Certification Courses
Hands-On Labs
Threat Intelligence
Latest Cyber News
MITRE ATT&CK Breakdown
All Cyber Keywords
Latest News
Gathering information to plan future operations
- Active Scanning (T1595)
- Gather Victim Host Information (T1592)
- Gather Victim Identity Information (T1589)
- Gather Victim Network Information (T1590)
- Gather Victim Org Info (T1591)
- Phishing for Information (T1598)
- Search Closed Sources (T1597)
- Search Open Technical Databases (T1596)
- Search Open Websites/Domains (T1593)
- Search Threat Vendor Data (T1681)
- Search Victim-Owned Websites (T1594)
Establishing resources to support operations
Gaining initial foothold in the network
- Content Injection (T1659)
- Drive-by Compromise (T1189)
- Exploit Public-Facing Application (T1190)
- External Remote Services (T1133)
- Hardware Additions (T1200)
- Phishing (T1566)
- Replication Through Removable Media (T1091)
- Supply Chain Compromise (T1195)
- Trusted Relationship (T1199)
- Valid Accounts (T1078)
- Wi-Fi Networks (T1669)
17
Running malicious code on victim systems
- Cloud Administration Command (T1651)
- Command and Scripting Interpreter (T1059)
- Container Administration Command (T1609)
- Deploy Container (T1610)
- ESXi Administration Command (T1675)
- Exploitation for Client Execution (T1203)
- Input Injection (T1674)
- Inter-Process Communication (T1559)
- Native API (T1106)
- Poisoned Pipeline Execution (T1677)
- Scheduled Task/Job (T1053)
- Serverless Execution (T1648)
- Shared Modules (T1129)
- Software Deployment Tools (T1072)
- System Services (T1569)
- User Execution (T1204)
- Windows Management Instrumentation (T1047)
23
Maintaining foothold across system reboots
- Account Manipulation (T1098)
- BITS Jobs (T1197)
-
Boot or Logon Autostart Execution (T1547)
- Registry Run Keys / Startup Folder (.001)
- Authentication Package (.002)
- Time Providers (.003)
- Winlogon Helper DLL (.004)
- Security Support Provider (.005)
- Kernel Modules and Extensions (.006)
- Re-opened Applications (.007)
- LSASS Driver (.008)
- Shortcut Modification .0029)
- Port Monitors (.010)
- Print Processors (.012)
- XDG Autostart Entries (.013)
- Active Setup (.014)
- Login Items (.015)
- Boot or Logon Initialization Scripts (T1037)
- Cloud Application Integration (T1671)
- Compromise Host Software Binary (T1554)
- Create Account (T1136)
- Create or Modify System Process (T1543)
-
Event Triggered Execution (T1546)
- Change Default File Association (.001)
- Screensaver (.002)
- Windows Management Instrumentation Event Subscription (.003)
- Unix Shell Configuration Modification (.004)
- Trap (.005)
- LC_LOAD_DYLIB Addition (.006)
- Netsh Helper DLL (.007)
- Accessibility Features (.008)
- AppCert DLLs (.009)
- AppInit DLLs (.010)
- Application Shimming (.011)
- Image File Execution Options Injection (.012)
- PowerShell Profile (.013)
- Emond (.014)
- Component Object Model Hijacking (.015)
- Installer Packages (.016)
- Udev Rules (.017)
- Python Startup Hooks (.018)
- Exclusive Control (T1668)
- External Remote Services (T1133)
-
Hijack Execution Flow (T1574)
- DLL (.001)
- Dylib Hijacking (.004)
- Executable Installer File Permissions Weakness (.005)
- Dynamic Linker Hijacking (.006)
- Path Interception by PATH Environment Variable (.007)
- Path Interception by Search Order Hijacking (.008)
- Path Interception by Unquoted Path (.009)
- Services File Permissions Weakness (.010)
- Services Registry Permissions Weakness (.011)
- COR_PROFILER (.012)
- KernelCallbackTable (.013)
- AppDomainManager (.014)
- Implant Internal Image (T1525)
- Modify Authentication Process (T1556)
- Modify Registry (T1112)
- Office Application Startup (T1137)
- Power Settings (T1653)
- Pre-OS Boot (T1542)
- Scheduled Task/Job (T1053)
- Server Software Component (T1505)
- Software Extensions (T1176)
- Traffic Signaling (T1205)
- Valid Accounts (T1078)
Gaining higher-level permissions
- Abuse Elevation Control Mechanism (T1548)
- Access Token Manipulation (T1134)
- Account Manipulation (T1098)
-
Boot or Logon Autostart Execution (T1547)
- Registry Run Keys / Startup Folder (.001)
- Authentication Package (.002)
- Time Providers (.003)
- Winlogon Helper DLL (.004)
- Security Support Provider (.005)
- Kernel Modules and Extensions (.006)
- Re-opened Applications (.007)
- LSASS Driver (.008)
- Shortcut Modification (.009)
- Port Monitors (.010)
- Print Processors (.012)
- XDG Autostart Entries (.013)
- Active Setup (.014)
- Login Items (.015)
- Boot or Logon Initialization Scripts (T1037)
- Create or Modify System Process (T1543)
- Domain or Tenant Policy Modification (T1484)
- Escape to Host (T1611)
-
Event Triggered Execution (T1546)
- Change Default File Association (.001)
- Screensaver (.002)
- Windows Management Instrumentation Event Subscription (.003)
- Unix Shell Configuration Modification (.004)
- Trap (.005)
- LC_LOAD_DYLIB Addition (.006)
- Netsh Helper DLL (.007)
- Accessibility Features (.008)
- AppCert DLLs (.009)
- AppInit DLLs (.010)
- Application Shimming (.011)
- Image File Execution Options Injection (.012)
- PowerShell Profile (.013)
- Emond (.014)
- Component Object Model Hijacking (.015)
- Installer Packages (.016)
- Udev Rules (.017)
- Python Startup Hooks (.018)
- Exploitation for Privilege Escalation (T1068)
-
Hijack Execution Flow (T1574)
- DLL (.001)
- Dylib Hijacking (.004)
- Executable Installer File Permissions Weakness (.005)
- Dynamic Linker Hijacking (.006)
- Path Interception by PATH Environment Variable (.007)
- Path Interception by Search Order Hijacking (.008)
- Path Interception by Unquoted Path (.009)
- Services File Permissions Weakness (.010)
- Services Registry Permissions Weakness (.011)
- COR_PROFILER (.012)
- KernelCallbackTable (.013)
- AppDomainManager (.014)
-
Process Injection (T1055)
- Dynamic-link Library Injection (.001)
- Portable Executable Injection (.002)
- Thread Execution Hijacking (.003)
- Asynchronous Procedure Call (.004)
- Thread Local Storage (.005)
- Ptrace System Calls (.008)
- Proc Memory (.009)
- Extra Window Memory Injection (.011)
- Process Hollowing (.012)
- Process Doppelgänging (.013)
- VDSO Hijacking (.014)
- ListPlanting (.015)
- Scheduled Task/Job (T1053)
- Valid Accounts (T1078)
Avoiding detection by security controls
- Abuse Elevation Control Mechanism (T1548)
- Access Token Manipulation (T1134)
- BITS Jobs (T1197)
- Build Image on Host (T1612)
- Debugger Evasion (T1622)
- Delay Execution (T1678)
- Deobfuscate/Decode Files or Information (T1140)
- Deploy Container (T1610)
- Direct Volume Access (T1006)
- Domain or Tenant Policy Modification (T1484)
- Email Spoofing (T1672)
- Execution Guardrails (T1480)
- Exploitation for Defense Evasion (T1211)
- File and Directory Permissions Modification (T1222)
-
Hide Artifacts (T1564)
- Hidden Files and Directories (.001)
- Hidden Users (.002)
- Hidden Window (.003)
- NTFS File Attributes (.004)
- Hidden File System (.005)
- Run Virtual Instance (.006)
- VBA Stomping (.007)
- Email Hiding Rules (.008)
- Resource Forking (.009)
- Process Argument Spoofing (.010)
- Ignore Process Interrupts (.011)
- File/Path Exclusions (.012)
- Bind Mounts (.013)
- Extended Attributes (.014)
-
Hijack Execution Flow (T1574)
- DLL (.001)
- Dylib Hijacking (.004)
- Executable Installer File Permissions Weakness (.005)
- Dynamic Linker Hijacking (.006)
- Path Interception by PATH Environment Variable (.007)
- Path Interception by Search Order Hijacking (.008)
- Path Interception by Unquoted Path (.009)
- Services File Permissions Weakness (.010)
- Services Registry Permissions Weakness (.011)
- COR_PROFILER (.012)
- KernelCallbackTable (.013)
- AppDomainManager (.014)
-
Impair Defenses (T1562)
- Disable or Modify Tools (.001)
- Disable Windows Event Logging (.002)
- Impair Command History Logging (.003)
- Disable or Modify System Firewall (.004)
- Indicator Blocking (.006)
- Disable or Modify Cloud Firewall (.007)
- Disable or Modify Cloud Logs (.008)
- Safe Mode Boot (.009)
- Downgrade Attack (.010)
- Spoof Security Alerting (.011)
- Disable or Modify Linux Audit System (.012)
- Disable or Modify Network Device Firewall (.013)
- Impersonation (T1656)
-
Indicator Removal (T1070)
- Clear Windows Event Logs (.001)
- Clear Linux or Mac System Logs (.002)
- Clear Command History (.003)
- File Deletion (.004)
- Network Share Connection Removal (.005)
- Timestomp (.006)
- Clear Network Connection History and Configurations (.007)
- Clear Mailbox Data (.008)
- Clear Persistence (.009)
- Relocate Malware (.010)
- Indirect Command Execution (T1202)
-
Masquerading (T1036)
- Invalid Code Signature (.001)
- Right-to-Left Override (.002)
- Rename Legitimate Utilities (.003)
- Masquerade Task or Service (.004)
- Match Legitimate Resource Name or Location (.005)
- Space after Filename (.006)
- Double File Extension (.007)
- Masquerade File Type (.008)
- Break Process Trees (.009)
- Masquerade Account Name (.010)
- Overwrite Process Arguments (.011)
- Browser Fingerprint (.012)
- Modify Authentication Process (T1556)
- Modify Cloud Compute Infrastructure (T1578)
- Modify Cloud Resource Hierarchy (T1666)
- Modify Registry (T1112)
- Modify System Image (T1601)
- Network Boundary Bridging (T1599)
-
Obfuscated Files or Information (T1027)
- Binary Padding (.001)
- Software Packing (.002)
- Steganography (.003)
- Compile After Delivery (.004)
- Indicator Removal from Tools (.005)
- HTML Smuggling (.006)
- Dynamic API Resolution (.007)
- Stripped Payloads (.008)
- Embedded Payloads (.009)
- Command Obfuscation (.0110)
- Fileless Storage (.011)
- LNK Icon Smuggling (.012)
- Encrypted/Encoded File (.013)
- Polymorphic Code (.014)
- Compression (.015)
- Junk Code Insertion (.016)
- SVG Smuggling (.017)
- Plist File Modification (T1647)
- Pre-OS Boot (T1542)
-
Process Injection (T1055)
- Dynamic-link Library Injection (.001)
- Portable Executable Injection (.002)
- Thread Execution Hijacking (.003)
- Asynchronous Procedure Call (.004)
- Thread Local Storage (.005)
- Ptrace System Calls (.008)
- Proc Memory (.009)
- Extra Window Memory Injection (.011)
- Process Hollowing (.012)
- Process Doppelgänging (.013)
- VDSO Hijacking (.014)
- ListPlanting (.015)
- Reflective Code Loading (T1620)
- Rogue Domain Controller (T1207)
- Rootkit (T1014)
- Selective Exclusion (T1679)
- Subvert Trust Controls (T1553)
- System Binary Proxy Execution (T1218)
- System Script Proxy Execution (T1216)
- Template Injection (T1221)
- Traffic Signaling (T1205)
- Trusted Developer Utilities Proxy Execution (T1127)
- Unused/Unsupported Cloud Regions (T1535)
- Use Alternate Authentication Material (T1550)
- Valid Accounts (T1078)
- Virtualization/Sandbox Evasion (T1497)
- Weaken Encryption (T1600)
- XSL Script Processing (T1220)
Stealing account names and passwords
- Adversary-in-the-Middle (T1557)
- Brute Force (T1110)
- Credentials from Password Stores (T1555)
- Exploitation for Credential Access (T1212)
- Forced Authentication (T1187)
- Forge Web Credentials (T1606)
- Input Capture (T1056)
- Modify Authentication Process (T1556)
- Multi-Factor Authentication Interception (T1111)
- Multi-Factor Authentication Request Generation (T1621)
- Network Sniffing (T1040)
- OS Credential Dumping (T1003)
- Steal Application Access Token (T1528)
- Steal or Forge Authentication Certificates (T1649)
- Steal or Forge Kerberos Tickets (T1558)
- Steal Web Session Cookie (T1539)
- Unsecured Credentials (T1552)
17
Gaining knowledge about the victim's system and internal network.
- Account Discovery (T1087)
- Application Window Discovery (T1010)
- Browser Information Discovery (T1217)
- Cloud Infrastructure Discovery (T1580)
- Cloud Service Dashboard (T1538)
- Cloud Service Discovery (T1526)
- Cloud Storage Object Discovery (T1619)
- Container and Resource Discovery (T1613)
- Debugger Evasion (T1622)
- Device Driver Discovery (T1652)
- Domain Trust Discovery (T1482)
- File and Directory Discovery (T1083)
- Group Policy Discovery (T1615)
- Local Storage Discovery (T1680)
- Log Enumeration (T1654)
- Network Service Discovery (T1046)
- Network Share Discovery (T1135)
- Network Sniffing (T1040)
- Password Policy Discovery (T1201)
- Peripheral Device Discovery (T1120)
- Permission Groups Discovery (T1069)
- Process Discovery (T1057)
- Query Registry (T1012)
- Remote System Discovery (T1018)
- Software Discovery (T1518)
- System Information Discovery (T1082)
- System Location Discovery (T1614)
- System Network Configuration Discovery (T1016)
- System Network Connections Discovery (T1049)
- System Owner/User Discovery (T1033)
- System Service Discovery (T1007)
- System Time Discovery (T1124)
- Virtual Machine Discovery (T1673)
- Virtualization/Sandbox Evasion (T1497)
Moving between systems within a network after initial access.
- Exploitation of Remote Services (T1210)
- Internal Spearphishing (T1534)
- Lateral Tool Transfer (T1570)
- Remote Service Session Hijacking (T1563)
- Remote Services (T1021)
- Replication Through Removable Media (T1091)
- Software Deployment Tools (T1072)
- Taint Shared Content (T1080)
- Use Alternate Authentication Material (T1550)
17
Locating and gathering target data from the victim's environment.
- Adversary-in-the-Middle (T1557)
- Archive Collected Data (T1560)
- Audio Capture (T1123)
- Automated Collection (T1119)
- Browser Session Hijacking (T1185)
- Clipboard Data (T1115)
- Data from Cloud Storage (T1530)
- Data from Configuration Repository (T1602)
- Data from Information Repositories (T1213)
- Data from Local System (T1005)
- Data from Network Shared Drive (T1039)
- Data from Removable Media (T1025)
- Data Staged (T1074)
- Email Collection (T1114)
- Input Capture (T1056)
- Screen Capture (T1113)
- Video Capture (T1125)
Maintaining communication with and control over compromised systems.
- Application Layer Protocol (T1071)
- Communication Through Removable Media (T1092)
- Content Injection (T1659)
- Data Encoding (T1132)
- Data Obfuscation (T1001)
- Dynamic Resolution (T1568)
- Encrypted Channel (T1573)
- Fallback Channels (T1008)
- Hide Infrastructure (T1665)
- Ingress Tool Transfer (T1105)
- Multi-Stage Channels (T1104)
- Non-Application Layer Protocol (T1095)
- Non-Standard Port (T1571)
- Protocol Tunneling (T1572)
- Proxy (T1090)
- Remote Access Tools (T1219)
- Traffic Signaling (T1205)
- Web Service (T1102)
17
Stealing and removing data from the victim's network.
- Automated Exfiltration (T1020)
- Data Transfer Size Limits (T1030)
- Exfiltration Over Alternative Protocol (T1048)
- Exfiltration Over C2 Channel (T1041)
- Exfiltration Over Other Network Medium (T1011)
- Exfiltration Over Physical Medium (T1052)
- Exfiltration Over Web Service (T1567)
- Scheduled Transfer (T1029)
- Transfer Data to Cloud Account (T1537)
17
Disrupting, degrading, or destroying systems and data.
- Account Access Removal (T1531)
- Data Destruction (T1485)
- Data Encrypted for Impact (T1486)
- Data Manipulation (T1565)
- Defacement (T1491)
- Disk Wipe (T1561)
- Email Bombing (T1667)
- Endpoint Denial of Service (T1499)
- Financial Theft (T1657)
- Firmware Corruption (T1495)
- Inhibit System Recovery (T1490)
- Network Denial of Service (T1498)
- Resource Hijacking (T1496)
- Service Stop (T1489)
- System Shutdown/Reboot (T1529)