CyberStrikeus/CyberStrike - Page 100

t1069-002-domain-groups

Adversaries may attempt to find domain-level groups and permission settings.

t1069-003-cloud-groups

Adversaries may attempt to find cloud groups and permission settings.

t1069-permission-groups-discovery

Adversaries may attempt to discover group and permission settings.

t1082-system-information-discovery

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

t1083-file-and-directory-discovery

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

t1087-001-local-account

Adversaries may attempt to get a listing of local system accounts.

t1087-002-domain-account

Adversaries may attempt to get a listing of domain accounts.

t1087-003-email-account

Adversaries may attempt to get a listing of email addresses and accounts.

t1087-004-cloud-account

Adversaries may attempt to get a listing of cloud accounts.

t1087-account-discovery

Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment.

t1120-peripheral-device-discovery

Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.

t1124-system-time-discovery

An adversary may gather the system time and/or time zone settings from a local or remote system.

t1135-network-share-discovery

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of in...

t1201-password-policy-discovery

Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment.

t1217-browser-information-discovery

Adversaries may enumerate information about browsers to learn more about compromised environments.

t1482-domain-trust-discovery

Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments.

t1518-001-security-software-discovery

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.

t1518-002-backup-software-discovery

Adversaries may attempt to get a listing of backup software or configurations that are installed on a system.

t1518-software-discovery

Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment.

t1526-cloud-service-discovery

An adversary may attempt to enumerate the cloud services running on a system after gaining access.

t1538-cloud-service-dashboard

An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features.

t1580-cloud-infrastructure-discovery

An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment.

t1613-container-and-resource-discovery

Adversaries may attempt to discover containers and other resources that are available within a containers environment.

t1614-001-system-language-discovery

Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host.

t1614-system-location-discovery

Adversaries may gather information in an attempt to calculate the geographical location of a victim host.

t1615-group-policy-discovery

Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that ca...

t1619-cloud-storage-object-discovery

Adversaries may enumerate objects in cloud storage infrastructure.

t1652-device-driver-discovery

Adversaries may attempt to enumerate local device drivers on a victim host.

t1654-log-enumeration

Adversaries may enumerate system and service logs to find useful data.

t1673-virtual-machine-discovery

An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host or hypervisor.

t1680-local-storage-discovery

Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number.

t1021-001-remote-desktop-protocol

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP).

t1021-002-smbwindows-admin-shares

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

t1021-003-distributed-component-object-model

Adversaries may use Valid Accounts to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM).

t1021-004-ssh

Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH).

t1021-005-vnc

Adversaries may use Valid Accounts to remotely control machines using Virtual Network Computing (VNC).

t1021-006-windows-remote-management

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM).

t1021-007-cloud-services

Adversaries may log into accessible cloud services within a compromised environment using Valid Accounts that are synchronized with or federated to on-premises user identities.

t1021-008-direct-cloud-vm-connections

Adversaries may leverage Valid Accounts to log directly into accessible cloud hosted compute infrastructure through cloud native methods.

t1021-remote-services

Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC.