CyberStrikeus/CyberStrike - الصفحة ٩٤

t1027-015-compression

Adversaries may use compression to obfuscate their payloads or files.

لغة النص الأصلي: الإنجليزية

t1027-016-junk-code-insertion

Adversaries may use junk code / dead code to obfuscate a malware’s functionality.

لغة النص الأصلي: الإنجليزية

t1027-017-svg-smuggling

Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG files.

لغة النص الأصلي: الإنجليزية

t1027-obfuscated-files-or-information

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

لغة النص الأصلي: الإنجليزية

t1036-001-invalid-code-signature

Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool.

لغة النص الأصلي: الإنجليزية

t1036-002-right-to-left-override

Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign.

لغة النص الأصلي: الإنجليزية

t1036-003-rename-legitimate-utilities

Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities.

لغة النص الأصلي: الإنجليزية

t1036-004-masquerade-task-or-service

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign.

لغة النص الأصلي: الإنجليزية

t1036-005-match-legitimate-resource-name-or-location

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.

لغة النص الأصلي: الإنجليزية

t1036-006-space-after-filename

Adversaries can hide a program's true filetype by changing the extension of a file.

لغة النص الأصلي: الإنجليزية

t1036-007-double-file-extension

Adversaries may abuse a double extension in the filename as a means of masquerading the true file type.

لغة النص الأصلي: الإنجليزية

t1036-008-masquerade-file-type

Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents.

لغة النص الأصلي: الإنجليزية

t1036-009-break-process-trees

An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID).

لغة النص الأصلي: الإنجليزية

t1036-010-masquerade-account-name

Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign.

لغة النص الأصلي: الإنجليزية

t1036-011-overwrite-process-arguments

Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign process.

لغة النص الأصلي: الإنجليزية

t1036-012-browser-fingerprint

Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc.

لغة النص الأصلي: الإنجليزية

t1036-masquerading

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

لغة النص الأصلي: الإنجليزية

t1055-001-dynamic-link-library-injection

Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges.

لغة النص الأصلي: الإنجليزية

t1055-002-portable-executable-injection

Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges.

لغة النص الأصلي: الإنجليزية

t1055-003-thread-execution-hijacking

Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.

لغة النص الأصلي: الإنجليزية

t1055-004-asynchronous-procedure-call

Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges.

لغة النص الأصلي: الإنجليزية

t1055-005-thread-local-storage

Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade process-based defenses as well as possibly elevate privileges.

لغة النص الأصلي: الإنجليزية

t1055-008-ptrace-system-calls

Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges.

لغة النص الأصلي: الإنجليزية

t1055-009-proc-memory

Adversaries may inject malicious code into processes via the /proc filesystem in order to evade process-based defenses as well as possibly elevate privileges.

لغة النص الأصلي: الإنجليزية

t1055-011-extra-window-memory-injection

Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges.

لغة النص الأصلي: الإنجليزية

t1055-012-process-hollowing

Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses.

لغة النص الأصلي: الإنجليزية

t1055-013-process-doppelgnging

Adversaries may inject malicious code into process via process doppelgänging in order to evade process-based defenses as well as possibly elevate privileges.

لغة النص الأصلي: الإنجليزية

t1055-014-vdso-hijacking

Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process-based defenses as well as possibly elevate privileges.

لغة النص الأصلي: الإنجليزية

t1055-015-listplanting

Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.

لغة النص الأصلي: الإنجليزية

t1055-process-injection

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.

لغة النص الأصلي: الإنجليزية

t1070-001-clear-windows-event-logs

Adversaries may clear Windows Event Logs to hide the activity of an intrusion.

لغة النص الأصلي: الإنجليزية

t1070-002-clear-linux-or-mac-system-logs

Adversaries may clear system logs to hide evidence of an intrusion.

لغة النص الأصلي: الإنجليزية

t1070-003-clear-command-history

In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.

لغة النص الأصلي: الإنجليزية

t1070-004-file-deletion

Adversaries may delete files left behind by the actions of their intrusion activity.

لغة النص الأصلي: الإنجليزية

t1070-005-network-share-connection-removal

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

لغة النص الأصلي: الإنجليزية

t1070-006-timestomp

Adversaries may modify file time attributes to hide new files or changes to existing files.

لغة النص الأصلي: الإنجليزية

t1070-007-clear-network-connection-history-and-configurations

Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations.

لغة النص الأصلي: الإنجليزية

t1070-008-clear-mailbox-data

Adversaries may modify mail and mail application data to remove evidence of their activity.

لغة النص الأصلي: الإنجليزية

t1070-009-clear-persistence

Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity.

لغة النص الأصلي: الإنجليزية

t1070-010-relocate-malware

Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove evidence of their presence and/or avoid defenses.

لغة النص الأصلي: الإنجليزية