Mitre alert packs T1100-1199
- Borja Moro Moreno
T1105Ingress Tool Transfer | ||
PurposeAdversaries may transfer tools or other files from an external system into a compromised environment. This can be done through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (Lateral Tool Transfer). Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system. On Windows, adversaries may use various utilities to download tools, such as | Included alerts
| Prerequisitesdata sources
LOOKUPS |
T1110Brute Froce | ||
PurposeThis alert pack is vital to help to protect “the wall” of your systems, but it is also important to make sure that any misconfigured system accounts can work properly. These attacks are often repeated access attempts and are naturally noisy alerts when they do fire. This is because the attacker will not stop until they get through. The alerts included in the alert pack will help your SOC know of any issues or misconfigurations in your environment and provide an extra level of security for you and your business. Through the use of Brute Force an adversary, without knowledge of the password for an account or set of accounts, may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. | Included alerts
| Prerequisitesdata sources
LOOKUPS |
T1112Modify Registry | ||
PurposeAdversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution. Access to specific areas of the Registry depends on account permissions, some requiring administrator-level access. The built-in Windows command-line utility Reg may be used for local or remote Registry modification. Other tools may also be used, such as a remote access tool, which may contain functionality to interact with the Registry through the Windows API. Registry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via Reg or other utilities using the Win32 API. Adversaries may abuse these pseudo-hidden keys to conceal payloads/commands used to maintain persistence. The Registry of a remote system may be modified to aid in execution of files as part of lateral movement. It requires the remote Registry service to be running on the target system. Often Valid Accounts are required, along with access to the remote system's SMB/Windows Admin Shares for RPC communication. | Included alerts
| Prerequisitesdata sources
LOOKUPS |
T1114Email Collection | ||
PurposeAdversaries may target user email to collect sensitive information from mail servers or clients. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. | Included alerts
| PrerequisitesDATA SOURCES
LOOKUPS |
T1115Clipboard Data | ||
PurposeAdversaries may collect data stored in the clipboard from users copying information within or between applications. For example, adversaries can access clipboard data on Windows by using Systems with macOS and Linux also have commands, such as | Included alerts
| Prerequisitesdata sources
LOOKUPS |
T1119Automated Collection | ||
PurposeOnce established within a system or network, an adversary may use automated techniques to collect internal data. Methods to do this include the use of a Command and Scripting Interpreter to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals. In cloud-based environments, adversaries may also use cloud APIs and command line interfaces, or extract, transform, and load ETL services to automatically collect data. This functionality could also be built into remote access tools. This technique may incorporate use of other techniques such as File and Directory Discovery and Lateral Tool Transfer to identify and move files, as well as Cloud Service Dashboard and Cloud Storage Object Discovery to identify resources in cloud environments. | Included alerts
| Prerequisitesdata sources
LOOKUPS |
T1123Audio Capture | ||
PurposeAn adversary can leverage a computer's peripheral devices (microphones and webcams) or applications (voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information. Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture audio. Audio files may be written to disk and exfiltrated later. | Included alerts
| Prerequisitesdata sources
LOOKUPS |
T1133External Remote Services | ||
PurposeAdversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally. Access to Valid Accounts to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network. Access to remote services may be used as a redundant or persistent access mechanism during an operation. Access may also be gained through an exposed service that doesn’t require authentication. In containerized environments, this may include an exposed Docker API, Kubernetes API server, kubelet, or web application such as the Kubernetes dashboard. | Included alerts
| PrerequisitesDATA SOURCES
LOOKUPS |
T1134Access Token Manipulation | ||
PurposeAdversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone else. When this occurs, the process also takes on the security context associated with the new token. An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. These tokens can then be applied to an existing process (Token Impersonation/Theft) or used to spawn a new process (Create Process with Token). Any standard user can use the | Included alerts
| PrerequisitesData sources
lookups |
T1136Create Account | ||
PurposeThis alert pack helps you to control any sort of misuse of credentials to create accounts and help secure environments by notifying you. This alert pack can also help you to maintain compliance by confirming any sort of account that was created and approved and is audit-friendly. Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system. | Included alerts
| PrerequisitesDATA SOURCES
LOOKUPS |
T1140Deobfuscate-Decode Files or Information | ||
PurposeAdversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for this include built-in functionality of malware or using utilities present on the system. One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. Another example is using the Windows command Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution, such as entering the password. | Included alerts
| PrerequisitesDATA SOURCES
LOOKUPS |
T1189Drive-by Compromise | ||
PurposeAdversaries may gain access to a system through a user visiting a website over the normal course of browsing. There are multiple ways of delivering exploit code to a browser:
When the targeted website is visited by a specific community, such as government, a particular industry, or region, is often referred to as a strategic web compromise or watering hole attack. | Included alerts
| PrerequisitesDATA SOURCES
LOOKUPS |
T1190Exploit Public-Facing Application | ||
PurposeAdversaries may attempt to take advantage of a weakness in an Internet-facing computer or program using software, data, or commands in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, or a design vulnerability. These applications are often websites, but can include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other applications with Internet accessible open sockets, such as web servers and related services. Depending on the flaw being exploited this may include Exploitation for Defense Evasion. If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs, exploit container host access via Escape to Host, or take advantage of weak identity and access management policies. | Included alerts
| PrerequisitesDATA SOURCES
|