CyberStrikeus/CyberStrike - الصفحة ٩٦

t1218-014-mmc

Adversaries may abuse mmc.exe to proxy execution of malicious .msc files.

لغة النص الأصلي: الإنجليزية

t1218-015-electron-applications

Adversaries may abuse components of the Electron framework to execute malicious code.

لغة النص الأصلي: الإنجليزية

t1218-system-binary-proxy-execution

Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.

لغة النص الأصلي: الإنجليزية

t1220-xsl-script-processing

Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files.

لغة النص الأصلي: الإنجليزية

t1221-template-injection

Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts.

لغة النص الأصلي: الإنجليزية

t1222-001-windows-file-and-directory-permissions-modification

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.

لغة النص الأصلي: الإنجليزية

t1222-file-and-directory-permissions-modification

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.

لغة النص الأصلي: الإنجليزية

t1480-001-environmental-keying

Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment.

لغة النص الأصلي: الإنجليزية

t1480-002-mutual-exclusion

Adversaries may constrain execution or actions based on the presence of a mutex associated with malware.

لغة النص الأصلي: الإنجليزية

t1480-execution-guardrails

Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.

لغة النص الأصلي: الإنجليزية

t1484-001-group-policy-modification

Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain.

لغة النص الأصلي: الإنجليزية

t1484-002-trust-modification

Adversaries may add new domain trusts, modify the properties of existing domain trusts, or otherwise change the configuration of trust relationships between domains and tenants to evade defenses an...

لغة النص الأصلي: الإنجليزية

t1484-domain-or-tenant-policy-modification

Adversaries may modify the configuration settings of a domain or identity tenant to evade defenses and/or escalate privileges in centrally managed environments.

لغة النص الأصلي: الإنجليزية

t1497-001-system-checks

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.

لغة النص الأصلي: الإنجليزية

t1497-002-user-activity-based-checks

Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments.

لغة النص الأصلي: الإنجليزية

t1497-003-time-based-checks

Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time.

لغة النص الأصلي: الإنجليزية

t1497-virtualizationsandbox-evasion

Adversaries may employ various means to detect and avoid virtualization and analysis environments.

لغة النص الأصلي: الإنجليزية

t1535-unusedunsupported-cloud-regions

Adversaries may create cloud instances in unused geographic service regions in order to evade detection.

لغة النص الأصلي: الإنجليزية

t1542-004-rommonkit

Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect.

لغة النص الأصلي: الإنجليزية

t1542-005-tftp-boot

Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server.

لغة النص الأصلي: الإنجليزية

t1542-pre-os-boot

Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system.

لغة النص الأصلي: الإنجليزية

t1548-006-tcc-manipulation

Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database to grant malicious executables elevated permissions.

لغة النص الأصلي: الإنجليزية

t1550-001-application-access-token

Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems.

لغة النص الأصلي: الإنجليزية

t1550-002-pass-the-hash

Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls.

لغة النص الأصلي: الإنجليزية

t1550-003-pass-the-ticket

Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls.

لغة النص الأصلي: الإنجليزية

t1550-004-web-session-cookie

Adversaries can use stolen session cookies to authenticate to web applications and services.

لغة النص الأصلي: الإنجليزية

t1550-use-alternate-authentication-material

Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal s...

لغة النص الأصلي: الإنجليزية

t1553-001-gatekeeper-bypass

Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs.

لغة النص الأصلي: الإنجليزية

t1553-002-code-signing

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools.

لغة النص الأصلي: الإنجليزية

t1553-003-sip-and-trust-provider-hijacking

Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks.

لغة النص الأصلي: الإنجليزية

t1553-004-install-root-certificate

Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.

لغة النص الأصلي: الإنجليزية

t1553-005-mark-of-the-web-bypass

Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls.

لغة النص الأصلي: الإنجليزية

t1553-006-code-signing-policy-modification

Adversaries may modify code signing policies to enable execution of unsigned or self-signed code.

لغة النص الأصلي: الإنجليزية

t1553-subvert-trust-controls

Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs.

لغة النص الأصلي: الإنجليزية

t1562-001-disable-or-modify-tools

Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities.

لغة النص الأصلي: الإنجليزية

t1562-002-disable-windows-event-logging

Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits.

لغة النص الأصلي: الإنجليزية

t1562-003-impair-command-history-logging

Adversaries may impair command history logging to hide commands they run on a compromised system.

لغة النص الأصلي: الإنجليزية

t1562-004-disable-or-modify-system-firewall

Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage.

لغة النص الأصلي: الإنجليزية

t1562-006-indicator-blocking

An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed.

لغة النص الأصلي: الإنجليزية

t1562-007-disable-or-modify-cloud-firewall

Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources.

لغة النص الأصلي: الإنجليزية