
|
Denial of service
| related-to |
T1583.005
|
Botnet
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1583.005
|
Botnet
|
value_chain.development.variety.Bot
|
A small program that can be distributed, installed, and controlled en mass.
| related-to |
T1583.005
|
Botnet
|
action.hacking.variety.Forced browsing
|
Forced browsing or predictable resource location. Child of 'Exploit vuln'.
| related-to |
T1583.006
|
Web Services
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1583.006
|
Web Services
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1583.006
|
Web Services
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1583.006
|
Web Services
|
value_chain.development.variety.Website
|
Development of any full website controlled by the attacker
| related-to |
T1583.006
|
Web Services
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1584
|
Compromise Infrastructure
|
action.malware.vector.Web application - download
|
Web via user-executed or downloaded content. Child of 'Web application'.
| related-to |
T1584
|
Compromise Infrastructure
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1584.001
|
Domains
|
action.social.variety.Pretexting
|
Pretexting (dialogue leveraging invented scenario). Unlike 'Phishing', does not transfer data. (A fraudulent transfer or changing a bank account on a business account is not really disclosing data.
| related-to |
T1584.001
|
Domains
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1584.002
|
DNS Server
|
action.malware.variety.Backdoor or C2
|
Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.
| related-to |
T1584.002
|
DNS Server
|
action.malware.variety.C2
|
Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.
| related-to |
T1584.002
|
DNS Server
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1584.003
|
Virtual Private Server
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1584.004
|
Server
|
action.hacking.variety.DoS
|
Denial of service
| related-to |
T1584.005
|
Botnet
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1584.005
|
Botnet
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1584.006
|
Web Services
|
action.social.variety.Pretexting
|
Pretexting (dialogue leveraging invented scenario). Unlike 'Phishing', does not transfer data. (A fraudulent transfer or changing a bank account on a business account is not really disclosing data.
| related-to |
T1585
|
Establish Accounts
|
value_chain.development.variety.Persona
|
A fake representation of a person, such as fake social media profiles
| related-to |
T1585
|
Establish Accounts
|
action.social.variety.Pretexting
|
Pretexting (dialogue leveraging invented scenario). Unlike 'Phishing', does not transfer data. (A fraudulent transfer or changing a bank account on a business account is not really disclosing data.
| related-to |
T1585.001
|
Social Media Accounts
|
value_chain.development.variety.Persona
|
A fake representation of a person, such as fake social media profiles
| related-to |
T1585.001
|
Social Media Accounts
|
action.social.variety.Pretexting
|
Pretexting (dialogue leveraging invented scenario). Unlike 'Phishing', does not transfer data. (A fraudulent transfer or changing a bank account on a business account is not really disclosing data.
| related-to |
T1585.002
|
Email Accounts
|
value_chain.development.variety.Persona
|
A fake representation of a person, such as fake social media profiles
| related-to |
T1585.002
|
Email Accounts
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1586
|
Compromise Accounts
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1586.001
|
Social Media Accounts
|
action.social.variety.Phishing
|
Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting.
| related-to |
T1586.001
|
Social Media Accounts
|
action.social.variety.Pretexting
|
Pretexting (dialogue leveraging invented scenario). Unlike 'Phishing', does not transfer data. (A fraudulent transfer or changing a bank account on a business account is not really disclosing data.
| related-to |
T1586.001
|
Social Media Accounts
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1586.002
|
Email Accounts
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1587
|
Develop Capabilities
|
value_chain.development.variety.Unknown
|
Nothing is known about the need for or type of development investment other than it was present.
| related-to |
T1587
|
Develop Capabilities
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1587.001
|
Malware
|
action.malware.variety.Unknown
|
Unknown
| related-to |
T1587.001
|
Malware
|
value_chain.development.variety.Bot
|
A small program that can be distributed, installed, and controlled en mass.
| related-to |
T1587.001
|
Malware
|
value_chain.development.variety.Payload
|
The portion a program that causes a negative effect.
| related-to |
T1587.001
|
Malware
|
value_chain.development.variety.Ransomware
|
Ransomware (encrypt or seize stored data)
| related-to |
T1587.001
|
Malware
|
value_chain.development.variety.Trojan
|
A program which masquerades as another program to get a target to execute malicious content
| related-to |
T1587.001
|
Malware
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1587.002
|
Code Signing Certificates
|
value_chain.development.variety.Other
|
The variety of development required is known, but is not listed.
| related-to |
T1587.002
|
Code Signing Certificates
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1587.003
|
Digital Certificates
|
value_chain.development.variety.Other
|
The variety of development required is known, but is not listed.
| related-to |
T1587.003
|
Digital Certificates
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1587.004
|
Exploits
|
action.malware.variety.Unknown
|
Unknown
| related-to |
T1587.004
|
Exploits
|
value_chain.development.variety.Exploit
|
Code to exploit a vulnerability, including web injects.
| related-to |
T1587.004
|
Exploits
|
value_chain.development.variety.Exploit Kits
|
Code sets capable of selecting and trying multiple exploits against a target.
| related-to |
T1587.004
|
Exploits
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1588
|
Obtain Capabilities
|
value_chain.development.variety.Unknown
|
Nothing is known about the need for or type of development investment other than it was present.
| related-to |
T1588
|
Obtain Capabilities
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1588.001
|
Malware
|
action.malware.variety.Unknown
|
Unknown
| related-to |
T1588.001
|
Malware
|
value_chain.development.variety.Bot
|
A small program that can be distributed, installed, and controlled en mass.
| related-to |
T1588.001
|
Malware
|
value_chain.development.variety.Payload
|
The portion a program that causes a negative effect.
| related-to |
T1588.001
|
Malware
|
value_chain.development.variety.Ransomware
|
Ransomware (encrypt or seize stored data)
| related-to |
T1588.001
|
Malware
|
value_chain.development.variety.Trojan
|
A program which masquerades as another program to get a target to execute malicious content
| related-to |
T1588.001
|
Malware
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1588.002
|
Tool
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1588.003
|
Code Signing Certificates
|
value_chain.development.variety.Other
|
The variety of development required is known, but is not listed.
| related-to |
T1588.003
|
Code Signing Certificates
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1588.004
|
Digital Certificates
|
value_chain.development.variety.Other
|
The variety of development required is known, but is not listed.
| related-to |
T1588.004
|
Digital Certificates
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1588.005
|
Exploits
|
action.malware.variety.Unknown
|
Unknown
| related-to |
T1588.005
|
Exploits
|
value_chain.development.variety.Exploit
|
Code to exploit a vulnerability, including web injects.
| related-to |
T1588.005
|
Exploits
|
value_chain.development.variety.Exploit Kits
|
Code sets capable of selecting and trying multiple exploits against a target.
| related-to |
T1588.005
|
Exploits
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1588.006
|
Vulnerabilities
|
action.malware.variety.Unknown
|
Unknown
| related-to |
T1588.006
|
Vulnerabilities
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1588.007
|
Artificial Intelligence
|
action.malware.variety.Unknown
|
Unknown
| related-to |
T1588.007
|
Artificial Intelligence
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1589
|
Gather Victim Identity Information
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1589.001
|
Credentials
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1589.002
|
Email Addresses
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1589.003
|
Employee Names
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1590
|
Gather Victim Network Information
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1590.001
|
Domain Properties
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1590.002
|
DNS
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1590.003
|
Network Trust Dependencies
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1590.004
|
Network Topology
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1590.005
|
IP Addresses
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1590.006
|
Network Security Appliances
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1592
|
Gather Victim Host Information
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1592.001
|
Hardware
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1592.002
|
Software
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1592.003
|
Firmware
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1592.004
|
Client Configurations
|
action.malware.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1595
|
Active Scanning
|
action.malware.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1595.001
|
Scanning IP Blocks
|
action.hacking.variety.Exploit vuln
|
Exploit vulnerability in code (vs misconfig or weakness). This can be used with other hacking enumerations, (such as XSS when an XSS vuln exists.). Parent of many hacking varieties.
| related-to |
T1595.002
|
Vulnerability Scanning
|
action.malware.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1595.002
|
Vulnerability Scanning
|
action.social.variety.Phishing
|
Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting.
| related-to |
T1598
|
Phishing for Information
|
action.social.variety.Pretexting
|
Pretexting (dialogue leveraging invented scenario). Unlike 'Phishing', does not transfer data. (A fraudulent transfer or changing a bank account on a business account is not really disclosing data.
| related-to |
T1598
|
Phishing for Information
|
action.social.variety.Phishing
|
Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting.
| related-to |
T1598.001
|
Spearphishing Service
|
action.social.variety.Pretexting
|
Pretexting (dialogue leveraging invented scenario). Unlike 'Phishing', does not transfer data. (A fraudulent transfer or changing a bank account on a business account is not really disclosing data.
| related-to |
T1598.001
|
Spearphishing Service
|
action.malware.vector.Email attachment
|
Email via user-executed attachment. Child of 'Email'
| related-to |
T1598.002
|
Spearphishing Attachment
|
action.social.variety.Phishing
|
Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting.
| related-to |
T1598.002
|
Spearphishing Attachment
|
action.social.variety.Pretexting
|
Pretexting (dialogue leveraging invented scenario). Unlike 'Phishing', does not transfer data. (A fraudulent transfer or changing a bank account on a business account is not really disclosing data.
| related-to |
T1598.002
|
Spearphishing Attachment
|
action.malware.vector.Email link
|
Email via embedded link. Child of 'Email'
| related-to |
T1598.003
|
Spearphishing Link
|
action.social.variety.Phishing
|
Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting.
| related-to |
T1598.003
|
Spearphishing Link
|
action.social.variety.Pretexting
|
Pretexting (dialogue leveraging invented scenario). Unlike 'Phishing', does not transfer data. (A fraudulent transfer or changing a bank account on a business account is not really disclosing data.
| related-to |
T1598.003
|
Spearphishing Link
|
action.social.variety.Phishing
|
Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting.
| related-to |
T1598.004
|
Spearphishing Voice
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1599
|
Network Boundary Bridging
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1599.001
|
Network Address Translation Traversal
|
action.hacking.variety.Cryptanalysis
|
Cryptanalysis. Child of 'Exploit vuln'.
| related-to |
T1600
|
Weaken Encryption
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1600
|
Weaken Encryption
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1600.001
|
Reduce Key Space
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1600.002
|
Disable Crypto Hardware
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1601
|
Modify System Image
|
attribute.integrity.variety.Software installation
|
Software installation or code modification
| related-to |
T1601
|
Modify System Image
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1601.001
|
Patch System Image
|
attribute.integrity.variety.Software installation
|
Software installation or code modification
| related-to |
T1601.001
|
Patch System Image
|
action.malware.variety.Disable controls
|
Disable or interfere with security controls
| related-to |
T1601.002
|
Downgrade System Image
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1602
|
Data from Configuration Repository
|
action.malware.variety.Capture stored data
|
Capture data stored on system disk
| related-to |
T1602
|
Data from Configuration Repository
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1602
|
Data from Configuration Repository
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1602.001
|
SNMP (MIB Dump)
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1602.001
|
SNMP (MIB Dump)
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1602.002
|
Network Device Configuration Dump
|
attribute.confidentiality.data_disclosure
|
None
| related-to |
T1602.002
|
Network Device Configuration Dump
|
action.hacking.variety.Session prediction
|
Credential or session prediction. Child of 'Exploit vuln'.
| related-to |
T1606
|
Forge Web Credentials
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1606
|
Forge Web Credentials
|
action.hacking.variety.Session prediction
|
Credential or session prediction. Child of 'Exploit vuln'.
| related-to |
T1606.001
|
Web Cookies
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1606.001
|
Web Cookies
|
action.hacking.variety.Unknown
|
Unknown
| related-to |
T1606.002
|
SAML Tokens
|
action.malware.variety.Unknown
|
Unknown
| related-to |
T1608
|
Stage Capabilities
|
action.malware.variety.Unknown
|
Unknown
| related-to |
T1608.001
|
Upload Malware
|
action.malware.variety.Unknown
|
Unknown
| related-to |
T1608.002
|
Upload Tool
|
action.malware.variety.Unknown
|
Unknown
| related-to |
T1608.003
|
Install Digital Certificate
|
action.malware.variety.Unknown
|
Unknown
| related-to |
T1608.004
|
Drive-by Target
|
action.malware.variety.Unknown
|
Unknown
| related-to |
T1608.005
|
Link Target
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1609
|
Container Administration Command
|
action.malware.variety.Downloader
|
Downloader (pull updates or other malware)
| related-to |
T1610
|
Deploy Container
|
action.malware.variety.Unknown
|
Unknown
| related-to |
T1610
|
Deploy Container
|
action.hacking.variety.Virtual machine escape
|
Virtual machine escape. Child of 'Exploit vuln'.
| related-to |
T1611
|
Escape to Host
|
action.malware.variety.Unknown
|
Unknown
| related-to |
T1612
|
Build Image on Host
|
action.hacking.variety.Scan network
|
Enumerating the state of the network
| related-to |
T1613
|
Container and Resource Discovery
|
action.hacking.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1614
|
System Location Discovery
|
action.hacking.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1614.001
|
System Language Discovery
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1622
|
Debugger Evasion
|
action.malware.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1622
|
Debugger Evasion
|
action.social.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1622
|
Debugger Evasion
|
action.malware.variety.Backdoor
|
Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'.
| related-to |
T1546.017
|
Udev Rules
|
action.malware.vector.Partner
|
Partner connection or credential. (Indicates supply chain breach.)
| related-to |
T1584.008
|
Network Devices
|
action.malware.vector.remote injection
|
None
| related-to |
T1659
|
Content Injection
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1556.008
|
Network Provider DLL
|
attribute.integrity.variety.Modify privileges
|
Modified privileges or permissions
| related-to |
T1556.008
|
Network Provider DLL
|
attribute.integrity.variety.Modify configuration
|
Modified configuration or services
| related-to |
T1556.009
|
Conditional Access Policies
|
attribute.integrity.variety.Modify privileges
|
Modified privileges or permissions
| related-to |
T1556.009
|
Conditional Access Policies
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1543.005
|
Container Service
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1548.005
|
Temporary Elevated Cloud Access
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1548.006
|
TCC Manipulation
|
action.hacking.variety.Use of stolen creds
|
Use of stolen or default authentication credentials (including credential stuffing)
| related-to |
T1558.005
|
Ccache Files
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564.011
|
Ignore Process Interrupts
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1564.012
|
File/Path Exclusions
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1564.012
|
File/Path Exclusions
|
action.hacking.variety.Hijack
|
To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes)
| related-to |
T1574.014
|
AppDomainManager
|
action.hacking.vector.Partner
|
Partner connection or credential. (Indicates supply chain breach.)
| related-to |
T1584.008
|
Network Devices
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1651
|
Cloud Administration Command
|
action.hacking.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1652
|
Device Driver Discovery
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1653
|
Power Settings
|
action.hacking.variety.Profile host
|
Enumerating the state of the current host
| related-to |
T1654
|
Log Enumeration
|
action.hacking.variety.Abuse of functionality
|
Abuse of functionality.
| related-to |
T1665
|
Hide Infrastructure
|
action.hacking.variety.Evade Defenses
|
Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.
| related-to |
T1666
|
Modify Cloud Resource Hierarchy
|