CyberStrikeus/CyberStrike - الصفحة ١٠٢

t1560-archive-collected-data

An adversary may compress and/or encrypt data that is collected prior to exfiltration.

لغة النص الأصلي: الإنجليزية

t1602-001-snmp-mib-dump

Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP).

لغة النص الأصلي: الإنجليزية

t1602-002-network-device-configuration-dump

Adversaries may access network configuration files to collect sensitive data about the device and the network.

لغة النص الأصلي: الإنجليزية

t1602-data-from-configuration-repository

Adversaries may collect data related to managed devices from configuration repositories.

لغة النص الأصلي: الإنجليزية

t1011-001-exfiltration-over-bluetooth

Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel.

لغة النص الأصلي: الإنجليزية

t1011-exfiltration-over-other-network-medium

Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel.

لغة النص الأصلي: الإنجليزية

t1020-001-traffic-duplication

Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure.

لغة النص الأصلي: الإنجليزية

t1020-automated-exfiltration

Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.

لغة النص الأصلي: الإنجليزية

t1029-scheduled-transfer

Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals.

لغة النص الأصلي: الإنجليزية

t1030-data-transfer-size-limits

An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds.

لغة النص الأصلي: الإنجليزية

t1041-exfiltration-over-c2-channel

Adversaries may steal data by exfiltrating it over an existing command and control channel.

لغة النص الأصلي: الإنجليزية

t1048-001-exfiltration-over-symmetric-encrypted-non-c2-protocol

Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel.

لغة النص الأصلي: الإنجليزية

t1048-002-exfiltration-over-asymmetric-encrypted-non-c2-protocol

Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel.

لغة النص الأصلي: الإنجليزية

t1048-003-exfiltration-over-unencrypted-non-c2-protocol

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.

لغة النص الأصلي: الإنجليزية

t1048-exfiltration-over-alternative-protocol

Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel.

لغة النص الأصلي: الإنجليزية

t1052-001-exfiltration-over-usb

Adversaries may attempt to exfiltrate data over a USB connected physical device.

لغة النص الأصلي: الإنجليزية

t1052-exfiltration-over-physical-medium

Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive.

لغة النص الأصلي: الإنجليزية

t1537-transfer-data-to-cloud-account

Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.

لغة النص الأصلي: الإنجليزية

t1567-001-exfiltration-to-code-repository

Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel.

لغة النص الأصلي: الإنجليزية

t1567-002-exfiltration-to-cloud-storage

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.

لغة النص الأصلي: الإنجليزية

t1567-003-exfiltration-to-text-storage-sites

Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel.

لغة النص الأصلي: الإنجليزية

t1567-004-exfiltration-over-webhook

Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel.

لغة النص الأصلي: الإنجليزية

t1567-exfiltration-over-web-service

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel.

لغة النص الأصلي: الإنجليزية

t1001-001-junk-data

Adversaries may add junk data to protocols used for command and control to make detection more difficult.

لغة النص الأصلي: الإنجليزية

t1001-002-steganography

Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult.

لغة النص الأصلي: الإنجليزية

t1001-003-protocol-or-service-impersonation

Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts.

لغة النص الأصلي: الإنجليزية

t1001-data-obfuscation

Adversaries may obfuscate command and control traffic to make it more difficult to detect.

لغة النص الأصلي: الإنجليزية

t1008-fallback-channels

Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thre

لغة النص الأصلي: الإنجليزية

t1071-001-web-protocols

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.

لغة النص الأصلي: الإنجليزية

t1071-002-file-transfer-protocols

Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic.

لغة النص الأصلي: الإنجليزية

t1071-003-mail-protocols

Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic.

لغة النص الأصلي: الإنجليزية

t1071-004-dns

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic.

لغة النص الأصلي: الإنجليزية

t1071-005-publishsubscribe-protocols

Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic.

لغة النص الأصلي: الإنجليزية

t1071-application-layer-protocol

Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic.

لغة النص الأصلي: الإنجليزية

t1090-001-internal-proxy

Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment.

لغة النص الأصلي: الإنجليزية

t1090-002-external-proxy

Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.

لغة النص الأصلي: الإنجليزية

t1090-003-multi-hop-proxy

Adversaries may chain together multiple proxies to disguise the source of malicious traffic.

لغة النص الأصلي: الإنجليزية

t1090-004-domain-fronting

Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffi...

لغة النص الأصلي: الإنجليزية

t1090-proxy

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to ...

لغة النص الأصلي: الإنجليزية

t1092-communication-through-removable-media

Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.

لغة النص الأصلي: الإنجليزية