...
T1505Server Software Component | ||||||||||
PurposeAdversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications. | Included alerts
| Prerequisites
| ||||||||
T1525Implant Internal Image | ||||||||||
PurposeAdversaries may implant cloud or container images with malicious code to establish persistence after gaining access to an environment. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be implanted or backdoored. Unlike Upload Malware, this technique focuses on images. Depending on how the infrastructure is provisioned, this could provide persistent access (if provisioning tool is instructed to always use the latest image). A tool has been developed to facilitate planting backdoors in cloud container images. If an adversary has access to a compromised AWS instance, and permissions to list the available container images, they may implant a backdoor such as a Web Shell. | Included alerts
| Prerequisites
| ||||||||
T1526Cloud Service Discovery | ||||||||||
PurposeAn adversary may attempt to enumerate the cloud services running on a system after gaining access, which can be platform-as-a-service (PaaS), infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Azure AD, etc. Azure tools and APIs (Azure AD Graph API and Azure Resource Manager API) can enumerate resources and services, including applications, management groups, resources and policy definitions, and their relationships that are accessible by an identity. Stormspotter is an open source tool for enumerating and constructing a graph for Azure resources and services. Pacu is an open source AWS exploitation framework that supports several methods for discovering cloud services. | Included alerts
| Prerequisites
| ||||||||
T1528Steal Application Access Token | ||||||||||
PurposeAdversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS). OAuth is one commonly implemented framework to issue tokens and adversaries steal them to be able to access data and perform actions with the permissions of these accounts, which can lead to privilege escalation and further compromise of the environment. In Kubernetes environments, processes running inside a container communicate with the Kubernetes API server using service account tokens. If a container is compromised, an attacker may be able to steal the container’s token and thereby gain access to Kubernetes API commands. Token theft can also occur through social engineering, in which case user action may be required to grant access. An application desiring access to cloud-based services or protected APIs can gain entry using OAuth 2.0 through a variety of authorization protocols. A commonly-used sequence is Microsoft's Authorization Code Grant flow, where an OAuth access token enables a third-party application to interact with resources containing user data in the ways requested by the application without obtaining user credentials. | Included alerts
| Prerequisites
| ||||||||
T1530Data from Cloud Storage Object | ||||||||||
PurposeAdversaries may access data from improperly secured cloud storage. Many cloud service providers offer solutions for online data object storage, either without an overarching application (Amazon S3, Azure Storage, and Google Cloud Storage) or as a peripheral use case of their platform (Slack, Confluence, and Salesforce). Providers typically offer security guides to help end users configure systems, though misconfigurations are a common problem. One of the examples is unintentionally allowing public access to unauthenticated users, overly-broad access by all users, or even access for any anonymous person outside the control of the Identity Access Management system without even needing basic user permissions. This open access may expose various types of sensitive data, such as credit cards, personally identifiable information, or medical records. Adversaries may also obtain and then abuse leaked credentials from source repositories, logs, or other means as a way to gain access to cloud storage objects. | Included alerts
| Prerequisites
| ||||||||
T1531Account Access Removal | ||||||||||
PurposeAdversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users (delete, lock or manipulate) to subsequently log off and/or perform a System Shutdown/Reboot to set malicious changes into place. In Windows, Net utility ( Adversaries who use ransomware or similar attacks may first perform this and other Impact behaviors, such as Data Destruction and Defacement, in order to impede incident response/recovery before completing the Data Encrypted for Impact objective. | Included alerts
| Prerequisites
| ||||||||
T1537Transfer Data to Cloud Account | ||||||||||
PurposeAdversaries may exfiltrate data, including backups of cloud environments, to another cloud account they control on the same service to avoid typical file transfers/downloads and network-based exfiltration detection. This is because a defender who is monitoring data transfers may not be watching for transfers within the same cloud provider. Such transfers may utilize existing cloud provider APIs and the internal address space of the cloud provider to blend into normal traffic or avoid data transfers over external network interfaces. | Included alerts
| Prerequisites
| ||||||||
T1539Steal Web Session Cookie | ||||||||||
PurposeAn adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used and can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Session cookies can be used to bypasses some multi-factor authentication protocols. There are several examples of malware targeting cookies from web browsers on the local system and also open source frameworks, such as Evilginx 2 and Muraena, to gather session cookies through a malicious proxy (Adversary-in-the-Middle), which can be set up and used in phishing campaigns. After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application. | Included alerts
| Prerequisites
| ||||||||
T1543Create of Modify System Process | ||||||||||
PurposeAdversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions (called services on Windows and Linux, and Launch Daemon/Launch Agent on MacOS, which are run to finish system initialization and load user specific parameters). Adversaries may install new services, daemons, or agents, or modify existing ones, that can be configured to execute at startup or a repeatable interval in order to establish persistence. Services, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges. Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges. | Included alerts
| Prerequisites
| ||||||||
T1546Event Triggered Execution | ||||||||||
PurposeAdversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events. Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked. Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges. | Included alerts
| Prerequisites
| ||||||||
T1547Boot or Logon Autostart Execution | ||||||||||
PurposeAdversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms to automatically run a program on system boot or account logon, which may include automatically executing programs placed in specially designated directories or in repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel. Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges. | Included alerts
| Prerequisites
| ||||||||
T1548Abuse Elevation Control Mechanism | ||||||||||
PurposeAdversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system | Included alerts
| Prerequisites
| ||||||||
T1550Use Alternate Authentication Material | ||||||||||
PurposeAdversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. Authentication processes generally require a valid identity (username) along with one or more authentication factors (password, pin, physical smart card, token generator, etc.). Alternate authentication material is legitimately generated by systems after both identity and authentication factors are provided or during the identity creation process. Caching alternate authentication material allows the system to verify identity without asking for factors again. Due to the fact that it must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through Credential Access techniques. By stealing them, adversaries are able to bypass system access controls and authenticate to systems. | Included alerts
| Prerequisites
| ||||||||
T1552Unsecured Credentials | ||||||||||
PurposeAdversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (Bash History), operating system or application-specific repositories (Credentials in Registry), or other specialized files/artifacts (Private Keys). | Included alerts
| Prerequisites
| ||||||||
T1553Subvert Trust Controls | ||||||||||
PurposeAdversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. They are allowed to run signed by a valid code certificate and the user is warned about an attribute set downloaded from the Internet or an untrusted site. The method used will depend on the specific mechanism they seek to subvert (File and Directory Permissions Modification or Modify Registry). They may also create or steal code signing certificates to acquire trust on target systems. | Included alerts
| Prerequisites
| ||||||||
T1555Credentials from Password Stores | ||||||||||
PurposeAdversaries may search for common password storage locations to obtain user credentials. Once credentials are obtained, they can be used to perform lateral movement and access restricted information. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications that store passwords to make it easier for users manage and maintain. | Included alerts
| Prerequisites
| ||||||||
T1556Modify Authentication Process | ||||||||||
PurposeAdversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts, being able to authenticate to a service or system without using Valid Accounts. The authentication process is handled by mechanisms responsible responsible for gathering, storing, and validating credentials
Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. | Included alerts
| Prerequisites
| ||||||||
T1558Steal or Forge Kerberos Tickets | ||||||||||
PurposeAdversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket. Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as "realms", there are three basic participants: client, service, and Key Distribution Center (KDC). Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. | Included alerts
| Prerequisites
| ||||||||
T1560Archive Collected Data | ||||||||||
PurposeAn adversary may compress and/or encrypt data that is collected prior to exfiltration. This can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide exfiltrated information from detection or make exfiltration less conspicuous upon inspection. Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method. | Included alerts
| Prerequisites
| ||||||||
T1562Impair Defenses | ||||||||||
PurposeThis alert pack helps you protect against an adversary that has infiltrated your system and is trying to remove barriers for other adversaries. It provides the necessary information to stop and remediate any damage caused before it is too late. Adversaries may maliciously modify components of a victim’s environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus but also detection capabilities that can use to audit activity and identify malicious behavior. This may also span both native defenses as well as supplemental capabilities installed by users and administrators. | Included alerts
| Prerequisites
| ||||||||
T1563Remote Service Session Hijacking
| ||||||||||
PurposeAdversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may employ valid credentials to log in to a service specifically designed to accept remote connections, such as telnet, SSH, and RDP, and a session will be established to maintain a continuous interaction with that service. Adversaries may commandeer these sessions to carry out actions on remote systems. Remote Service Session Hijacking differs from use of Remote Services because it hijacks an existing session rather than creating a new session using Valid Accounts. | Included alerts
| Prerequisites
| ||||||||
T1565Data Manipulation | ||||||||||
PurposeAdversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data. By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making. The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact. | Included alerts
| Prerequisites
| ||||||||
T1566Phishing | ||||||||||
PurposeAdversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted at a specific individual, company, or industry, which is known as spearphishing, or mass malware spam campaigns, which is known as non-targeted phishing. Adversaries may send victims emails or use social media to send malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also involve social engineering techniques (posing as a trusted source), as well as evasive techniques (removing or manipulating emails or metadata/headers from the compromised accounts used as senders as in Email Hiding Rules). They also forge or spoof the identity of the sender which can be used to fool both the human recipient as well as automated security tools. Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer. | Included alerts
| Prerequisites
| ||||||||
T1567Exfiltration Over Web Service | ||||||||||
PurposeAdversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services and web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. | Included alerts
| Prerequisites
| ||||||||
T1568Dynamic Resolution | ||||||||||
PurposeAdversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control. Adversaries may use dynamic resolution for the purpose of Fallback Channels. When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control. | Included alerts
| Prerequisites
| ||||||||
T1569System Services | ||||||||||
PurposeAdversaries may abuse system services or daemons to execute commands or programs. To do this, they can execute malicious content by interacting with or creating services either locally or remotely. Many services are set to run at boot, which can aid in achieving persistence (Create or Modify System Process), but they can also abuse services for one-time or temporary execution. | Included alerts
| Prerequisites
| ||||||||
T1571Non-Standard Port  | ||||||||||
PurposeAdversaries may communicate using a protocol and port paring that are typically not associated, or make changes to the standard port used by a protocol, to bypass filtering or muddle analysis/parsing of network data. | Included alerts
| Prerequisites
| ||||||||
T1572Protocol Tunneling  | ||||||||||
PurposeAdversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). There are various means to encapsulate a protocol within another protocol. For example, adversaries may perform SSH tunneling (also known as SSH port forwarding), which involves forwarding arbitrary data over an encrypted SSH tunnel. Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet. Known as DNS over HTTPS (DoH), queries to resolve C2 infrastructure may be encapsulated within encrypted HTTPS packets. Protocol Tunneling may also be abused by adversaries during Dynamic Resolution or in conjunction with Proxy and/or Protocol Impersonation to further conceal C2 communications and infrastructure. | Included alerts
| Prerequisites
| ||||||||
T1574Hijack Execution Flow | ||||||||||
PurposeAdversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time, as well as to elevate privileges or evade defenses, such as application control or other restrictions on execution. There are many ways to this such as manipulating how the operating system locates programs to be executed, how the operating system locates libraries to be used by a program, or the locations where the operating system looks for programs/resources (file directories or the Registry in Windows). | Included alerts
| Prerequisites
| ||||||||
T1578Modify Cloud Compute Infrastructure | ||||||||||
PurposeAn adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots. Permissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure. Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence. | Included alerts
| Prerequisites
| ||||||||
T1580Cloud Infrastructure Discovery | ||||||||||
PurposeThis alert pack will let you know when the attackers are looking for valuable information about your clouds and can help your team respond to all discovery threats. An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services. | Included alerts
| Prerequisites
| ||||||||
T1585Establish Accounts  | ||||||||||
PurposeAdversaries may create and cultivate accounts with services that can be used during targeting, and create accounts that can be used to build a persona for further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy. For operations incorporating social engineering, the utilization of an online persona may be important, and they may be fictitious or impersonate real people. Establishing a persona may require development of additional documentation to make them seem real. Establishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for Phishing for Information. | Included alerts
| Prerequisites
| ||||||||
T1587Develop Capabilities  | ||||||||||
PurposeAdversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle. As with legitimate development efforts, different skill sets may be required for developing capabilities, and they may be located in-house contracted out. The use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability. | Included alerts
| Prerequisites
| ||||||||
T1588Obtain Capabilities | ||||||||||
PurposeAdversaries may buy, free download and/or steal capabilities that can be used during targeting, rather than developing their own capabilities in-house, in order to support their operations throughout numerous phases of the adversary lifecycle. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. When purchasing capabilities from third-party entities, they do so from technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals. When stealing capabilities from third-party entities (including other adversaries), they include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits. | Included alerts
| Prerequisites
| ||||||||
T1589Gather Victim Identity Information | ||||||||||
PurposeAdversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (employee names, email addresses, etc.) as well as sensitive details such as credentials. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about users could also be enumerated via other active means such as probing and analyzing responses from authentication services that may reveal valid usernames in a system (Active Scanning). | Included alerts
| Prerequisites
| ||||||||
T1590Gather Victim Network Information | ||||||||||
PurposeAdversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (IP ranges, domain names, etc.) as well as specifics regarding its topology and operations. To gather this, adversaries perform direct collection actions via Active Scanning or Phishing for Information. It may also be exposed via online or other accessible data sets (Search Open Technical Databases). Gathering this information may reveal opportunities for other forms of reconnaissance (Active Scanning or Search Open Websites/Domains), establishing operational resources (Acquire Infrastructure or Compromise Infrastructure), and/or initial access (Trusted Relationship). | Included alerts
| Prerequisites
| ||||||||
T1592Gather Victim Host Information | ||||||||||
PurposeAdversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (name, assigned IP, functionality, etc.) and specifics regarding its configuration (operating system, language, etc.). To gather this, adversaries perform direct collection actions via Active Scanning or Phishing for Information. They may also compromise sites and then include malicious content designed to collect host information from visitors. Information about hosts may also be exposed via online or other accessible data sets (Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (Develop Capabilities or Obtain Capabilities), and/or initial access (Supply Chain Compromise or External Remote Services). | Included alerts
| Prerequisites
| ||||||||
T1595Active Scanning | ||||||||||
PurposeAdversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction. Depending on the information they seek, this can be done in various ways, include the use of native features of network protocols such as ICMP. Information from these scans may reveal opportunities for other forms of reconnaissance (Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (Develop Capabilities or Obtain Capabilities), and/or initial access (External Remote Services or Exploit Public-Facing Application). | Included alerts
| Prerequisites
| ||||||||
T1599Network Boundary Bridging | ||||||||||
PurposeAdversaries may bridge network boundaries by compromising perimeter network devices or internal devices responsible for network segmentation, bypassing restrictions on traffic routing that otherwise separate trusted and untrusted networks. Devices such as routers and firewalls can be used to create boundaries between trusted and untrusted networks by restricting traffic types. Restriction can be achieved by prohibiting IP addresses, layer 4 protocol ports, or through deep packet inspection to identify applications. To participate with the rest of the network, these devices can be directly addressable or transparent, but their mode of operation has no bearing on how the adversary can bypass them when compromised. When an adversary takes control of such a boundary device, they can bypass its policy enforcement to pass normally prohibited traffic across the trust boundary between the two separated networks without hinderance. By achieving sufficient rights on the device, an adversary can reconfigure the device to allow the traffic they want for command and control via Multi-hop Proxy or exfiltration of data via Traffic Duplication. Adversaries may also target internal devices responsible for network segmentation and abuse them in conjunction with Internal Proxy. In the cases where a border device separates two separate organizations, the adversary can also facilitate lateral movement into new victim environments. | Included alerts
| Prerequisites
| ||||||||
...