CyberStrikeus/CyberStrike - الصفحة ٩٨

t1647-plist-file-modification

Adversaries may modify property list files (plist files) to enable other malicious activity, while also potentially evading and bypassing system defenses.

لغة النص الأصلي: الإنجليزية

t1656-impersonation

Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf.

لغة النص الأصلي: الإنجليزية

t1666-modify-cloud-resource-hierarchy

Adversaries may attempt to modify hierarchical structures in infrastructure-as-a-service (IaaS) environments in order to evade defenses.

لغة النص الأصلي: الإنجليزية

t1672-email-spoofing

Adversaries may fake, or spoof, a sender’s identity by modifying the value of relevant email headers in order to establish contact with victims under false pretenses.

لغة النص الأصلي: الإنجليزية

t1678-delay-execution

Adversaries may employ various time-based methods to evade detection and analysis.

لغة النص الأصلي: الإنجليزية

t1679-selective-exclusion

Adversaries may intentionally exclude certain files, folders, directories, file types, or system components from encryption or tampering during a ransomware or malicious payload execution.

لغة النص الأصلي: الإنجليزية

t1003-001-lsass-memory

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).

لغة النص الأصلي: الإنجليزية

t1003-002-security-account-manager

Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is...

لغة النص الأصلي: الإنجليزية

t1003-003-ntds

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as...

لغة النص الأصلي: الإنجليزية

t1003-004-lsa-secrets

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service...

لغة النص الأصلي: الإنجليزية

t1003-005-cached-domain-credentials

Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.

لغة النص الأصلي: الإنجليزية

t1003-006-dcsync

Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API) to simulate the replication process fr...

لغة النص الأصلي: الإنجليزية

t1003-007-proc-filesystem

Adversaries may gather credentials from the proc filesystem or `/proc`.

لغة النص الأصلي: الإنجليزية

t1003-008-etcpasswd-and-etcshadow

Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable offline password cracking.

لغة النص الأصلي: الإنجليزية

t1003-os-credential-dumping

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password.

لغة النص الأصلي: الإنجليزية

t1040-network-sniffing

Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network.

لغة النص الأصلي: الإنجليزية

t1110-001-password-guessing

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts.

لغة النص الأصلي: الإنجليزية

t1110-002-password-cracking

Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained.

لغة النص الأصلي: الإنجليزية

t1110-003-password-spraying

Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials.

لغة النص الأصلي: الإنجليزية

t1110-004-credential-stuffing

Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap.

لغة النص الأصلي: الإنجليزية

t1110-brute-force

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.

لغة النص الأصلي: الإنجليزية

t1111-multi-factor-authentication-interception

Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and netw...

لغة النص الأصلي: الإنجليزية

t1187-forced-authentication

Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept.

لغة النص الأصلي: الإنجليزية

t1212-exploitation-for-credential-access

Adversaries may exploit software vulnerabilities in an attempt to collect credentials.

لغة النص الأصلي: الإنجليزية

t1528-steal-application-access-token

Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.

لغة النص الأصلي: الإنجليزية

t1539-steal-web-session-cookie

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.

لغة النص الأصلي: الإنجليزية

t1552-001-credentials-in-files

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

لغة النص الأصلي: الإنجليزية

t1552-002-credentials-in-registry

Adversaries may search the Registry on compromised systems for insecurely stored credentials.

لغة النص الأصلي: الإنجليزية

t1552-003-shell-history

Adversaries may search the command history on compromised systems for insecurely stored credentials.

لغة النص الأصلي: الإنجليزية

t1552-004-private-keys

Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials.

لغة النص الأصلي: الإنجليزية

t1552-005-cloud-instance-metadata-api

Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.

لغة النص الأصلي: الإنجليزية

t1552-006-group-policy-preferences

Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP).

لغة النص الأصلي: الإنجليزية

t1552-007-container-api

Adversaries may gather credentials via APIs within a containers environment.

لغة النص الأصلي: الإنجليزية

t1552-008-chat-messages

Adversaries may directly collect unsecured credentials stored or passed through user communication services.

لغة النص الأصلي: الإنجليزية

t1552-unsecured-credentials

Adversaries may search compromised systems to find and obtain insecurely stored credentials.

لغة النص الأصلي: الإنجليزية

t1555-001-keychain

Adversaries may acquire credentials from Keychain.

لغة النص الأصلي: الإنجليزية

t1555-002-securityd-memory

An adversary with root access may gather credentials by reading `securityd`’s memory.

لغة النص الأصلي: الإنجليزية

t1555-003-credentials-from-web-browsers

Adversaries may acquire credentials from web browsers by reading files specific to the target browser.

لغة النص الأصلي: الإنجليزية

t1555-004-windows-credential-manager

Adversaries may acquire credentials from the Windows Credential Manager.

لغة النص الأصلي: الإنجليزية

t1555-005-password-managers

Adversaries may acquire user credentials from third-party password managers.

لغة النص الأصلي: الإنجليزية