RECONNAISSANCE
11
Gathering information to plan future operations
- Active Scanning (T1595)
- Gather Victim Host Information (T1592)
- Gather Victim Identity Information (T1589)
- Gather Victim Network Information (T1590)
- Gather Victim Org Info (T1591)
- Phishing for Information (T1598)
- Search Closed Sources (T1597)
- Search Open Technical Databases (T1596)
- Search Open Websites/Domains (T1593)
- Search Threat Vendor Data (T1681)
- Search Victim-Owned Websites (T1594)
RESOURCE DEVELOPMENT
8
Establishing resources to support operations
INITIAL ACCESS
11
Gaining initial foothold in the network
- Content Injection (T1659)
- Drive-by Compromise (T1189)
- Exploit Public-Facing Application (T1190)
- External Remote Services (T1133)
- Hardware Additions (T1200)
- Phishing (T1566)
- Replication Through Removable Media (T1091)
- Supply Chain Compromise (T1195)
- Trusted Relationship (T1199)
- Valid Accounts (T1078)
- Wi-Fi Networks (T1669)
EXECUTION
17
Running malicious code on victim systems
- Cloud Administration Command (T1651)
- Command and Scripting Interpreter (T1059)
- Container Administration Command (T1609)
- Deploy Container (T1610)
- ESXi Administration Command (T1675)
- Exploitation for Client Execution (T1203)
- Input Injection (T1674)
- Inter-Process Communication (T1559)
- Native API (T1106)
- Poisoned Pipeline Execution (T1677)
- Scheduled Task/Job (T1053)
- Serverless Execution (T1648)
- Shared Modules (T1129)
- Software Deployment Tools (T1072)
- System Services (T1569)
- User Execution (T1204)
- Windows Management Instrumentation (T1047)
PERSISTENCE
23
Maintaining foothold across system reboots
- Account Manipulation (T1098)
- BITS Jobs (T1197)
-
Boot or Logon Autostart Execution (T1547)
- Registry Run Keys / Startup Folder (.001)
- Authentication Package (.002)
- Time Providers (.003)
- Winlogon Helper DLL (.004)
- Security Support Provider (.005)
- Kernel Modules and Extensions (.006)
- Re-opened Applications (.007)
- LSASS Driver (.008)
- Shortcut Modification .0029)
- Port Monitors (.010)
- Print Processors (.012)
- XDG Autostart Entries (.013)
- Active Setup (.014)
- Login Items (.015)
- Boot or Logon Initialization Scripts (T1037)
- Cloud Application Integration (T1671)
- Compromise Host Software Binary (T1554)
- Create Account (T1136)
- Create or Modify System Process (T1543)
-
Event Triggered Execution (T1546)
- Change Default File Association (.001)
- Screensaver (.002)
- Windows Management Instrumentation Event Subscription (.003)
- Unix Shell Configuration Modification (.004)
- Trap (.005)
- LC_LOAD_DYLIB Addition (.006)
- Netsh Helper DLL (.007)
- Accessibility Features (.008)
- AppCert DLLs (.009)
- AppInit DLLs (.010)
- Application Shimming (.011)
- Image File Execution Options Injection (.012)
- PowerShell Profile (.013)
- Emond (.014)
- Component Object Model Hijacking (.015)
- Installer Packages (.016)
- Udev Rules (.017)
- Python Startup Hooks (.018)
- Exclusive Control (T1668)
- External Remote Services (T1133)
-
Hijack Execution Flow (T1574)
- DLL (.001)
- Dylib Hijacking (.004)
- Executable Installer File Permissions Weakness (.005)
- Dynamic Linker Hijacking (.006)
- Path Interception by PATH Environment Variable (.007)
- Path Interception by Search Order Hijacking (.008)
- Path Interception by Unquoted Path (.009)
- Services File Permissions Weakness (.010)
- Services Registry Permissions Weakness (.011)
- COR_PROFILER (.012)
- KernelCallbackTable (.013)
- AppDomainManager (.014)
- Implant Internal Image (T1525)
- Modify Authentication Process (T1556)
- Modify Registry (T1112)
- Office Application Startup (T1137)
- Power Settings (T1653)
- Pre-OS Boot (T1542)
- Scheduled Task/Job (T1053)
- Server Software Component (T1505)
- Software Extensions (T1176)
- Traffic Signaling (T1205)
- Valid Accounts (T1078)
PRIVILEGE ESCALATION
14
Gaining higher-level permissions
- Abuse Elevation Control Mechanism (T1548)
- Access Token Manipulation (T1134)
- Account Manipulation (T1098)
-
Boot or Logon Autostart Execution (T1547)
- Registry Run Keys / Startup Folder (.001)
- Authentication Package (.002)
- Time Providers (.003)
- Winlogon Helper DLL (.004)
- Security Support Provider (.005)
- Kernel Modules and Extensions (.006)
- Re-opened Applications (.007)
- LSASS Driver (.008)
- Shortcut Modification (.009)
- Port Monitors (.010)
- Print Processors (.012)
- XDG Autostart Entries (.013)
- Active Setup (.014)
- Login Items (.015)
- Boot or Logon Initialization Scripts (T1037)
- Create or Modify System Process (T1543)
- Domain or Tenant Policy Modification (T1484)
- Escape to Host (T1611)
-
Event Triggered Execution (T1546)
- Change Default File Association (.001)
- Screensaver (.002)
- Windows Management Instrumentation Event Subscription (.003)
- Unix Shell Configuration Modification (.004)
- Trap (.005)
- LC_LOAD_DYLIB Addition (.006)
- Netsh Helper DLL (.007)
- Accessibility Features (.008)
- AppCert DLLs (.009)
- AppInit DLLs (.010)
- Application Shimming (.011)
- Image File Execution Options Injection (.012)
- PowerShell Profile (.013)
- Emond (.014)
- Component Object Model Hijacking (.015)
- Installer Packages (.016)
- Udev Rules (.017)
- Python Startup Hooks (.018)
- Exploitation for Privilege Escalation (T1068)
-
Hijack Execution Flow (T1574)
- DLL (.001)
- Dylib Hijacking (.004)
- Executable Installer File Permissions Weakness (.005)
- Dynamic Linker Hijacking (.006)
- Path Interception by PATH Environment Variable (.007)
- Path Interception by Search Order Hijacking (.008)
- Path Interception by Unquoted Path (.009)
- Services File Permissions Weakness (.010)
- Services Registry Permissions Weakness (.011)
- COR_PROFILER (.012)
- KernelCallbackTable (.013)
- AppDomainManager (.014)
-
Process Injection (T1055)
- Dynamic-link Library Injection (.001)
- Portable Executable Injection (.002)
- Thread Execution Hijacking (.003)
- Asynchronous Procedure Call (.004)
- Thread Local Storage (.005)
- Ptrace System Calls (.008)
- Proc Memory (.009)
- Extra Window Memory Injection (.011)
- Process Hollowing (.012)
- Process Doppelgänging (.013)
- VDSO Hijacking (.014)
- ListPlanting (.015)
- Scheduled Task/Job (T1053)
- Valid Accounts (T1078)
DEFENSE EVASION
47
Avoiding detection by security controls
- Abuse Elevation Control Mechanism (T1548)
- Access Token Manipulation (T1134)
- BITS Jobs (T1197)
- Build Image on Host (T1612)
- Debugger Evasion (T1622)
- Delay Execution (T1678)
- Deobfuscate/Decode Files or Information (T1140)
- Deploy Container (T1610)
- Direct Volume Access (T1006)
- Domain or Tenant Policy Modification (T1484)
- Email Spoofing (T1672)
- Execution Guardrails (T1480)
- Exploitation for Defense Evasion (T1211)
- File and Directory Permissions Modification (T1222)
-
Hide Artifacts (T1564)
- Hidden Files and Directories (.001)
- Hidden Users (.002)
- Hidden Window (.003)
- NTFS File Attributes (.004)
- Hidden File System (.005)
- Run Virtual Instance (.006)
- VBA Stomping (.007)
- Email Hiding Rules (.008)
- Resource Forking (.009)
- Process Argument Spoofing (.010)
- Ignore Process Interrupts (.011)
- File/Path Exclusions (.012)
- Bind Mounts (.013)
- Extended Attributes (.014)
-
Hijack Execution Flow (T1574)
- DLL (.001)
- Dylib Hijacking (.004)
- Executable Installer File Permissions Weakness (.005)
- Dynamic Linker Hijacking (.006)
- Path Interception by PATH Environment Variable (.007)
- Path Interception by Search Order Hijacking (.008)
- Path Interception by Unquoted Path (.009)
- Services File Permissions Weakness (.010)
- Services Registry Permissions Weakness (.011)
- COR_PROFILER (.012)
- KernelCallbackTable (.013)
- AppDomainManager (.014)
-
Impair Defenses (T1562)
- Disable or Modify Tools (.001)
- Disable Windows Event Logging (.002)
- Impair Command History Logging (.003)
- Disable or Modify System Firewall (.004)
- Indicator Blocking (.006)
- Disable or Modify Cloud Firewall (.007)
- Disable or Modify Cloud Logs (.008)
- Safe Mode Boot (.009)
- Downgrade Attack (.010)
- Spoof Security Alerting (.011)
- Disable or Modify Linux Audit System (.012)
- Disable or Modify Network Device Firewall (.013)
- Impersonation (T1656)
-
Indicator Removal (T1070)
- Clear Windows Event Logs (.001)
- Clear Linux or Mac System Logs (.002)
- Clear Command History (.003)
- File Deletion (.004)
- Network Share Connection Removal (.005)
- Timestomp (.006)
- Clear Network Connection History and Configurations (.007)
- Clear Mailbox Data (.008)
- Clear Persistence (.009)
- Relocate Malware (.010)
- Indirect Command Execution (T1202)
-
Masquerading (T1036)
- Invalid Code Signature (.001)
- Right-to-Left Override (.002)
- Rename Legitimate Utilities (.003)
- Masquerade Task or Service (.004)
- Match Legitimate Resource Name or Location (.005)
- Space after Filename (.006)
- Double File Extension (.007)
- Masquerade File Type (.008)
- Break Process Trees (.009)
- Masquerade Account Name (.010)
- Overwrite Process Arguments (.011)
- Browser Fingerprint (.012)
- Modify Authentication Process (T1556)
- Modify Cloud Compute Infrastructure (T1578)
- Modify Cloud Resource Hierarchy (T1666)
- Modify Registry (T1112)
- Modify System Image (T1601)
- Network Boundary Bridging (T1599)
-
Obfuscated Files or Information (T1027)
- Binary Padding (.001)
- Software Packing (.002)
- Steganography (.003)
- Compile After Delivery (.004)
- Indicator Removal from Tools (.005)
- HTML Smuggling (.006)
- Dynamic API Resolution (.007)
- Stripped Payloads (.008)
- Embedded Payloads (.009)
- Command Obfuscation (.0110)
- Fileless Storage (.011)
- LNK Icon Smuggling (.012)
- Encrypted/Encoded File (.013)
- Polymorphic Code (.014)
- Compression (.015)
- Junk Code Insertion (.016)
- SVG Smuggling (.017)
- Plist File Modification (T1647)
- Pre-OS Boot (T1542)
-
Process Injection (T1055)
- Dynamic-link Library Injection (.001)
- Portable Executable Injection (.002)
- Thread Execution Hijacking (.003)
- Asynchronous Procedure Call (.004)
- Thread Local Storage (.005)
- Ptrace System Calls (.008)
- Proc Memory (.009)
- Extra Window Memory Injection (.011)
- Process Hollowing (.012)
- Process Doppelgänging (.013)
- VDSO Hijacking (.014)
- ListPlanting (.015)
- Reflective Code Loading (T1620)
- Rogue Domain Controller (T1207)
- Rootkit (T1014)
- Selective Exclusion (T1679)
- Subvert Trust Controls (T1553)
- System Binary Proxy Execution (T1218)
- System Script Proxy Execution (T1216)
- Template Injection (T1221)
- Traffic Signaling (T1205)
- Trusted Developer Utilities Proxy Execution (T1127)
- Unused/Unsupported Cloud Regions (T1535)
- Use Alternate Authentication Material (T1550)
- Valid Accounts (T1078)
- Virtualization/Sandbox Evasion (T1497)
- Weaken Encryption (T1600)
- XSL Script Processing (T1220)
CREDENTIAL ACCESS
17
Stealing account names and passwords
DISCOVERY
17
Stealing account names and passwords
LATERAL MOVEMENT
17
Stealing account names and passwords
COLLECTION
17
Stealing account names and passwords
COMMAND AND CONTROL
17
Stealing account names and passwords
EXFILTRATION
17
Stealing account names and passwords
IMPACT
17
Stealing account names and passwords